[VulnDiscuss] IE: Old tricks are the best tricks.

Description:
    Windows service pack, installation path and installed hotfixes
    detection using an old known bug in IE or a "feature" of all
    webbrowsers.

Quick fix:
    Turn off javascript in your webbrowser.

Details:

Using a year(!) old bug in IE, we have been able to detect the Service Pack
and installation path of windows. This information comes in handy when
exploiting bugs in IE or scanning machines/networks. The origional bug was
found by Tom Micklovitch and is described at
http://online.securityfocus.com/bid/3779. It allows a script to detect the
existance of any file on the local file system. Installing service packs
leaves specific files on the filesystem, ready to be detected.

I will describe the technique we designed to detect windows Service pack,
installation path and installed hotfixes. This has been tested to work on
win2k and winXP and can probably be used for winNT 4 too. (Let me know if
you want to help and are running NT) The IE version that comes with Windows
Longhorn handles non existing files a bit differently and does not allow the
detecting of all files, so it'll be more difficult (if not impossible)
to write a working exploit for that. Local file detecting is possible using
other techniques then Micklovitch's bug and is not limited to IE, as I
described a few months back (See
http://spoor12.edup.tudelft.nl/SkyLined%20v4.2/?Advisories/Webbrowser%20soft
ware%20fingerprinting for details).

-=[ %systemroot% ]=-----------------------
First we have to know where windows is running from. This can be done by
educated guessing: All versions of windows have "win.ini" in this directory.
We can test a few frequently used directory's and see if they contain
"win.ini". This will give us the path from which windows is running. (Ok, if
you install windows in a directory named "\kT9G2NbR9kH8Tx4\", it's not easy
to guess and this will not work, but for 99,99% of the systems it will)

-=[ Service Pack ]=-----------------------
The easiest way to detect the installed servicepack(s) is to check for the
files "sp1.cab", "sp2.cab", "sp3.cab", ...  in the "\%systemroot%\Driver
Cache\i386\" directory. I know you can safely delete these files after
installing the service pack but who does this ? 99,99% of the people I know
don't. You can always switch to detecting files like
"\%systemroot%\system32\sp?res.dll" for win2k, there are bound to be files
that alert the presence of a specific servicepack for other version of
windows.

-=[ Drive ]=------------------------------
Since we now know one of the drives contains win.ini and we know in which
directory it does, we can start testing "C:\%systemroot%\win.ini",
"D:\%systemroot%\win.ini", ... untill we detect it. This will tell us on
which drive windows is installed.

-=[ hotfixes ]=---------------------------
I bet you can figure this out for yourself by now. Hotfixes leave
"Qxxxxx.log" files in the %systemroot% directory. See the PoC for a far
from complete list of detectable hotfixes.

This "feature" of Micklovitch's bug was discovered and designed by Blazde,
Juano and me. Greetings go to all the other 0dd folks.

A PoC html page can be found at:
http://spoor12.edup.tudelft.nl/SkyLined%20v4.2/Detect_Win.html

Berend-Jan Wever
[email protected]
http://spoor12.edup.tudelft.nl/