0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Prevx 3.0.5.210 config file Vulnerability
[========================================= Prevx 3.0.5.210 config file Vulnerability ========================================= Author : [STRELiTZIA] Software : [Prevx 3.0.5.210 and old] Tested on : [Windows All] ============================ = Description = ============================ Prevx uses "csidb.csi" to store user's preferences, I expected to see it after analysis, elaborate and better protected, because it contains very important information, like user's password, Enabling or disabling specific option, controling self protection levels and others. Unfortunately this was not the case. Location: \%Documents and Settings%\%All Users%\%Application Data%\PrevxCSI\csidb.csi Prevx.exe, at first time loads the configuration file in memory, and any actual and effective changes are in memory, the file on the disk used to store changes to read at the next startup. Prevx uses a very basic approach: - Stores and checks a simple '01' or '00' value at constant offsets for her options. Below X86 platform offsets, for X64 platform a small shift offsets positions. SELF PROTECTION: Offset: 000017BC Minimum = 00 Medium = 02 Maximum = 01 USER'S PASSWORD: Only MD5 hash for user's password without any additional encryption. Eg. 8B1A9953C4611296A827ABF8C47804D7 = MD5(Hello) Offset : 000031A0 (Stored MD5 hash user's password) Offset : 0000319C (Enable/Disable password checks option) Val = 00 : (Disable password check) Val = 01 : (Enable password check) OTHER OPTIONS: Offset: 00003380 Enable/Disbale SafeOnLine. 01 = Disabled. Offset: 00000B88 Enable/Disable "Right Click" Scanning in Windows Explorer. 00 = Disabled. Offset: 000017DC Enable/Disable Automatically download and apply updates. Offset: 000017A8 Enable/Disable Enhanced Rootkit Detection. Offset: 00000B9C Enable/Disable Realtime Master Boot Record Scanning. Offset: 0000323C Show the Authenticating files screen when a file being scanned. Offset: 00000B98 Disable heuristics. 00 = Disbaled Offset: 000017E4 Enable Scheduled Scans. 00 = Disbaled How to modify Prevx options manually: - Open "csidb.csi" with any HexEditor. - Go to desired offset and change the option you want, - Then restart your System for Prevx loads the file into memory with the new options. IMPORTANT: Vulnerability published only for educational purposes. # 0day.today [2024-12-27] #