our discoverings


---------------------------------------------------------------------
AIM FAX - contributed by Sphartex

When connected to AIM there's always two connections 
opened up on port 5190 starting with the IP address 
205.188 my assumption is that one of these is for data 
going out and one for data coming in.

Known vulnerabilities include "warn" DoSing but it can only 
work with the help of others and even at that its not very effective.

IP Address can be determined with direct connections such 
as "buddy icon" file transfers and these can be mimicked 
by deleting your buddy icon so as to send another one to the 
person who's IP you want and have your fireall up when it sends, 
you're firewall (if you have a decent one) will display a log 
of connections, look at the log while the file is sending and 
it should be pretty obvious. Alternately, you can delete the 
icon that your "buddy" sent you so he can send you it again 
automaticaly, now ofcourse this option wont work if you're 
harrasing someone you've never spoken to.

All direct connections are vulnerable to revelation of an IP 
address these include File transfers, buddy icon transfers and 
IM image transfers.

Since AIM allows for limited Hypertext Markup Language to be 
executed whithin the AIM box its just enough to use Microsoft 
window's vulnerbily in DOS. You can do this as a link. 
Just type the following in the text box: 
<a href="c:\com1\com1">Click here to get nuked</a> 
Now this only works if the person who's computer you want to 
inflict a "blue screen of death" to hasn't updated the 
microsoft critical patches, which means you can get away with 
this with the average luser. However, as far as I know... the 
patch only fixes the problem when a person uses com1 and lpt1 
so there may be more possibilities out there.

You can cause programs to open up, such as notepad or whatever 
but it requires the receiving end's consent. The code 
<a href="c:\windows\notepad.exe">Click here</a> can accomplish 
this, but when the user clicks on it, its considered as a download.

One of the problems with AIM is this new buddy icon feature 
which almost forces that icon to get through, now we all 
know the possibilities that lay before us. This 
buddy icon doesn't even have to BE a buddy icon, it just 
needs to have the proper file extention that's all. And we've 
all heard experienced those stupid viruses sent over IRC with 
bootleg file extentions that can do some damage.


---------------------------------------------------------------------
aim - contributed by psytek
allows you to view the other persons ip address when
you connect to send im image or send a file.

known port numbers are

5190 for basic connectivity
1510 (on remote machine) for file transfer


---------------------------------------------------------------------
AOL Instant Messenger (AIM) protocol information and password decoder
by james@foo.org contributed by Sphartex

A quick note: please, do not kick and scream if this is old news; I
don't really watch these things and this is the first I've seen.

 AOL Instant Messenger doesn't seem to make too much a point of
 security. Security really isn't very friendly though, and it sure
 would slow a large system like AOL down.

 I've successfully signed on to the AIM network illicitly using
 a couple  different methods. You may say "So? This is just a chat
 network." That excuse doesn't work, look at how many people use
 it every day.


 First, the hash that AIM uses to "encrypt" user passwords going
 over the network is awful. I can only assume that it's not meant
 to provide any security at all, in which case .. *sigh*

 An AIM password must be between 4 and 16 characters. I got this from
 the AIM "Change your Password" screen. When the AIM client signs on
 to the authorizer, the encoded password presented is the same length
 as the decoded form. After a little number crunching, I've found
 that the hash used to encode the password looks like this:

 u_char hash[16] = { 243, 179, 108, 153, 149, 63, 172, 182,
                     197, 250, 107, 99, 105, 108, 195, 154 };

 The user password is simply XOR'ed with this. All the server has to
 do is XOR this hash with the encoded password to get the original
 text. In other words:

         for (i = 0; i < 16; i ++)
           crypt_pw = cleartext_pw[i] ^ hash[i];

 As far as I can tell, this data is static; it's used by all the
 clients I've played with anyway (AIM for Windows '95 and AIM for
 Java version 1.2). It may be different for different versions of the
 client, but the client sends it's version information over the wire
 too so this is a moot point.

 If you sniff a user's connection to the authorizer you have yourself
 the user's cleartext password and can do with it what you will.
 Impersonate them, deny them access to AIM, etc.

 There are a number of alternative ways to do this simple password
 authentication, and not all of them require fancy (read: slow)
 encryption.

 This next method isn't as sexy as the previous, but it works nonetheless.

 Once the AIM client has authenticated once, it never has to do it again.
 The server sends it a cookie, much like a Kerberos KDC gives a client a
 TGT. The cookie lets a user signon quickly to another service.

 But what happens if you can get that cookie? You can steal a user's
 cookie, flood the user or reset their connection so that they can't
 reach the destination server, and login with their cookie yourself. I
 have only tried this with the BOS server; it will probably work just
 as well with the ad servers, chat & chatnav servers, and the directory
 servers. I assume they all run basically the same server software,
 with software modules that plug-in to provide the various services.

 The server's appear to be doing some sort of traffic filtering at the
 transport level. If my host hasn't been given a cookie, it won't let me
 connect to any services. This traffic filtering does not seem to be tied
 to the cookie however; as long as you have a legitamate reason for
 connecting to the server it will let you on.

 Wouldn't it be fun to sneak up on an AOL staff person, sniff their
 traffic, and find out if they have access to any "hidden" commands? :-)


--------------------------------------------------------------------------
and yet another Sphartex contribution :)


 21 June 1998, james@foo.org 

Date: Mon, 19 Apr 1999 22:00:00 -0500
From: Adam Brown <mad@SKILL.ORG>
To: BUGTRAQ@netspace.org
Subject: AOL Instant Messenger URL Crash

There is a bug in the newer versions of AOL's Instant Messenger that will
cause the client to crash when exploited.  All builds of version 2.0 that
I've tested seem to be vulnerable, although I have not done extensive
version testing.  AOL was notified of this about two weeks ago.  To exploit
this bug, send a hyperlink in this format: aim:addbuddy?=screenname

Have fun,

SpunOne

http://www.fazed.net

http://www.webzone.net

--------------------------------------------------------------------------

Date: Tue, 20 Apr 1999 16:24:02 -0400
From: Daniel Reed <djr@NARNIA.N.ML.ORG>
To: BUGTRAQ@netspace.org
Subject: Re: AOL Instant Messenger URL Crash

On Mon, 19 Apr 1999, Adam Brown wrote:
) There is a bug in the newer versions of AOL's Instant Messenger that will
) cause the client to crash when exploited.  All builds of version 2.0 that
) I've tested seem to be vulnerable, although I have not done extensive
) version testing.  AOL was notified of this about two weeks ago.  To exploit
) this bug, send a hyperlink in this format: aim:addbuddy?=screenname
I just sent <a href="aim:addbuddy?=screenname">what does this show up as</a>?
to an AOL AIM 2.0.996 user and once she *clicked* on it AIM crashed. I don't
know if you meant to say that the user had to click on it for the client to
crash, or if this is indeed different behaviour. I also just tried it with
"screenname" replaced with first her screenname, and then with mine, again
with no automatic reaction.

(sent from linuxkitty, a naim-0.9.4-parse2 user, to <victim>, an AOL AIM
2.0.996 user)
[15:59:43] linuxkitty: [LINK:href="aim:addbuddy?=screenname":what
does this show up as]?
[16:00:23] Friend <victim> has just logged off :(
[16:03:09] Friend <victim> is now online =)
[16:14:14] linuxkitty: [LINK:href="aim:addbuddy?=<victim>":miaow
miaow] (don't click on that, I'm just testing something)
[16:14:50] linuxkitty: [LINK:href="aim:addbuddy?=linuxkitty":anoth
er test...]

--
Daniel Reed <n@ml.org>
Many a false step is made by standing still...

--------------------------------------------------------------------------

Date: Tue, 20 Apr 1999 16:34:16 -0500
From: Adam Brown <mad@skill.org>
To: BUGTRAQ@netspace.org
Subject: Re: AOL Instant Messenger URL Crash

I'm sorry if I was unclear in my first post.  The only way I've seen to
exploit this is to send someone a hyperlink in the form of
aim:addbuddy?=screenname and have them click on it.  (replacing "screenname"
with an actual screen name seems to give the same result)  You can also set
up a web page that will redirect your victim to a client crashing URL once
they've caught on to your evil little scheme. :p  I set up an example of
this at http://www.fazed.net/poof for testing purposes, of course.

Adam Brown
SpunOne@IRC
http://www.fazed.net
http://www.webzone.net

--------------------------------------------------------------------------

Date: Wed, 21 Apr 1999 14:30:40 -0400
From: Eric L. Howard <elhoward@MARKL.COM>
To: BUGTRAQ@netspace.org
Subject: Re: AOL Instant Messenger URL Crash

I haven't been able to duplicate this on any 2.0.8* builds...I've tested about
15 different people and none in the 2.0.8* builds were affected.

All others tested were in the 2.0.9* build and died immediately, some causing
the user to have to reboot, all rendering AIM completly unable to be restarted
for several minutes after the Dr. Watson cleared on NT.

        ~ELH~

--------------------------------------------------------------------------

Date: Wed, 21 Apr 1999 18:14:59 -0700
From: Adam Herscher <adam@AXISPRODUCTIONS.COM>
To: BUGTRAQ@netspace.org
Subject: Re: AOL Instant Messenger URL Crash

The problem could not be duplicated on AIM 2.0.813 (Windows 98) running IE
5.0 - Is it possible that this is in part a problem with IE 4.0?

Adam Herscher (ajh-)

--------------------------------------------------------------------------

Date: Wed, 21 Apr 1999 18:07:12 -0700
From: Adam Herscher <adam@AXISPRODUCTIONS.COM>
To: BUGTRAQ@netspace.org
Subject: Re: AOL Instant Messenger URL Crash

>I'm sorry if I was unclear in my first post.  The only way I've seen to
>exploit this is to send someone a hyperlink in the form of
>aim:addbuddy?=screenname and have them click on it.  (replacing
"screenname"
>with an actual screen name seems to give the same result)  You can also set
>up a web page that will redirect your victim to a client crashing URL once
>they've caught on to your evil little scheme. :p  I set up an example of
>this at http://www.fazed.net/poof for testing purposes, of course.
>
>Adam Brown
>SpunOne@IRC
>http://www.fazed.net
>http://www.webzone.net


This doesn't seem to work on the Mac versions (tested 2.01.644)

Adam Herscher (ajh-)