BrowseGate is a proxy/firewall from NetCPlus. BrowseGate is sometimes installed on servers along with other network applications including SmartServer3 with which it is made to integrate.
BrowseGate's stores its password in a text file, hiding it by a very simple encryption algorithm, which can be easily reversed.
This means that attackers with local access to BrowseGate's configuration file can obtain the firewall's configuration password.
BrowseGate installs by default in C:\Program Files\BrowseGate\ and stores it's configuration information in the file brwgate.ini. The file is accessible, by default, to all local users. The "encrypted" password is stored under the 'scrnsze' setting, for instance:
scrnsze=Ic6li9m\
The password encryption is very weak. Though it has some other strange properties, the scheme works by adding a position-specific value to each character of the password, where seven characters encrypt differently from the rest of the character set. This scheme appears related to the one used in SmartServer 3 but is somewhat different. Look at the exploit code for more details.
Exploit:
/* This is proof of concept code for decrypting password from BrowseGate by NetCplus */
#include <stdio.h>
