A couple years ago I mentioned in a SecurityFocus column that Windows has a problem when you put a file named “program.exe” in the system root directory. The problem is basically in how it deals with spaces in paths that don’t have quotes around them. Anyone with the permissions to create a file in the root directory could create a malicious program that could escalate their privileges. Here’s an excerpt from that article:

Suppose that you want to run the following command:

C:\Program Files\Internet Explorer\iexplore

One cool thing about Windows is that although the path contains a space, it still runs the application fine, even if you don’t place quotes around the entire command and even if you don’t use the executable extension for iexplore.exe.

But how does Windows know where the program path ends and the program’s command line parameters begin? How does it know that the user isn’t trying to run a program named “C:\Program.exe” with the parameter “Files\Internet Explorer\iexplore?”

The problem is that it doesn’t know. It just starts at the beginning and tries finding an executable until it finds a match. So in this case, it will try these files every time you run the command:

C:\Program.exe
C:\Program Files\Internet.exe
C:\Program Files\Internet Explorer\iexplore.exe

Today I ran across the program.exe file I mentioned in the article and thought I’d try it out again. I placed program.exe in my root directory and rebooted. Sure enough, several programs showed up in the log file. Looking through my Registry, I noticed that there are still thousands of file paths that include spaces and don’t have quotes around them. Program.exe is just one of the many ways you could exploit this. If you were targeting a specific executable you could probably hide it somewhere else in the path. In fact, you could also exploit DLL files and COM components using the same technique.

Microsoft has been aware of this issue since Windows NT 4, and it affects every version of windows since then, but surprisingly few people have really exploited it. Microsoft added a check for “C:\Program.exe” at startup but there is a Registry key that turns off this check. This key is:

Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
\Explorer\DontShowMeThisDialogAgain
Value Name: RogueProgramName

If you set this value to “no” then the dialog box will no longer pop up. Here’s the problem: it is a user key and is probably warning the user way too late. Many services and other components run long before a user logs in. A program that runs as a service could easily add that Registry key for all users on the system. The check is also largely insufficient because there are many other paths in the system where you could exploit this.

So what does my program do? Here’s a rundown:

1. It sets the “RogueProgramName” registry value to “no”
2. It logs the program’s parameters and user context.
3. It constructs a path to launch the original program

Download program.exe and place it in your system root directory. Run it once to set the registry key. Check back after a while, especially after a reboot, and see what it logged. The program will store its logs in a file called program.dat. The program isn’t that smart and there’s no error handling so don’t expect everything to work perfectly.

Note that you could also try this in other directories that have spaces in the name and might hold executables. Try renaming it to documents.exe to catch programs run from c:\documents and settings\. You could also rename it to common.exe and placing it under the Program Files directory.

Of course, with little effort this program could be modified to be much stealthier and do some very bad stuff. In fact, bad enough that this problem really should be addressed better than it currently is.

You can download the files here:
program.exe 19kb
VB6 Source Code 12kb

When your website is ready to be launched you should start looking for a quality web host to get a web space and that provides a variety of web hosting services and can help in the web site design of the company as well. One such good company is hostmonster. The rapid increase in the wireless internet servicesand dsl technology, web based businesses is becoming more and more common. Business communication has become cheap and flexible through the voip technology.

No tag for this post.