Mustafa Al-Bassam's blog

Equation Group's BENIGNCERTAIN tool - a remote exploit to extract Cisco VPN private keys

Thu, 18 Aug 2016 00:00:00 +0000

In the Equation Group dump that contained NSA hacking tools, there was an overlooked tool called BENIGNCERTAIN.

Analysis of the tool shows that it appears to be a remote exploit for Cisco PIX devices that sends an Internet Key Exchange (IKE) packet to the victim machine, causing it to dump some of its memory. The memory dump can then be parsed to extract an RSA private key and other sensitive configuration information.

The tool references Cisco PIX versions 5.2(9) to 6.3(4), which was released in 2004. It is also worth noting that the Cisco PIX line of products are at their end-of-life.

The exploit consists of three binaries, each consisting of an individual step in the exploitation process.

The first step is executing bc-genpkt, which generates an IKE packet of arbitrary size and fills some of it with arbitrary data.

Usage:	./bc-genpkt [-h] [-o <file>] [-f <X>] [-r] [-s] [-v[vv]] size

	-h	help/usage
	-o file write data to named file
	-f X	fill remainder of large packets with character 'X'
	-r	randomize the initiator cookie
	-s	randomize the SPI
	-v[vv]	verbosity - show lengths, packet dumps, etc
	size	size of new packet, should be 96 <= size <= 65536 bytes

	Packets larger than 2528 bytes will be filled with random data
	unless the -f option is used.

This generates a packet file which can be used as input to the binary bc-id, which sends the packet to the victim host. Hector Martin notes that it sends a IKE packets with a large Group-Prime option, and speculates that if the victim host is replying using the request length but only filling in the requested 768 bit prime, then it returns a buffer of uninitialised data following it.

Usage:
   ./bc-id -t <dest IP> [<options>]
  Options:
      -t <dest IP>
      -l <local port>
      -p <remote port>
      -I <infile name>  [defaults to sendpacket.raw]
      -O <outfile name> [defaults to "<dest IP>.raw"]
      -f <packetfile name> Reads in packet from a file.
      -h              print this message
      -q              quiet mode.  Doesn't print hex of response packet.

The strings in the bc-id binary shows that the program seems to patch some memory and look for a start string in the response. However Hector Martin notes that this appears to be dead unreferenced code.

Patched memory at location %d with %s
  *** Error: Start string never found.
    %.*s

The bc-id program then outputs a file which can be used as input to bc-parser, a program that parses the response.

BENIGNCERTAIN parser v1.0
Usage:	./bc-parser [-c] [-h] [-u] [-v] <file>

	-c	Generate PIX configuration commands
	-h	Usage
	-v	Verbose - print uninteresting/default stuff
	-u	Hex-dump unknown structures only
	-x	Hex-dump all structures (overrides -u)

	<file>	BENIGNCERTAIN .raw file

The strings in the bc-parser binary shows what the tool extracts, which appears to include VPN configuration details and RSA private keys.

RSA private key structure at offset 0x%04x, size 0x%x bytes:
	*** Found probable RSA private key ***
RSA public key structure at offset 0x%04x, size 0x%x bytes:
	*** Found probable RSA public key ***
RSA key structure at offset 0x%04x, size 0x%x bytes:
	RSA keys were generated at %s
VPN group structure at offset 0x%04x, size 0x%x bytes
	Split-tunnel ACL:  0x%08x		%s
	Idle-time:         0x%08x		[%d seconds]
	Max-time:          0x%08x		[%d %s]
	PFS:               0x%08x		%s
	Clear-client-cfg:  0x%08x		%s
	User-idle-timeout: 0x%08x		[%d seconds]
	Authen. server:    0x%08x		%s
	Secure-unit-auth:  0x%08x		%s
	User authen.:      0x%08x		%s
	Device pass-thru:  0x%08x		%s

It also shows that it appears to be reading a memory dump.

Per-thread stack structure at offset 0x%04x, size 0x%x bytes:
CLI buffer structure at offset 0x%04x, size 0x%x bytes:
ISAKMP key structure at offset 0x%04x, size 0x%x bytes
	Pointer:           0x%08x		%s

The tool’s folder also contains various payloads for different encryption algorithms, and Maksym Zaitsev notes that the tool uses Internet Security Association and Key Management Protocol (ISAKMP) for the payloads.

3DES_MD5_payload
3DES_SHA_payload
AES_MD5_payload
AES_SHA_payload
DES_MD5_payload
DES_SHA_payload

Equation Group firewall operations catalogue

Tue, 16 Aug 2016 00:00:00 +0000

This week someone auctioning hacking tools obtained from the NSA-based hacking group “Equation Group” released a dump of around 250 megabytes of “free” files for proof alongside the auction.

The dump contains a set of exploits, implants and tools for hacking firewalls (“firewall operations”). This post aims to be a comprehensive list of all the tools contained or referenced in the dump.

Exploits

EGREGIOUSBLUNDER A remote code execution exploit for Fortigate firewalls that exploits a HTTP cookie overflow vulnerability. It affects models 60, 60M, 80C, 200A, 300A, 400A, 500A, 620B, 800, 5000, 1000A, 3600, and 3600A. The model of the firewall is detected by examining the ETag in the HTTP headers of the firewall. This is not CVE-2006-6493 as detected by Avast.

ELIGIBLEBACHELOR An exploit for TOPSEC firewalls running the TOS operation system, affecting versions 3.2.100.010, 3.3.001.050, 3.3.002.021 and 3.3.002.030. The attack vector is unknown but it has an XML-like payload that starts with <?tos length="001e:%8.8x"?>.

ELIGIBLEBOMBSHELL A remote code execution exploit for TOPSEC firewalls that exploits a HTTP cookie command injection vulnerability, affecting versions 3.2.100.010.1_pbc_17_iv_3 to 3.3.005.066.1. Version detection by ETag examination.

WOBBLYLLAMA A payload for the ELIGIBLEBOMBSHELL TOPSEC firewall exploit affecting version 3.3.002.030.8_003.

FLOCKFORWARD A payload for the ELIGIBLEBOMBSHELL TOPSEC firewall exploit affecting version 3.3.005.066.1.

HIDDENTEMPLE A payload for the ELIGIBLEBOMBSHELL TOPSEC firewall exploit affecting version tos_3.2.8840.1.

CONTAINMENTGRID A payload for the ELIGIBLEBOMBSHELL TOPSEC firewall exploit affecting version tos_3.3.005.066.1.

GOTHAMKNIGHT A payload for the ELIGIBLEBOMBSHELL TOPSEC firewall exploit affecting version 3.2.100.010.8_pbc_27. Has no BLATSTING support.

ELIGIBLECANDIDATE A remote code execution exploit for TOPSEC firewalls that exploits a HTTP cookie command injection vulnerability, affecting versions 3.3.005.057.1 to 3.3.010.024.1.

ELIGIBLECONTESTANT A remote code execution exploit for TOPSEC firewalls that exploits a HTTP POST paramter injection vulnerability, affecting versions 3.3.005.057.1 to 3.3.010.024.1. This exploit can be tried after ELIGIBLECANDIDATE.

EPICBANANA A privilege escalation exploit against Cisco Adaptive Security Appliance (ASA) and Cisco Private Internet eXchange (PIX) devices. Exploitation takes advantage of default Cisco credentials (password: cisco). Affects ASA versions 711, 712, 721, 722, 723, 724, 80432, 804, 805, 822, 823, 824, 825, 831, 832 and PIX versions 711, 712, 721, 722, 723, 724, 804.

ESCALATEPLOWMAN A privilege escalation exploit against WatchGuard firewalls of unknown versions that injects code via the ifconfig command.

EXTRABACON A remote code execution exploit against Cisco Adaptive Security Appliance (ASA) devices affecting ASA versions 802, 803, 804, 805, 821, 822, 823, 824, 825, 831, 832, 841, 842, 843, 844. It exploits an overflow vulnerability using the Simple Network Management Protocol (SNMP) and relies on knowing the target’s uptime and software version.

BOOKISHMUTE An exploit against an unknown firewall using Red Hat 6.0.

FALSEMOREL Allows for the deduction of the “enable” password from data freely offered by an unspecified firewall (likely Cisco) and obtains privileged level access using only the hash of the “enable” password. Requires telnet to be installed on the firewall’s inside interface.

Implants

BLATSTING A firewall software implant that is used with EGREGIOUSBLUNDER (Fortigate) and ELIGIBLEBACHELOR (TOPSEC).

BANANAGLEE A non-persistent firewall software implant for Cisco ASA and PIX devices that is installed by writing the implant directly to memory. Also mentioned in the previously leaked NSA ANT catalogue.

BANANABALLOT A BIOS module associated with an implant (likely BANANAGLEE).

BEECHPONY A firewall implant that is a predecessor of BANANAGLEE.

JETPLOW A firmware persistence implant for Cisco ASA and PIX devices that persists BANANAGLEE. Also mentioned in the previously leaked NSA ANT catalogue.

SCREAMINGPLOW Similar to JETPLOW.

BARGLEE A firewall software implant for Juniper NetScreen firewalls.

BUZZDIRECTION A firewall software implant for Fortigate firewalls.

FEEDTROUGH A technique for persisting BANANAGLEE and ZESTYLEAK implants for Juniper NetScreen firewalls. Also mentioned in the previously leaked NSA ANT catalogue.

JIFFYRAUL A module loaded into Cisco PIX firewalls with BANANAGLEE.

BANNANADAIQUIRI An implant associated with SCREAMINGPLOW. Yes, banana is spelled with three Ns this time.

POLARPAWS A firewall implant. Unknown vendor.

POLARSNEEZE A firewall implant. Unknown vendor.

ZESTYLEAK A firewall software implant for Juniper NetScreen firewalls that is also listed as a module for BANANAGLEE. Also mentioned in the previously leaked NSA ANT catalogue.

SECONDDATE A packet injection module for BANANAGLEE and BARGLEE.

BARPUNCH A module for BANANAGLEE and BARGLEE implants.

BBALL A module for BANANAGLEE implants.

BBALLOT A module for BANANAGLEE implants.

BBANJO A module for BANANAGLEE implants.

BCANDY A module for BANANAGLEE implants.

BFLEA A module for BANANAGLEE implants.

BMASSACRE A module for BANANAGLEE and BARGLEE implants.

BNSLOG A module for BANANAGLEE and BARGLEE implants.

BPATROL A module for BANANAGLEE implants.

BPICKER A module for BANANAGLEE implants.

BPIE A module for BANANAGLEE and BARGLEE implants.

BUSURPER A module for BANANAGLEE implants.

CLUCKLINE A module for BANANAGLEE implants.

Tools

BILLOCEAN Retrieves the serial number of a firewall, to be recorded in operation notes. Used in conjunction with EGREGIOUSBLUNDER for Fortigate firewalls.

FOSHO A Python library for creating HTTP exploits.

BARICE A tool that provides a shell for installing the BARGLEE implant.

DURABLENAPKIN A tool for injecting packets on LANs.

BANANALIAR A tool for connecting to an unspecified implant (likely BANANAGLEE).

PANDAROCK A tool for connecting to a POLARPAWS implant.

TURBOPANDA A tool that can be used to communicate with a HALLUXWATER implant. Also mentioned in the previously leaked NSA ANT catalogue.

TEFLONDOOR A self-destructing post-exploitation shell for executing an arbitrary file. The arbitrary file is first encrypted with a key.

1212/DEHEX Converts hexademical strings to an IP addresses and ports.

XTRACTPLEASING Extracts something from a file and produces a PCAP file as output.

NOPEN A post-exploitation shell consisting of a client and a server that encrypts data using RC6. The server is installed on the target machine.

BENIGNCERTAIN A tool that appears to be for sending certain types of Internet Key Exchange (IKE) packets to a remote host and parsing the response.

Security advisory - E-Detective Lawful Interception System

Sun, 14 Jun 2015 00:00:00 +0000

This is a security advisory (also posted on the Full Disclosure mailing list) co-authored by slipstream/RoL and I, for multiple vulnerabilities in Decision Group’s E-Detective “Real-Time Network Forensics and Lawful Interception System”.

E-Detective is a real-time Internet interception, monitoring and forensics system that captures, decodes, and reconstructs various types of Internet traffic. It is commonly used for organization Internet behavioral monitoring, auditing, record keeping, forensics analysis, and investigation, as well as, legal and lawful interception for lawful enforcement agencies such as Police Intelligence, Military Intelligence, Cyber Security Departments, National Security Agencies, Criminal Investigation Agencies, Counter Terrorism Agencies etc. It also can provide a compliance solution for many standards or acts like Sarbanes Oxley Act (SOX), HIPAA, GLBA, SEC, NASD, E-Discovery and many others.

Decision Group also claims that its products are used by “more than 100 law enforcement agencies”, including the National Security Bureau of the Republic of China.

1. Unauthenticated Local File Disclosure

The common/download.php script in the web root allows for unauthenticated users to read arbitrary files on the system. This may include database credentials and captured data intercepts.

The file URL query parameter of the script is “protected” by the following encoding which is trivially reversible: base64 followed by rot40.

A proof of concept for this vulnerability is available on GitHub.

2. Authenticated Remote Code Execution

Combining this vulnerability with the Local File Disclosure vulnerability above can result in unauthenticated remote code execution.

The restore feature on the “config backup” page extracts a .tar file encrypted with Blowfish using OpenSSL into the system’s root directory (/) as root.

The .tar file must be encrypted with the static key /tmp/.charlie. Yes, that’s the actual key - the software passes the wrong argument to OpenSSL. -K is used to pass the keyfile instead of -kfile, meaning that the key is the path of the keyfile rather than the contents of the keyfile.

This allows an attacker to upload a shell into the web root, or overwrite any sensitive system files such as /etc/shadow/.

Making sound from the sentiment of Tweets

Sat, 13 Jun 2015 00:00:00 +0000

This a write up of a hack I originally co-authored as “Noisy Tweets” with Mark Ormesher, Fares Alaboud and Kristin Kasavetova at MLH Launch Hack.

Noisy Tweets is an application created in 24 hours that takes in a keyword as input, live-streams all tweets containing that keyword, analyses how happy or sad (sentiment) the tweets are, and plays different musical notes depending on how happy or sad the tweets are.

The happier the general discussion, the higher the pitch of each note; the more tweets there are, the faster the notes play.

I eventually refactored it into a live web application: listentotwitter.com.

Screenshot from listentotwitter.com.

The backend of the web application is written in Python, using Flask for the web server, TextBlob for sentiment analysis, and socket.io for real-time client communication.

Admittedly, it sounds pretty bad from a musical perspective. It sounds a bit like the “world’s ugliest music”. Regardless, it was a fun experiment. There are perhaps way to make it sound more musical, but I don’t know much about making music that sounds good.

Asteroids on Steroids

Sun, 03 Aug 2014 11:00:00 +0000

Asteroids on Steroids is a desktop game I developed in Python using the Pygame library in the summer of 2012, when I was 17.

It was my first ever Python project, and although the code for this project is pretty horrible and unstructured, I’ve been hooked on Python ever since and use it for almost everything.

The idea for the game is to make it possible to play the classic arcade game Asteroids with anything - not just asteroids. Instead of shooting asteroids, you can shoot elements of any image you specify. There’s also a desktop mode that allows you to shoot at your computer desktop.

The game automatically determines what the different elements (or “asteroids”) of the user-specified image are. It does this by considering which regions of the image are connected by the same (or similar) colour. This method was inspired by the fuzzy selection tool in GIMP.

Initially, I attempted to implement my own fuzzy selection algorithm in raw Python using a queue-based implementation, but I quickly realised that Python and scripting languages in general were way too slow (for a responsive game) to process the millions of pixels in an image on their own. My implementation in Python took several minutes per image to execute. I eventually found OpenCV, an image processing library available for Python that had a “fuzzy selection”-type function (in the end it was probably unnecessary because Pygame itself has a “fuzzy selection”-type function).

The source code for the game is available on GitHub.

A screenshot of gameplay in desktop mode, on an Ubuntu desktop.

A screenshot of gameplay when an image of Barack Obama’s face is used as input.

Musical Packets

Sun, 03 Aug 2014 10:00:00 +0000

Earlier this year I attended StudentHack and formed a team with Fares Alaboud and Callum Spawforth. For 24 hours we worked on a project called Musical Packets.

Musical Packets is a Python application that listens to your aggregate network traffic and plays it back as music! It also comes with a web interface that visualises the aggregate packets received.

Musical Packets web interface.

The way it works at the moment is by converting the rate of packets received per second to a musical tone. Although it sounds pretty good as it is right now, the original idea (which wasn’t developed further due to the 24 hours time constraint) was to assign a different instrument to each network protocol or port. For example, HTTP would sound different than HTTPS.

The application also logs packets into a MongoDB database, so it has the capability of playing back the musical packets.

The project won two of the six prizes at StudentHack:

Best Use of MongoHQ
Best Fresher Hack

The source code is available on GitHub.

From left to right: Callum Spawforth, me and Fares Alaboud.

First they came...

Wed, 09 Jul 2014 00:00:00 +0000

The NSA is spying on every single person in this photo, because everybody in existence is in this photo (except for Neil Armstrong and Michael Collins).

First they came for the sysadmins, and I did not speak out—
Because I was not a sysadmin.

Then they came for the Tor users, and I did not speak out—
Because I was not a Tor user.

Then they came for the journalists, and I did not speak out—
Because I was not a journalist.

Then they came for the civil rights leaders, and I did not speak out—
Because I was not a civil rights leader.

Then they came for the politically active, and I did not speak out—
Because I was not politically active.

Then they came for the World of Warcraft players, and I did not speak out—
Because I was not a World of Warcraft player.

Then they came for the Cubans, and I did not speak out—
Because I was not a Cuban.

Then they came for the Bahamians, and I did not speak out—
Because I was not a Bahamian.

Then they came for the protest groups, and I did not speak out—
Because I was not in a protest group.

Then they came for the wankers, and I did not speak out—
Because I was not a wanker (but they are).

Then they came for me—and there was no one left to speak for me.