BadTunnel: How Do I Get Big Brother Power ?
Yang Yu @ Tencent's Xuanwu Lab

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

Who am I?
Yang Yu, @tombkeeper• From Beijing, China• Director of Tencent’s Xuanwu Lab• The guy who make the most money from Microsoft Bounty Programs • Working in information security industry since 2002

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu LabBefore 2002

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu LabNow

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu LabAgenda• Background knowledge• How to create a BadTunnel• What BadTunnel could do• How to defend against BadTunnel attacks

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

Background Knowledge

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu LabAncient NetBIOS Protocol
Name Service (NBNS)

UDP/TCP 137
TCP rarely used

NetBIOS
Datagram Service (NBDS)

UDP 138

Session Service (NBSS)

TCP 139

How ancient is NetBIOS? If you study on the research history of
NetBIOS security, your will see the name Cult of the Dead Cow.

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

NetBIOS Name Service (NBNS)• NBNS provides a name resolution service, like DNS• The packet formats of the NBNS are identical to DNS• “DNS running on port 137”

• Transaction ID of NBNS is not random but incremental• NBNS use UDP packets sent from and to port 137• The security of DNS protocol is completely dependent on therandomness of source port and Transaction ID. But NBNS
abandoned this in design• However, this is understandable, considering NBNS is designed for exclusive
use in the local area network. Name resolving is done using UDP broadcast,which can be received by all hosts in the same network. So it seems
unnecessary to randomize the source port and Transaction ID.

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

Two Types of NBNS Query• NB query, for name resolving, can work both in broadcast mode orunicast mode
• NB query be used to resolve names (e.g. “tencent”), but it can also be used toresolve FQDN (e.g. “www.tencent.com”)• For FQDN resolving, NB query is only used when there is no DNS results.

• NBSTAT query, for diagnostics, unicast• NBSTAT query is usually send by diagnostic tools such as nbtstat.exe thesystem also sent it after failing to access network share path such as\\10.10.10.10\BadTunnel• NB query and NBSTAT query shares the same Transaction ID
counter

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

C:\Users\tk>ping -n 1 WINXP

Pinging WINXP [192.168.152.129] with 32 bytes of data:
Reply from 192.168.152.129: bytes=32 time=1ms TTL=128
Ping statistics for 192.168.152.129:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1ms, Average = 1ms
C:\Users\tk>nbtstat -A 192.168.152.129
Local Area Connection:
Node IpAddress: [192.168.152.128] Scope Id: []NetBIOS Remote Machine Name Table
Name
Type
Status--------------------------------------------WINXP<00> UNIQUE
Registered
WINXP<20> UNIQUE
Registered
WORKGROUP<00> GROUP
Registered
WORKGROUP<1E> GROUP
Registered
WORKGROUP<1D> UNIQUE
Registered..__MSBROWSE__.<01> GROUP
Registered
MAC Address = 00-0C-29-DA-28-A8

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

The NBNS Transaction ID is incremental.
NB query and NBSTAT query shared the same counter.

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

Create BadTunnel

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

If Alice send a NBSTAT query to Bob:
Alice

NAT & FirewallBob

192.168.9.9

192.168.1.1

10.10.2.2

Alice:137

Bob:137

Request

NAT:52131
Bob:137
Bob:137

Alice:137

137/UDPResponse

Bob:137

NAT:52131

137/UDP“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

As mentioned previously, NBNS use UDP packets sent from and to port 137.

Host firewalls, network firewalls, NAT devices and any other network devices
cannot distinguish which session the UDP packet belongs to, so if they allow
a UDP traffic, they must allow the UDP packet on both directions.
So, the client can become the server, the server can become a client.

Now, the only question is: how to make Alice send a NBSTAT query to Bob?

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

When Windows is trying to access an UNC path with IP address, if the 139 and445 port of the target is inaccessible – either timed out or been reset – thesystem will send a NBNS NBSTAT query to the target IP address.
There are numerous ways to make a system access a UNC path.
To web browser:<img src="\\10.10.10.10\BadTunnel">
To MS Office:Set TargetMode to "External" and Target to "file://10.10.10.10/A/A.png"
To shortcut:
Set IconFile to “file://10.10.10.10/A”
To web server:
http://web.server/reader.aspx?ID=\\10.10.10.10\BadTunnel…

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

What BadTunnel could do“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

What BadTunnel Could Do?
• Hijack “WPAD”• The Web Proxy Auto-Discovery Protocol• Windows system use http://WPAD/wpad.dat to configure proxy settings• Hijacking WPAD + Evilgrade ≈ Execute any program• Hijacking WPAD = Bypass IE Sandbox• If the wpad.dat returns "DIRECT" for a site, IE will runs at Medium IL, outside of
EPM/AppContainer• Hijack “ISATAP”• ISATAP: The Intra-Site Automatic Tunnel Addressing Protocol• Windows use hosts named “ISATAP” as ISATAP router.

• Hijack nonexistent domain name• Steal Cookies• Send NBNS NBSTAT query to get LAN host name and MACaddresses

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

Using BadTunnel to Hijack WPAD
Alice

NAT & FirewallBob

192.168.9.9

192.168.1.1

10.10.2.2
Induce Alice to visit a malicious file or url

Try to visit \\10.10.2.2\BadTunnel, send SYN packets to 445/TCP and 139/TCP
Try to visit http://WPAD/wpad.dat
Send a broadcast NB query
Deny access to 445/TCP and 139/TCP
Tigger a NBSTAT query  Create a 137/UDP – 137/UDP tunnel and leak Transaction ID
Using the leaked Transaction ID send spoofing NB response via the tunnel

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

With BadTunnel, you can hijack the network traffic of every
version of the Microsoft Windows going back to Windows 95

This is Big Brother power “BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

How to defend against BadTunnel attacks

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu LabDefend Against BadTunnel• Microsoft has fixed the vulnerabilityin June 2016
• No more NBNS NBSTAT query after
failed UNC path access• No longer use NBNS to resolve
WPAD name• If you are still using unsupported
versions such as Windows XP, orotherwise can not install the patch,
you could consider disabling theNetBIOS over TCP/IP.

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

Mitigate with Perimeter Firewall
Alice

NAT & FirewallBob

192.168.9.9

192.168.1.1

10.10.2.2

137/UDP  137/UDP

“BadTunnel: How Do I Get Big Brother Power” , BlackhHat US 2016, Yang Yu, Tencent’s Xuanwu Lab

Thank you for listening!
To explore strange attack surfaces
To seek out new flaws and new weaknesses
To boldly go where no hacker has gone before