Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1292 Thanks!
[Music]
don't rock us too hard owning ruckus AP
devices which will be I think one of the
more hardcore hacking talks as we like
it here to Congress please give us big
again a warm round of applause and I'll
be good to go
awesome okay so I'm doing the live demos
so I need to just be prepared with some
stuff with a terminal here this is
always good and another one why not
and okay
wait what come on Oh scary
alright yeah now I am almost good to go
awesome
well thank you and thanks ECC for
inviting me to speak here before I begin
I would last I would like to ask if
anybody is familiar with raucous network
devices raise your hand all right okay
all right well CCC gonna hate me for the
next slide but the first time I saw
raucous access point was when I intended
blackhat USA this year I noticed that
raucous provide their conference Wi-Fi
and when I got back home I was wondering
how many vulnerabilities were discovered
on Arrakis equipment so I did a quick
research on CV details calm and I saw
that ruckus had 11 CVS and five of them
were critical doe CVE were post attenti
cated command injection well this means
no three of RCE
were found on raucous devices and only
post of authentication
so that either means that they are
really really secure or I'll let you
answer this question yourself
so wait before begin Who am I
my name is God's war I'm from Tel Aviv
Israel I'm a research leader at Aleph
research by HCl AppScan and I've been
doing reversing for around 10 years and
I focus on offensive and embedded
devices research and in this talk I will
be using this ruckus are 510 Unleashed
ruckus has an Unleashed version for
every access point they provide unleash
our access point that don't rely on
Wi-Fi controllers however all access
points on this list share the same
vulnerable code base and I notice that
some völler bilities also work on zone
director product line which is their
Wi-Fi controller the vulnerabilities I
will show affect this femur version and
prayer fuel analysis was pretty much
straightforward no compression no
encryption and on the are 510 you can
even get the can of be config from some
odd wizard
well another cool thing about this
research is that I did this entire
research with device emulation only when
I actually found a vulnerability I
actually bought a device now I would
like to talk about my device simulation
environment I'm using my simple yet
useful emulation Dockers on my docker
hub I got pre-built qmu systems for
different architecture such as our v7
our v6 MIPS and MIPS l and these Dockers
really helped me emulating and setting
up different routers for this research I
used docker that wraps an arm v7 qmu
that runs Debian kernel and now I would
like to show you how is it is to set up
an environment and that of course does
not work so let me just just a minute
okay so just a few more minutes and I'll
show the video okay got it
oops awesome okay so here so here I'm
just starting my docker with port five
five seven five and I am first forward a
bit because it's not the Edit one and
here just stars out it takes a few
minutes so I cut it out from the
original video
I'll just all right now I'm gonna go to
the fuel extraction folder and just
TARDIS pacifist route system and now I
can just copy it using SCP to the port
the docker map to and now I just tore it
and then SSH to the doctor and I got the
tar geez that file I'm gonna extract it
get into the folder sorry get into the
folder and just is truth to change my
route to this squash a face in a minute
yeah
all right so now I'm running truth
change my route and now I got the
raucous Bunner and the busybox the
rocket busybox and I can see there in
its D scripts which are the start of
strips okay this is it for the doctors
and let's start with some exploits so
this is my first RC in this attack I
will fetch admin credentials without
authentication and then pop busybox
shell
with gel breakthrough SSH and let's
start with live demos because demos our
fun and what could possibly go wrong
right
just about everything but yeah all right
so for this I got my terminal and
awesome let me just do this okay great
so now I'm gonna fetch a file from the
router so I'm just using W get and this
is my router IP address the one here and
I'm fetching a file from slash user
slash WPS - oh [ __ ] thank you very much
for that yeah like them I was right
they told me not to do that okay so this
is the right terminal and let me just
adjust it as well got it
so this one you see right yeah okay so
I'm using W get and I'm just gonna fetch
a file from the router IP from user WPS
tools to cache slash bar / RP and key
dot rev that so I probably got a type of
here and yeah so now I got the number 8
and I'm now I'm gonna fetch the same
file only with 8 and pipe it through
strings and grab something called
all-powerful login and hopefully I got a
typo okay got it all for logging
hmm yeah I'm gonna copy/paste the hell
out of it
with the right number which is 8 and
this is it finally so those are the
admin credentials I just fetch them
unauthenticated just like that
and now to finish my exploit I will just
log in to the SS age using the
credentials I just fetched and now I
will enter the debug mode script mode
and use exit command to run being a sage
and as you can see I got my busy box and
I am the admin and I am part of the
routes group and this is it thank you
Wow live demos are tough okay
so let's understand what we just saw
here
so I started by examining the web server
configuration raucous uses embed this as
its web server interface and this is how
the configuration file looks we see that
it uses slash web as its web root
directory and we also see that it uses
EGS handler for dot EGS and dot JSP
extension EGS is embedded JavaScript
back-end language that the web server
uses but the most important thing is
what we don't see here we don't see any
file fetching requite restriction whoops
that means I can fetch any file from
slash web directory regardless of its
file extension or type in other words no
access control whatsoever yes so now
that I know I can fetch any file I would
like to look for some interesting file
to fetch there are 67 files that are not
standard web pages eight of them are
symbolic
Lynx and one in particular is this
symbolic link to /tmp deer yeah
that means every file I will fetch from
slash user slash WPS underscore tool
underscore cache gonna fetch files from
the TMP folder yeah and since I was
emulating the router using qmu system
old I could run the system any scripts
and I know this that some files are
written to /tmp on system startup one of
them was this one rpm dot log this log
shows that every day the router write a
Becca file called rpm key with a
different reversion number and that file
looked like a really good file to fetch
the problem was that it righted to slash
var slash run I can only fetch files
from /tmp well it's not a problem since
slash var slash log slash var slash run
is also symbolically linked to slash
temp slash var slash run yay for me
right so now let's see how I was able to
fetch this rpm key file so yeah slash
user slash WPS to cache is symbolically
linked to TMP
var run is symbolic linked
symbolically linked to TMP var run now I
was needed to get the RPM key reversion
number here it's 11
well there's a file called RPM key dot
rev that just stored this number so I
first needed to send a request to get
this number and after that I can just
fetch the right rpm key file ok so now
that I fetch this RPM key file I notice
that it contains some binary data so I
just pipe it into strings and as you can
see here this are the admin credentials
in plain [ __ ] text right yeah
okay great so to finish my RCE
I wanted a busy box shell as the sage
can be an can be enabled from the web
interface but the thing is ruckus are
using their own CLI at first I tried to
run busy box with hidden command called
exclamation mark V 54 exclamation mark
and as you can see it's supposed to exit
the CLI and enter the operation system
shell but the problem was that it needed
the device serial number and I don't
necessarily got this number so I had to
use a different approach
eventually I used the CLI debug script
mode that was only supposed to run store
shell scripts
however this exit command is vulnerable
to pass traversal so I just used it to
run being a sage and I got a busy box
shell as route awesome
so after this beginners level CTF
vulnerability it got me thinking there
are probably more of an ability to
discover here and I was wondering in how
many ways I can get code execution on
those devices so this is my second RC
attack here I'm exploiting a stack
overflow vulnerability with an
authenticated request to an ad jack
okay but before that I would like to
talk about
deidre scripts I wrote that really
helped with a reversing process so
ruckus has left all the lock strings in
the binary as you can see here we got
debug error info warned just about
everything
and here we can see a dude rowdy
compiled code for a function and it's
debug log print what's even better is
that ruckus also praying the function
name for every log print so I wrote a
script that just search for this log
print and rename the onion function with
a function from that lob print so here I
just updated the name to get
zdn instead of their undefined function
here we can see a binary called EMF D I
was able to reduce its undefined
function from 1500 to less than 900
which made the reversing process way
shorter based on that script our team
member verenao tajen eric stripped for
Diedre this script search for patterns
in Deidre decompile called and renamed
the function with matches now I would
like to show you how the script can work
not only on ruckus code here is Deidre
the compiled code for dropper executable
that was compiled with a trace option
here we see that it's log string
contains function name this is buff get
see the ECDSA Prive kam our script uses
records to match the lot print and group
the function name then it replaces the
function name with the group matches so
this is how we mapped this is how we
managed to retrieve function name for
dropper binary as well ok yeah so this
script is already available on our live
github account feel free to use it it's
really useful for many projects all
right but back to my second attack so
now I would like to present three
important binaries in the web interface
the first one is slash bin slash webs
this is the actual embed this web server
it handles HTTP requests and execute
handlers according to the configuration
we just saw it then sends command
through a UNIX domain sockets to EMF D
EMF D is an executable that contains the
web interface logic it Maps function
from the web pages to its own function
it then implement web interface commands
such as backup network configuration
retrieve system information and much
more
Libby MFD . so is a library that used by
EMF D for web authentication some
sanitation and some code execution and
now in a diagram so webs listen to HTTP
slash HTTP if it receive JSA page it
uses eg a sender to pass function to EMF
d EMF D then checks if the function name
is mapped and if so he calls the
function pointer and eventually en FD
runs some kind of shell command for
example if config IP tables wrote route
and etc I will get back to this later
but look at this carefully because this
is where everything messed up okay for
example when I'm sending an HTTP request
to slash admin / underscore update guest
image name dot JSP web's invoked the EGS
handler this handler uses a function
called delegate which sends a command to
EMF D through a domain UNIX socket EMF D
then Maps every string it received to a
function pointer and runs it here we see
that ETS handler uses upload verify
string to to send to MFD and en if they
then maps this string to a function also
called upload verify all right next
let's talk about how the authentication
mechanism work so there are four
permission levels admin user FM and
guest here we see that each user has
paid with delegate function call
for example FM login uses of FM and user
login uses off user and so on once the
user is authenticated his session is
stored for a specific period of time
each JSP page should check if the
session is valid before calling other
delegate function here we see that
underscore
CMB state dot JSP
calls session check before equals the
objects in this state and that means it
checks for valid session before iran's
the object CMD state alright so I used
grep and got 67 pages that did not
perform any kind of check I then listed
all the different function that can be
reached without authentication and one
function that looked very interesting
was this Ajax restricted CMD state here
we can see that it does not perform the
session check and it can be reached by
sending a request to flashtool slash
underscore RC and this date dot JSP
but enough about enough with the talk
let's go to my second demo which is the
stack overflow exploitation right again
I've just use my terminal yeah yeah just
like there was all tough apparently okay
yeah okay so now everybody yeah awesome
so now first I would like to tell that
my router on port 1 2 3 4 5 and see that
nothing works which is good and now this
is my payload so I'm this is my overflow
and I'm gonna call 10d with minus L and
minus P 1 2 3 4 5 ok and now let me just
post this payload and hopefully I will
not have any typos god help me
tools and underscore RC + V state dot
JSP
great so in a second it should work
awesome
so I got a
message okay which is a great indication
and now I can just tell that my router
on port 1 2 3 4 5 and as you can see I
am the admin and again I am the part of
the group route yeah this is it thank
you
ok so to understand how I was able to
exploit this stack overflow I would like
to explain how the adjective
works I was able to run both embed this
web server and ENFP on the QM assistant
emulation and that's how I was able to
inspect a standard web request like that
here I call the underscore C underscore
CMD stay JSP page which is mapped in
anfd
to a function called Ajax CMD state make
sense attacks in this state receive an
action attribute from the request since
the action is do command it uses
something called adapter command adapter
do command then calls the command
function the command is a large switch
case function that executes different
command based on the attribute it gets
in this example it gets get connect
status which calls a function called CMD
get internet steps now let's look on a
page that do not perform session check
EMF D Maps underscore our CMD state JSP
- a function called Ajax restricted CMD
state this is where the R stands for the
function also called objects in this
state but with a very limited set of
commands this specific request pass zap
D to do command and it runs an
executable called zap this is how
Zab command runs in the shell we see
that we can control its server and
client argument bypassing the attribute
server and client the thing is server
and client are not sanitized good enough
so I can just pass unattended arguments
to zap for example this - de / tamp /b
crush me please okay so I was able to
find zap sources online raucous describe
it as robust network performance test
tool and when I examined the code I
noticed there is a stack overflow in the
- the argument here's the code that
parses - the argument let's see what it
does so first it replaces all comers
character with spaces then it copies
every segment - 10 buffer since it
expects the number this is a very small
buffer and well they try to be secured
by using by copying string with STR and
copy but they used the entire string
length for n so it doesn't really
protect the string in any way and I was
able to smash the stack as for
expectation are 50 are 510 uses both an
X and a SLR to overcome annex I decided
to use Rob gadget I use to Gajic to run
system with a pointer to my payload in
this case I'm using telnet D that runs
slash bin slash sage as a login page on
port 1 2 3 4 5 s for SLR sends app is
forth from EMF D I can use a brute force
approach and by that overcome its 9 bit
of randomness ok so now I would like to
look at request that runs app command
again so if I can control the server and
the client attributes
can I just use it for command injection
so to understand this I need to
understand how zap command is being
executed here we can see that do command
uses x-axis CMD implementation to run
this app to run zap x-axis same the
implementation is a function in leap EMF
this function first called find sis
wrapper function and then it uses V fork
and exit V to execute the shell command
let's look on find sis wrapper the
compiled code we see it looks for slash
bin slash this wrapper underscore
wrapper dot sh if the script is
available it update a global variable
that I named sis wrapper path now x axis
command implementation executes slash
bin slash sis wrapper and in our case it
runs zap command with the argument from
the adjectives equesticle and client
here we can see the sis wrapper dot sage
line count and it's seems like a very
big script but it handles many command
but what interesting may is the Zap
execution command here we see that slash
bin slash app is being executed with opt
variable this variable received both
server and client values from the
request however ops get its value with
quotation mark and that stops me from
injecting code and well that made my
life sucks for a while to be honest but
what kept me entertained and motivated
was that ruckus had the weirdest CLI in
their finger alright so before I
continued to my next attack I would like
to show you other rocker CLI so this is
the CLI I had to escape for the first
attack this is an entire different CLI
that also being used by the device I
noticed that it can be reach after
system startup this CLI also got a
hidden command exclamation mark V 54th
summation mark that also supposed to
escape to busy box but it also needed
the device serial number and it was no
good to me
however this V 54 command uses content
from this file / writable slash EDC
system access the content of the Access
file was written by another hidden
command called ruckus
I discovered that by passing this string
to ruckus command I was able to inject
code and escape the show but now for the
real for the weird stuff when I called
ruckus command to save my payload this
is what I got and this one and this one
yeah woof-woof
bow-bow and rough yeah Roku CLI actually
box at me yeah so when I call V 54 to
execute my command injection I was asked
what the Chow as in Chow Chow dogs what
the actual [ __ ] no seriously well at the
end I was able to run a busy box shell
and I didn't really care about those
weird Easter eggs but it was still a
pretty entertaining yeah well I still
wanted to achieve free off remote code
execution by command injection and I
just knew that EMF D got to be
vulnerable it it took me some time but
eventually I made this possible and this
is my last attack where I found a
command injection vulnerability and I
was able to reach it without
authentication by writing a web page
alright so as I mentioned before EMF D
execute code in a really messy way EMF
this some
uses lip EMF other times called
shell script cease rapper and sometimes
it just runs the command itself with lip
see these are all the different function
that EMF D uses to execute shell code
here we see that there are 107 lips this
system function call so I had to find a
page that uses this function code
without sanitation I was able to find
for function that calls system without
that code system and were vulnerable to
command injection and today I will be
showing the last one which is CMD import
AVP port all right so to reach the
vulnerable function I need to send an
adjective equestrian slash underscore
CMD state the dot JSP and my request
should look like this I'm passing the
command I'm passing a command with CMD
equals import AVP port this also uses
the command to call CMD import AVP port
function this function uses lips
assistant function unsafely here we see
the function the compiled code all I had
to do is to pass command injection in
the upload file attribute and as you can
see it just executes the code right so
this is it that that's the win
well not exactly I still needed to be
authenticated to reach this function
well the problem was that seen this
state's page check for session and only
then it calls the vulnerable function
object CMD state all right so I need a
different approach and what if I could
write a page that only calls adjectives
this state and do not use the session
check hole it might actually work for
this I decided to use the zap executable
again
that has a lot of different arguments
and we already know that we can pass
unintended arguments to it without
authentication one of them is set path
for the zaps log however writing a log
is not enough for me I need to control
the content for this I use tag sub and
note argument they are a string and just
so they get it string and just write it
in the log file for some extra
information here is the log file writing
code
it get the file path directly from minus
l you can control the log content by
passing arguments note tag and sub okay
great but there are more problem to
solve here I wanted to write a page and
it has to be in the slash web directory
the problem was that slash web is a part
of the squash affairs file system which
is a read-only file system I needed to
find a writable path inside web
directory
luckily slash web slash uploaded
directory is symbolically linked to /
writer / e TC / air spider and this
directory is on a writable file system
yay for me okay so now I knew that I can
write file with my content to the web
directory the only problem left to solve
was the ads app executable needed to
connect something called
TX station otherwise it won't write
anything to the log file since I got
zapped sources I could just compile zap
D which is that text station and now I
can set that to connect to station on my
computer awesome so this was the request
I needed to send it executed this zap
command
notice that I used two arguments - S sub
and minus T tag to write my delegate
call
finally Zappa's wrote a phone to slash
web slash uploaded slash index dot JSP
although this fare this page was full of
junk that didn't bother me because what
interest me was the delegate call to the
phone vulnerable function now I can
change those two vulnerabilities
together first I write a page to slash
web slash uploaded slash index dot JSP
now I can send a command injection panel
to the page I just wrote and this is the
time for my last demo which is the most
difficult one so good luck to me
ok so first I will need another terminal
yeah this is it and so in this one I
will run zap D which is the TX station
and I will listen to pause for for for
with netcat great and now for my other
terminal ok great so now I would like to
show you the page create payload so as
you can see here I'm using the server
and set it to my computer and I'm using
the minus L to write a page and minus T
and minus s to write the delegate
function call to add Jack's CMD state
and now I can just post it H create is a
to my router
/ - slash underscore our CMD state dot
JSP no typos and in a minute it will
just reply and say ok awesome so now I
wrote a page next I would like to show
you my
command injection payload so here I am
using NC on the router and with
netiquette I'm just connecting to my
computer on port 4 4 4 4 4 4 4 4 with
reverse shell and again I will post this
command injection to the router uploaded
slash index dot JSP
oh yeah [ __ ]
sorry about that ok again great and now
hopefully hopefully I'll see that I am
the root user one more second
again and now be root you know you don't
see them anymore ok in conclusion I
demonstrated 3 pre of RCE today the
first one was credential leakage with
CLI jailbreak the second one one was
stack overflow without authentication
and the last one was command injection
with authentication bypass I also shared
my daugher setup and introduced a very
useful deidre script that helped with my
research and Cal can help others raucous
networks was inform above these
vulnerabilities
I requested 10 CDs for this research and
they confirm these CVS
if there are any ruckus user here you
should stop what you're doing
and go and check that you're running the
latest firmware update if not you may be
victim to some very serious abuse so
again please check your femur ASAP okay
and well this research was a lot of fun
it involved all sorts of different
vulnerabilities it was also an excellent
opportunity to check our documentation
environment which proved itself very
useful a blog post with all the details
will be posted but since Rockhurst asked
really nicely I will wait with my post
until January 6 so stay tuned for my
blog at Aleph research blog and while
you there check our amazing research and
this is a thank you very much for
listening
[Applause]
thank you for this great talk so now we
have quite a lot of time for Q&A so you
already know the game queue up at the
microphones or ask the ask question on
the Internet
we will today start with the Internet so
please all right so there are a couple
of questions your the first question is
or will this work on unleashed firmware
of rocker say P yes definitely will no
not the latest but the entire research
was conducted on the Unleashed version
all right now let's do an in drone
question first a microphone number one
case so thanks for the great talk first
then you mentioned that there were 107
handlers for which Colt system at some
point and I hope you didn't check them
manually so my question would be you
probably used
deidre to to search for those how would
it be yeah so the the system the
reference count just gave me a really
good indication that they're doing
something wrong and when I actually
searched for command injection I first
look what are the reachable pages that
uses system so that narrowed the list to
something smaller which was still around
like 15 12 15 also so I just so that the
command injection was done pretty much
manually with Dedra no fancy scripts
here so no analyzing of the call of the
call tree in Dedra no okay sure all
right microphone number two please
um first of all let me just express a
what the actual [ __ ] and secondly from a
networking consultant perspective
the what one usage in your scripts it's
easy but please don't do it because
people tend to use quad one as a leach
IP address in their systems for dummy IP
addresses which is actually DNS server
on the public Internet
and just comment the extra question is
the all your attack your attack vectors
are against when you are able to reach
the system on a layer three basis right
yeah correct
so both of the all of the attacks are
from both the Internet or the van but
yeah only they're three so okay and in
the end I can only offer you that I have
some hardware from an orange vendor I
can offer you if you want to use some
for the exploitation on other vendors
yeah why not oh all right
the Internet has another question I
think rent right so Trenton wants to
know is the virtual smart zone mode also
affected no only access point and some
of the vulnerabilities as I said also
work for the zone director all right
number two please thanks again for the
entertaining talk and I noticed that on
some of the slides there was like a
hard-coded cross-site request forgery
token so I just wanted to ask what's up
with that and where you able to find
more places where there are basically
security boundaries crossed by a
hard-coded string like that yeah so we
found so I try to focus
my research more on the the low-level
and like stackoverflow and and command
injection from the binary analyzed but
yeah we saw some web vulnerabilities one
of them is is a seraph and another might
be with the tokens that it's still hard
coded there are a lot of things to to
keep on looking in those fingers so you
didn't report that one know that the
hard-coded one not yet okay thank you
all right
the Internet right so how much time did
you invest in total for ripping this
device into little pieces and so many
ways so it took me one month the first
exploit I found I found relatively fast
I think it took me around two days and
after that the whole the other analyzed
took me around three weeks or so alright
microphone number two thank you for this
awesome talk I really enjoyed it and the
first first bit of the presentation was
a little bit fast for me
the docker part how did you discover
that you can run the the Roxas firmware
in your own docker container can you can
you please repeat your question how did
you discover that you can run the Roxas
firmware in your own docker container so
that you can discover all these flaws
yeah so so I skipped a few steps so I
basically used bean walk and after I
extracted so I download the fewer used
bean walk and then bin work usually
extracts the splash of s which is the
fewer file system difference in file
system so I just copied into my
and because it's a cross architecture
docker it runs the ARM architecture and
I was able to actually run the code from
the finger dial use of space code okay
thank you sure
all righty any other questions you have
30 seconds to invent a question do you
have 30 seconds of content no I can do a
fancy dance or something like that all
right yes please yeah I wish I could I
always say good all right still no
questions well then a goodnight to
everyone of you and thank our speaker
again please
[Music]