Simple Network Management Pwnd Information Data Leakage Attacks - - PowerPoint PPT Presentation

▶
simple network management pwnd
SMART_READER_LITE
LIVE PREVIEW

Simple Network Management Pwnd Information Data Leakage Attacks - - PowerPoint PPT Presentation

Mar 19, 2023 273 likes •956 views

Simple Network Management Pwnd Information Data Leakage Attacks Against SNMP Introduction Deral Heiland Matthew Kienow deral_heiland@rapid7.com mkienow@inokii.com dh@layereddefense.com @HacksForProfit @Percent_X Why ? Add value ?

slide-1
SLIDE 1

Simple Network Management Pwnd

Information Data Leakage Attacks Against SNMP

slide-2
SLIDE 2

Deral Heiland deral_heiland@rapid7.com dh@layereddefense.com @Percent_X Matthew Kienow mkienow@inokii.com @HacksForProfit

Introduction

slide-3
SLIDE 3
  • Add value
  • Discover
  • Exploit
  • Curiosity

Why

?

?

?

slide-4
SLIDE 4

Why

SHODAN STATISTICS SNMP 7,205,555

  • Brazil

2,423,559

  • India

638,228

  • United States 577,780
  • Turkey

263,700

  • France

45,039

slide-5
SLIDE 5

Introduction to SNMP

slide-6
SLIDE 6

Simple

Why do we need SNMP?

slide-7
SLIDE 7

Simple

slide-8
SLIDE 8

Network Management

Monitoring Managing Manager

slide-9
SLIDE 9

Network Management

Tracking Updating Agent

slide-10
SLIDE 10

Network Management

Communication

slide-11
SLIDE 11

Protocol

  • Provides management standards
  • Transport protocol normally UDP
  • Agent listens on port 161
  • Manager listens on port 162
slide-12
SLIDE 12

SNMP Version 1

Messages / Protocol Data Units (PDUs)

  • Manager to Agent
  • 1. GetRequest
  • 2. GetNextRequest
  • 3. SetRequest
  • Agent to Manager
  • 4. GetResponse
  • 5. Trap
slide-13
SLIDE 13

GetRequest Message

  • 1. Manager wants to get the value of the sysDescr and

sysUpTime objects

  • 2. Manager creates a GetRequest message
slide-14
SLIDE 14

SNMPv1 Common PDU Format

Version Variable Bindings Object 1: Value 1, …, Object X: Value X Community PDU Type (0‐3) Request Identifier Error Status Error Index

slide-15
SLIDE 15

GetRequest Message

  • 3. Manager sends GetRequest message to router
slide-16
SLIDE 16
  • 4. Agent on router creates a GetResponse message with

the values of the requested variables

  • 5. Agent sends the message to the manager

GetRequest Message

slide-17
SLIDE 17

SNMP Version 1

Messages / Protocol Data Units (PDUs)

  • Manager to Agent
  • 1. GetRequest
  • 2. GetNextRequest
  • 3. SetRequest
  • Agent to Manager
  • 4. GetResponse
  • 5. Trap
slide-18
SLIDE 18

SNMP Version 2

Major Enhancements

  • Addition of Messages / Protocol Data Units (PDUs)

○ GetBulkRequest - efficient retrieval of many variables in single request ○ InformRequest - acknowledged event notification

slide-19
SLIDE 19

SNMP Version 2

Major Enhancements

  • Security enhancements

○ Party-Based SNMP Version 2 ○ Community-Based SNMP Version 2 (SNMPv2c) ○ User-Based SNMP Version 2 (SNMPv2u)

slide-20
SLIDE 20

SNMP Version 3

Major Enhancements

  • Security Model

○ Authentication ○ Encryption ○ Integrity

  • Access Control Model
slide-21
SLIDE 21

Introduction OIDs and MIBs

slide-22
SLIDE 22

How do we enumerate specific data using SNMP?

Introduction OIDs and MIBs

slide-23
SLIDE 23

“Management Information Base (MIB) is a file that contains definitions of management information so that networked systems can be remotely monitored, configured, and controlled.”

Introduction OIDs and MIBs

slide-24
SLIDE 24

“Object Identifier (OIDs) point to individual network objects that are maintained in a database called a Management Information Base“

Introduction OIDs and MIBs

slide-25
SLIDE 25
  • OIDs utilize a dotted list notation
  • 1.3.6.1 = iso.org.dod.internet
  • Universally unique

Introduction OIDs and MIBs

slide-26
SLIDE 26

Introduction OIDs and MIBs

slide-27
SLIDE 27

Number of Network Interfaces on a Device

ISO (1)

1

ORG (3)

.3

DOD (6)

.6

INTERNET (1)

.1 .2 .1 .2

Management (2) MIB2 (1) Interface (2) ifNumber (1)

.1

Introduction OIDs and MIBs

slide-28
SLIDE 28
  • Enterprise MIBs

○ 1.3.6.1.4.1 ○ iso.org.dod.internet.private.enterprise

  • Individual enterprises are assigned a number by Internet

Assigned Numbers Authority (IANA)

http://www.iana.org/assignments/enterprise-numbers/enterprise-numbers

Introduction OIDs and MIBs

slide-29
SLIDE 29

1.3.6.1.4.1.2 IBM 1.3.6.1.4.1.9 ciscoSystems 1.3.6.1.4.1.11 Hewlett-Packard 1.3.6.1.4.1.304 Farallon Computing, Inc. 1.3.6.1.4.1.1991 Brocade Communication Systems, Inc. 1.3.6.1.4.1.4491 Cable Television Laboratories, Inc. 1.3.6.1.4.1.4684 Ambit Microsystems Corporation 1.3.6.1.4.1.43555 LayeredDefense Deral Heiland

Introduction OIDs and MIBs

slide-30
SLIDE 30

SOHO Device Attacks

slide-31
SLIDE 31
  • Initial research focused on cable / DSL modems

○ Easily obtainable devices ○ Low cost

  • Devices examined

○ Netopia/Motorola/Arris ○ Ambit/Ubee ○ Netmaster

Exploits & Related Attack Vectors

slide-32
SLIDE 32

Exploits & Related Attack Vectors

  • Modems with WiFi builtin frequently expose

○ Wireless keys ○ SSIDs ○ Interface credentials

slide-33
SLIDE 33

Manual Information Extraction Demo

Exploits & Related Attack Vectors

slide-34
SLIDE 34

Username: 1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 Password: 1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 WEP Key Index: 1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.3.1.2.12 WPA PSK: 1.3.6.1.4.1.4491.2.4.1.1.6.2.2.1.5.12 SSID: 1.3.6.1.4.1.4684.38.2.2.2.1.5.4.1.14.1.3.12

Ubee DDW3611

Exploits & Related Attack Vectors

slide-35
SLIDE 35

Automated Information Extraction Demo

Exploits & Related Attack Vectors

slide-36
SLIDE 36

Password: 1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SSID: 1.3.6.1.4.1.4115.1.20.1.1.3.22.1.2.12 WPA PSK: 1.3.6.1.4.1.4115.1.20.1.1.3.26.1.2.12 WEP Key 64-bit Index: 1.3.6.1.4.1.4115.1.20.1.1.3.24.1.2.1 WEP Key 128-bit Index: 1.3.6.1.4.1.4115.1.20.1.1.3.24.1.2.1

ARRIS DG950A

Exploits & Related Attack Vectors

slide-37
SLIDE 37
  • Modems Identified leaking data
  • Ambit U10C019 (2,285)
  • Ubee DDW3611
  • Netopia 3347 series (40,444)
  • Arris DG950A (19,776)
  • Motorola/Arris SBG-6580 (97)
  • Netmaster CBW700N (114,265)

176,867

Exploits & Related Attack Vectors

slide-38
SLIDE 38

Observations and Trends

– Internet Service Providers (ISP) have poorly configured SNMP to manage cable/dsl modems – A decrease in exploitable devices – Older devices are replaced – Newer deployments better secured

slide-39
SLIDE 39

Enterprise Device Attacks

slide-40
SLIDE 40

Enterprise Device Attacks

  • SNMP is available on all enterprise devices
  • Often found enabled by default
  • Almost as often configured with community strings of

public and private

slide-41
SLIDE 41

Brocade ServerIron ADX 1016-2-PREM

Demo

Enterprise Device Attacks

slide-42
SLIDE 42

Brocade Load Balancer

Brocade ServerIron ADX 1016-2-PREM

Shodan results for ServerIron (826)

USERNAME  1.3.6.1.4.1.1991.1.1.2.9.2.1.1 PWD HASHES  1.3.6.1.4.1.1991.1.1.2.9.2.1.2

slide-43
SLIDE 43
  • Kyocera printers (Various models)

– Independently discovered by both Artyon Breus and Chris Schatz

  • SMB Path: 1.3.6.1.4.1.1347.42.23.2.4.1.1.2.x.1
  • SMB Host: 1.3.6.1.4.1.1347.42.23.2.4.1.1.3.x.1
  • SMB Port: 1.3.6.1.4.1.1347.42.23.2.4.1.1.4.x.1
  • SMB Login: 1.3.6.1.4.1.1347.42.23.2.4.1.1.5.x.1
  • SMB Password: 1.3.6.1.4.1.1347.42.23.2.4.1.1.6.x.1

X= user number

Enterprise Device Attacks

slide-44
SLIDE 44

Information Harvesting

slide-45
SLIDE 45

Demo Log Data Extraction Attacks

slide-46
SLIDE 46
  • Logs viewable via SNMP
  • Successful logins
  • Identify valid accounts
  • Identify host they authenticated from
  • Failed logins
  • Oops... I just entered my password in the user field
  • Maybe an injection point for XSS in the web viewed logs

Log Data Extraction Attacks

slide-47
SLIDE 47

Log Data Extraction Attacks

DEMO

slide-48
SLIDE 48
  • When encountering devices on a pen-test

○ Alway check to see whether SNMP is enabled and accessible ○ Snmp(bulk)walk device and analyze prior to engaging the device with brute force attacks (telnet, ssh, web, etc.) ○ Avoid overwriting usable data

Log Data Extraction Attacks

slide-49
SLIDE 49

Log Data Extraction Attacks

  • Sample list of device with SNMP stored logs
  • Netgear ProSafe GSM7328Sv2 Managed Switch
  • Smart IP Microwave Radio
  • Netopia 33xx
slide-50
SLIDE 50

Automated Information Harvesting

slide-51
SLIDE 51

Automated Information Harvesting

  • Large amounts of data
  • Unknown meaning of data
  • Limited time to analyse
slide-52
SLIDE 52

Automated Information Harvesting

  • How do we gather useful information?

○ Snmp(bulk)walk all devices ○ Parse for keyword and patterns

slide-53
SLIDE 53

Automated Information Harvesting

  • snmpbw.pl (Still work in progress)

○ Perl script ○ Multithreaded ○ Runs snmpbulkwalk against target list ○ https://github.com/dheiland-r7/snmp

slide-54
SLIDE 54

Automated Information Harvesting

  • snmpprs.pl (Still work in progress)

○ Perl script ○ Parses snmpwalk data for information ○ https://github.com/dheiland-r7/snmp

slide-55
SLIDE 55

Automated Information Harvesting

  • Data harvest

○ usernames ○ password or hashes ○ SNMP community strings ○ network infrastructure and VLANs information

slide-56
SLIDE 56

Automated Information Harvesting

  • Samples
  • \$[1-6]\$[0-9a-zA-Z.$/]\{31\}
  • \"[0-9A-Fa-f]\{32\}\”
  • [a-zA-Z.]@[a-zA-Z].[cegmnort]
  • traphost
  • admin, Admin, root
  • fail, success, logging
slide-57
SLIDE 57

Automated Information Harvesting

DEMO

slide-58
SLIDE 58

Other Data Points of Interest

slide-59
SLIDE 59

Other Data Points of Interest

  • SNMP DoS

○ Earliest identified DoS POC dated 2005

■ http://packetstormsecurity.com/files/36070/snmpdos.c.html

○ Attacker can direct responses to a target since UDP is connectionless, allowing spoofed IP address ○ GetBulkRequest message is used for reflected amplification attacks

slide-60
SLIDE 60

SNMP Security Best Practices

slide-61
SLIDE 61

SNMP Security Best Practices

  • Manufacture:
  • 1. SNMP disabled by default
  • 2. Move away from SNMPv1 and SNMPv2c
  • 3. MIB objects should not contain any authentication data
  • Passwords, password hashes, security keys, usernames or

community strings

  • Should only contain data related to the operational parameters of

the device

slide-62
SLIDE 62
  • End User:
  • 1. SNMP if not in use should be disabled on all devices prior to

deployment.

  • 2. SNMP community strings should be a minimum of 20 characters,

alphanumeric upper and lower case with special characters and contain no dictionary words.

SNMP Security Best Practices

slide-63
SLIDE 63
  • End User:
  • 3. SNMP community strings public and private should not be the same
  • 4. SNMP community strings should differ based on the different security

levels of the devices. Example: SNMP community string on your IP camera should not be the same as your router/switches/firewalls.

SNMP Security Best Practices

slide-64
SLIDE 64

Deral Heiland deral_heiland@rapid7.com dh@layereddefense.com @Percent_X Matthew Kienow mkienow@inokii.com @HacksForProfit

Conclusion

slide-65
SLIDE 65

References

  • h$p://www.bitag.org/documents/SNMP‐Reflected‐AmplificaBon‐DDoS‐A$ack‐

MiBgaBon.pdf

  • h$p://www.prolexic.com/kcresources/white‐paper/white‐paper‐snmp‐ntp‐chargen‐

reflecBon‐a$acks‐drdos/An_Analysis_of_DrDoS_SNMP‐NTP‐ CHARGEN_ReflecBon_A$acks_White_Paper_A4_042913.pdf

slide-66
SLIDE 66

Exploit References

  • https://community.rapid7.com/community/metasploit/blog/2014/05/15/

r7-2014-01-r7-2014-02-r7-2 14-03-disclosures-exposure-of-critical- information-via-snmp-public-community-string

  • https://community.rapid7.com/community/metasploit/blog/2014/08/21/

more-snmp-information-leaks-cve-2014-4862-and-cve-2014-4863

  • http://seclists.org/fulldisclosure/2014/May/79