Daniel Mende on Insinuator.net - Bold Statements

dizzy version 2.0 released

Fri, 03 Aug 2018 00:00:00 +0000

A new major version of our fuzzing framework dizzy has been released.

This blog post will cover the biggest changes and new features, as well as give you a short introduction into how to use them.

You can find the new version on github.

Installation

There are two supported ways of installing dizzy:

via pypi
$ pip install dizzy
via setup.py
$ git clone https://https://github.com/ernw/dizzy && cd dizzy && python setup.py install

Erlang distribution RCE and a cookie bruteforcer

Thu, 05 Oct 2017 00:00:00 +0000

In one of the last pentests we’ve found an epmd (Erlang port mapper daemon) listening on a target system (tcp/4369). It is used to coordinate distributed erlang instances, but also can lead to a RCE, given one knows the so called “authentication cookie”. Usually, this cookie is located in ~/.erlang.cookie and is generated by erlang at the first start. If not modified or set manually it is a random string [A:Z] with a length of 20 characters. If an attacker gains this cookie, a RCE is quite easy – as I like to describe below.

ss7MAPer – A SS7 pen testing toolkit

Tue, 16 Feb 2016 00:00:00 +0000

While running some SS7 pentests last year, I developed a small tool automating some of the well-known SS7 attack cases. Today I’m releasing the first version of ss7MAPer, a SS7 MAP (pen-)testing toolkit.

The toolkit is build upon the Osmocom SS7 stack and implements some basic MAP messages. At its current state tests against the HLR are ready for use, in future versions tests against VLR, MSC and SMSC will follow.

The source code of the tool is published on github, feel free to use and extend.

An unpacker for Alcatel TiMOS images

Fri, 12 Jun 2015 00:00:00 +0000

Hi,

I wrote a small python script that extracts the content from Alcatel .tim firmware files. It took some time staring at hex values, as well as a fair amount of guess work to figure out the file format.

All .tim files start with a common header, containing the TiMOS version string, the build string, the used compression algorithm and the number of segments included in the file. The common header is followed by a header for each segment in the file. The segment header contains values like the name of the segment, the beginning of the segment in the image file, the size of the segment, compressed as well as extracted, a checksum of the decompressed data and also the base address and entry point of the data in the routers memory. A segment header can look like this:

TACACS+ module for loki

Wed, 10 Jun 2015 00:00:00 +0000

There has been, again, some development within the loki domain. Today I’m going to write about the latest module added to the suite, a module for decoding and cracking Cisco’s TACACS+.

TACACS is the Terminal Access Controller Access-Control System, a protocol for handling remote user authentication and central access control. It originated in 1984 and was used in the old Unix world. TACACS+ is a related protocol developed by Cisco Systems and is widely used for AAA (Authentication, Authorization, Accounting) on IOS based devices. It was released as an open standard in 1993 (and expired in 1998 by the way ;-)).

Advanced Security Evaluation of Network Protocols

Mon, 08 Jun 2015 00:00:00 +0000

Hi,

I’m back from London where I gave a talk about security evaluation of proprietary network protocols. I had a great time at InfoSecurity Intelligent Defence and BSides London, many thanks for inviting me and giving me the opportunity to speak to so much nice people.

Find the abstract and the download link to the slides after the break.

Even in the time of Cloud-based security tools, behavior- and machine learning-based APT detection and colorful security appliances, a lot of vulnerabilities are still buried deep within the protocol layers. For security researchers it is quite a challenge to find those in well documented protocols (take SSL for an example), and when it comes to proprietary protocols, the bar is raised even (significantly) higher. This keynote will show that there is still an urgent need for security evaluation on (undocumented) network protocols, discuss war stories on protocol fails, and also give an introduction into the methodology of protocol reversing and how those protocol fails could have been avoided.

Cisco Cloud Services Router 1000V and the Virtual Matryoshka

Mon, 28 Jul 2014 00:00:00 +0000

Recently we started playing around with Cisco’s virtual router, the CSR 1000V, while doing some protocol analysis. We found Cisco offering an BIN file for download (alternatively there is an ISO file which contains a GRUB boot loader and the BIN file, or an OVA file which contains a virtual machine description and the ISO file) and file(1) identifies it as DOS executable:

$ file csr1000v-universalk9.03.12.00.S.154-2.S-std.SPA.bin 
    csr1000v-universalk9.03.12.00.S.154-2.S-std.SPA.bin: DOS executable (COM)

We didn’t manage to get the file running, neither in a (Free-)DOS environment, nor in a wine virtual DOS environment, except using the boot loader from the ISO file. So we became curious as for the structure and ingredients of the file.

New Tool: s1ap_enum

Wed, 25 Jun 2014 00:00:00 +0000

As we continue our research in the 3GPP protocol world, there is a new tool for you to play with. It is called s1ap_enum and thats also what it does 😉

The tool itself is written in erlang, as i found no other free ASN.1 parser that is able to parse those fancy 3GPP protocol specs. It connects to an MME on sctp/36412 and tries to initiate a S1AP session by sending an S1SetupRequest PDU. To establish a S1AP session with an MME the right MCC and MNC are needed in the PLMNIdentity. The tool tries to guess the right MCC/MNC combinations. It comes with a preset of known MCC/MNC pairs from mcc-mnc.com, but can try all other combinations as well.

Fresh Meat From the Coding Front

Thu, 20 Feb 2014 00:00:00 +0000

Within the last months I had some time to work on my code and today I’m releasing some of that: a new version of dizzy as well as two new loki modules.

New version of dizzy:

Download version 0.8.2 here.

USB target support

Dizzy is able to use neighbor travis’ facedancer to emulate a client device. Two fuzzing modes are available for USB descriptor fuzzing and USB endpoint fuzzing.

Here is an example cmd to start usb configuration descriptor fuzzing:

pytacle – alpha2

Wed, 30 Oct 2013 00:00:00 +0000

Its been a long time, since i released the last version of pytacle, but now the time has come. Here is alpha2 with some new features:

– Support of RTLSDR sticks
– Possibility to scan for cells around you
– Changed the code to generate real KCs (but as nobody noticed the wrong KCs i guess you were good with the others 😉

Im also planning to address hopping channels in the future, but ive not made it far enough in my DSP lecture, yet 😉

BlackBerry 10 USB Modes

Tue, 23 Jul 2013 00:00:00 +0000

So we got these shiny new BlackBerry Q10 and Z10 device laying on the desk one morning. It’s my first BlackBerry, I have to admit, but never the less, the hole wushy GUI and touchy glass stuff wasn’t my main concern, instead i took a look at the stuff going on while you connect the phone (do i have to call it blackberry? its a phone, isn’t it?) to your computer.

A Word on Cisco Jabber

Wed, 03 Apr 2013 00:00:00 +0000

Recently we took a look on Ciscos XMPP client, called Cisco Jabber. The Client is used in combination with Ciscos Unified Communication Server (CUCM) and Ciscos Unified Presence Server (CUPS). Only the latter one is used for XMPP communication.

We built a small lab setup with this components (CUCM, CUPS and the Win7 Client) and watched the client working.

First the client connects to a web service at https://CUPS:8443/EPASSoap/service/v80. We intercepted this connection with the Burp Proxy and had no problems getting into the SSL. Inside we found a SOAP request containing the users authentication credentials and a SOAP response with a onetime password, which is used for authentication in the XMPP stream later on. Phew, the users credentials _and_ unlimited onetime passwords _that_ easy? Thanks Cisco!

TROOPERS13 – The Badge Code

Fri, 15 Mar 2013 00:00:00 +0000

As a lot of people were asking for, here comes the code of your badge. All You need to customize your badge, is a micro controller programmer, like the Pickit (its around 30 to 40 euros) and the build environment, MPLAB which you can get for free. Then just download the code and implement your own super cool features. Let us know what you did, the best hacks will get into the TROOPERS hall of fame (-;

Paparazzi over IP – Slides

Mon, 18 Feb 2013 00:00:00 +0000

We are back from ShmooCon had a great time and it was a lot of fun talking to all of you guys. Here are the slides of our talk. Thanks to all who made this possible, we really enjoyed being part of this years Shmoo.

cheers

/daniel and pascal

Paparazzi over IP

Fri, 15 Feb 2013 00:00:00 +0000

Almost every higher class DSLR on the market today features multiple and complex access technologies. To name a few, canons new flagship features IP connectivity wired via 802.3 as well as wireless via 802.11. All the big vendors are pushing these features to the market and advertise them with real time image transfer to the cloud. We have taken a look at the layer 2 and 3 implementations in the CamOS and the services running upon those, so here is what we found while examine the EOS 1D X:

All Your Calls Are Still Belong to Us – continued

Thu, 03 Jan 2013 00:00:00 +0000

Hi again and a happy new year 2013!

Lets continue were I left you the last time.

The CTL

The CTL is basically a binary TLV file with 1 byte type, followed by 2 bytes length and finally the data. But as this is far to easy, some special fields omit the length field and just place the data after the type (I guess those are fields with a fixed length). Here is an example CTL file:

All Your Calls Are Still Belong to Us – aka. Hacking Cisco high secure Enterprise VoIP Solution

Thu, 27 Dec 2012 00:00:00 +0000

Some of you may have heard the topic before, as we have spoken about on this years BlackHat Europe, TROOPERS12 and HES12, so this is nothing completely new, but as we’re done with responsible disclosure (finally (-; ) and all the stuff should be fixed, we’re going to publish the code that brought us there. I will split the topic into two blog posts, this one will wrap up the setup, used components and protocols, the next one [tbd. till EOY, hopefully] will get into detail on the tools and techniques we used to break the enterprise grade security.

Loki for Windows released

Thu, 08 Nov 2012 00:00:00 +0000

Today is a great day, its the day, Loki finally runs on all big operating systems. Im proud to announce the first Loki release for Windows!

There are a few things not working (yet / at all) under Windows. Those are:

The WLCCP Module – ive not yet managed to build and link against asleap on windows [but time may help (-; ]
TCP-MD5 Auth for BGP – This will never work, as Windows has no TCP-MD5 impl. in the kernel
The MPLS Module – Had some hassle here with WinPcap, may be working in the future

The most testing so far was done on Windows 7 were all the other functions work as they do on Linux and Mac.

SQL Injection in Cisco MeetingPlace

Thu, 08 Nov 2012 00:00:00 +0000

Cisco has released a security advisory for a vulnerability we discovered last year.
For comparison here is our original advisory to cisco:

Security Advisory for Cisco Unified Communications Solution

Release Date: 11/8/2012 Author: Daniel Mende

1 SUMMARY Multiple critical SQL injections exist in Cisco unified meeting place.

2 AFFECTED PRODUCTS The following Products have been tested as vulnerable so far: Cisco Unified Meetingplace with the following modules: • MeetingPlace Agent 7.1.1.9 • MeetingPlace Audio Service 7.1.1.8 • MeetingPlace Gateway SIM 7.1.1.2 • MeetingPlace Replication Service 7.1.1.9 • MeetingPlace Master Service 7.1.1.8 • MeetingPlace Extension 7.1.1.8 • MeetingPlace Authentication Filter 7.1.1.8

3 DETAILS The following parameters are affected: http://$IP/mpweb/scripts/mpx.dll [POST Parameter wcRecurMtgID]

4 VULNERABILITY SCORING The severity rating based on CVSS Version 2: Base Vector: (AV:N / AC:L / Au:S / C:P / I:P / A:P) CVSS Version 2 Score: 6.5 Severity: Low

SessionID=A40490A1-AB17-4C1E-BA4A-E3C5C90F62CA.1ED59E5C-A774-4546-8683- AEB15D6FBD0D.55931857-6296-48ec-9434-3231c683c47d.ADadfjadlkeNmFhmplaihgkdDg &wcMeetingID=&wcRecurMtgID=‘ or 1=1 —&URL0=wcBase.tpl&TXT0=Startseite&URL1=& TXT1=&URL2=&TXT2=&URL3=&TXT3=&URL4=&TXT4=&URL5=&TXT5=&MtgCatToSearch= %28all%2Bcategories%29&ML_PublicPosted=Yes&MtgIDToSearch=0000007&SchedulerID= &wcRequest=&wcHash=&FormType=listmeetings&wcState=3&STPL=wcFindMtg.tpl&FTPL= wcFindMtg.tpl&ML_List=MT_Today&ML_EndTime_Month=&ML_EndTime_Day=&ML_End Time_Year=&ML_ShowContMtgs=Yes&SP_VLanguage=lang999i00

Pytacle alpha1 released!

Wed, 31 Oct 2012 00:00:00 +0000

Finally it’s here!

pytacle is a tool inspired by tentacle. It automates the task of sniffing GSM frames of the air, extracting the key exchange, feeding kraken with the key material and finally decode/decrypt the voice data. All You need is a USRP (or similar) to capture the GSM band and a kraken instance with the berlin tables (only about 2TB 😉 )

I’ve posted a preview before, take a look at the video to see the tool in action.

Fuzzing VMDK files

Wed, 30 May 2012 00:00:00 +0000

As announced at last week’s #HITB2012AMS, I’ll describe the fuzzing steps which were performed during our initial research. The very first step was the definition of the interfaces we wanted to test. We decided to go with the plain text VMDK file, as this is the main virtual disk description file and in most deployment scenarios user controlled, and the data part of a special kind of VMDK files, the Host Sparse Extends.

Releasing dizzy version 0.6

Wed, 23 May 2012 00:00:00 +0000

Hi @all,
today im releasing a new version of our famous fuzzing framework, dizzy. The version counts 0.6 by now and youll get some brand new features!

see the CHANGELOG:
v0.6:
– ssl support
– server side fuzzing mode
– command output
– new dizz funktions: lambda_length, csum, lambda_csum, lambda2_csum
– recursive mutation mode
– new dizz objects: fill
– new interaction objects: null_dizz
– reconnect option
– additional fuzzing values

pytacle preview

Sun, 18 Dec 2011 00:00:00 +0000

Hi,

today I’ll give a short preview of my newest tool, pytacle. It is simply a little helper program to control gnuradio/airprobe/kraken/some_other_tools, convert their input/output and to find a use able clear/cipher text combination to break A5/1. In the end it should record, crack and decode/play a gsm phone call with ~5 mouse clicks.

Take a look at this video:

The code is not available yet, as its not finished 😉 the recording and cracking part are working, but the decoding doesn’t. I need to put some more time into the code, but there isn’t much spare in that time of the year 😀

Week of releases – apnbf

Thu, 14 Jul 2011 00:00:00 +0000

Another day, another tool 😉

Today I’m proudly releasing the first version of apnbf, a small python script designed for enumerating valid APNs (Access Point Name) on a GTP-C speaking device. It tries to establish a new PDP session with the endpoint via sending a createPDPContextRequest. This request needs to include a valid APN, so one can easily distinguish from a valid APN (which will be answered with a createPDPContextResponse) and an invalid APN (which will be answered with an error indication message). In addition the tool also parses the error indication and displays the reason (which should be “Missing or unknown APN” in case of an invalid APN).

Week of releases – gtp_scan-0.7

Wed, 13 Jul 2011 00:00:00 +0000

So, after having a completely new release yesterday, we will stay with already known but updated software today. You might have heard of gtp_scan before, which is a small python script for scanning mainly 3G and 4G devices and detecting GTP (GPRS Tunneling Protocol) enabled ports. As GTP is transported via UDP and we all know, UDP scanning is a pain, the tool uses the GTP build-in echo mechanism to detect GTP speaking ports. Since the last version I’ve implemented some new features:

Week of releases – dizzy

Tue, 12 Jul 2011 00:00:00 +0000

I’m proud to announce, today a new fuzzing framework will see the light of day. It’s called dizzy and was written because the tools we used for fuzzing in past didn’t match our requirements. Some (unique) features are:

Python based
Fast!
Can send to L2 as well as to upper layers (TCP/UDP/SCTP)
Ability to work with odd length packet fields (no need to match byte borders, so even single flags or 7bit long fields can be represented and fuzzed)
Very easy protocol definition syntax
Ability to do multi packet state-full fuzzing with the ability to use received target data in response.

We already had a lot of success using it, now you will be able to know the true promises.

Week of releases – loki-0.2.7

Mon, 11 Jul 2011 00:00:00 +0000

Today I’m going to open up the ‘Week of releases’, which means there will be some new software in the next days.

Lets start with a new version of loki. The version goes up to 0.2.7 and there are a lot of new features:

SCTP support in the base.
Invalid option and invalid header scan in the ICMP6 module.
On-line msg updates for neighbor messages in the RIP module.
New module for rewriting 802.1Q labels
Lots of small improvements and bug-fixes
Some new features I won’t tell right now, get the source and find them yourself 😉

Also there are new packages for gentoo, ubuntu-11.04 and fedora-15, also its the first time, packages for amd64 systems are available.

update for your fuzzing toolkit

Mon, 02 May 2011 00:00:00 +0000

As I’m currently developing the ‘next gen’ state-full fuzzing framework @ERNW [called dizzy, to be released soon 😉 ], I will give you an updated set of fuzzing scripts from the ‘old world’.

Some of you will remember the 2008 release of sulley_l2, which was a modified version of the sulley fuzzing framework, enhanced with Layer 2 sending capabilities and a hole bunch of (L2) fuzzing scripts. All the blinking, rebooting, mem-corrupting ciscos gave us some attention. Back from then, we continued to write and use the fuzzing scripts, so the hole collection grew.

GTP_SCAN released

Tue, 01 Mar 2011 00:00:00 +0000

gtp_scan is a small python script that scans for GTP (GPRS tunneling protocol) speaking hosts. To discover those hosts it uses the GTP build in PING mechanism, it sends a GTP packet of the type ECHO_REQUEST and listens for an incoming GTP ECHO_REPLY. Its capable of generating ECHO_REQUESTS for GTP version 1 and GTP version 2. Also the script can scan for both, GTP-C and GTP-U (the control channel and the user data channel), only the port differs here.