Logo Intuity
Contatti

A Journey Into the Beauty of DNSRebinding – Part 2

Be part of the Intuity Army

Send your application to careers@intuity.it.

By submitting your application, you confirm that you have read the privacy policy regarding the processing of your personal data for recruitment purposes.

Abstract

In the first part, after a fast overview on the DNS Rebinding technique, we considered a practical example in which UPnP services has been exploited to perform NAT Injection attacks and, therefore, expose internal services on Internet.

Secondly, we are going to demonstrate how DNS Rebinding could be used to exploit vulnerable services running locally in order to achieve Remote Code Execution (RCE). 

Particularly, we will consider the case of CVE-2016-6563, which consists in a known Buffer Overflow issue caused by an unsafe parsing of the XML fields present in the login SOAP request affecting the HNAP service of some D-Link routers.

In short, below are listed the steps in order to create a working DNS Rebinding proof of concept:

  • Firmware static and dynamic analysis;
  • Buffer Overflow sink and source identification through static binary analysis;
  • Exploit development through binary emulation;
  • DNS Rebinding + Buffer Overflow ROP exploit chaining.

Static Firmware and Binary Analysis

As a first step, we downloaded the “DIR-842_C1_FW300b18.bin” firmware, which was available on the vendor site, and extracted the squash-fs filesystem by using binwalk.

Then we stared to inspect the “hnap” binary inside the filesystem and we found the same behavior described in CVE-2016-6563.

We have then reversed the target binary with Ghidra and, by looking for the the strings related to the login parameters, we have identified the following function, which was renamed as “Vulnerable” in the following snippet of code.

The “Action”, “Username”, “LoginPassword” and “Captcha” XML fields are parsed by the (renamed) “VulnerableXMLParser” method:

Here the user-controllable input present in the login parameter tags is copied in an insecure way:

  • inside a local buffer (i.e. “var_overflow”);
  • into the 128 byte buffer defined inside the caller function through the “destination_buffer” pointer.

Firmware Emulation and Binary Debugging

In order to try to exploit the issue we have tried to emulate the firmware. We then used FAT in order to achieve full system emulation:

However, we have used the QEMU user-mode emulation feature with the aim of debugging the issue and creating a working exploit.


In particular, the following setting was used to emulate a HTTP request to the target mips “hnap” service:

Following the description of the used parameters:

  • chroot: the full command was executed within the root directory of the extracted squash-fs filesystem, so chroot . makes this directory the root directory;
  • qemu-mips-static: allows to emulate MIPS binaries. The “-E” options was used to set some environment variables required by “hnap” to regularly invoke the vulnerable method; “-g” sets the “QEMU_GDB” environment variable that opens a gdb-server on the specified port (in this case port 4444).


It was then possible to attach to the gdb-server running on “localhost:4444” and debugging the target binary using gdb-multiarch as follows:

A working Buffer Overflow exploit

After some digging into the analysis both user-mode and system-mode, we got a running ROP exploit that allowed us to execute an arbitrary command by jumping to the ld-uClibc-0.9.33.2 system() function:

The following gadget was found in the libc address and used to perform a return-to-system:

This gadget allows to jump to the next instruction through jalr $t9 and lw $t9, 0x24($sp); so we put the address of system() 36 bytes after the current pointed address. 

The argument of system(), was previously controlled thanks to addiu $a0, $sp, 0xb8, which points to the stack location that contains the command to execute.

Once adjusted the libc base address according to the system-mode, we could test the exploit by using curl (the body file contains the output of the python exploit):

The “touch /tmp/minded” command was successfully executed as this file was written in the “/tmp” directory of the emulated firmware. 

The following output is related to FAT and shows the emulated router console exposing the SIGSEGV crash caused by the running exploit. 

Following the proof of the execution of the touch command (of the minded file).

Remote Command Execution through DNS Rebinding attack

It was then possible to embed the generated payload inside an xhr SOAP request in the DNS Rebinding HTML attack page we used in the first part:

Below the screenshot showing the execution of the xhr request after the successful DNS Rebinding attack.

The exploit was successfully executed and the “testJS” file was created on the filesystem of the router.
image not found

Following the complete DNS Rebinding attack scheme.

image not found


Getting Persistence using DNS Rebinding + UPnP NAT Injection + telnetd service

The next step for an attacker would be to create a backdoor in order to get persistent access to the victim’s device.


During the static firmware analysis we noticed the existence of “/usr/sbin/telnetd” within the firmware, so we could force the router to run the telnetd service just by replacing his path in the working exploit. 

Following the generated HTTP request.

image not found

The service was executed on the machine as shown in the following screenshot that shows the nmap output before and after the exploit execution.

Telnet service status before the exploit execution:

image not found

Telnet service started after the exploit execution:

image not found

Conclusion

We were able to use the DNS Rebinding attack against CVE-2016-6563 proving that it is possible to execute a Remote Command Execution against a not public facing service, as the web interface of a router.

Moreover, we have used the UPnP NAT Injection technique from the firstpart to expose the telnetd service to the public interface in order to get a remote backdoor.

Below the Attack Tree of the proposed attack:

image not found

References:

Authors

Alessandro Braccio

Giovanni Guido