all right
um so hi everybody and uh thank you for
joining me
uh to my talk and thanks confidence for
inviting me to speak here
um well so at this
talk i will present my follow-up
research
on ruckus wireless rockers is a wireless
solution company
owned by comscope and i first noticed
them
when they partnered with blackit for
their
wi-fi conference solution and
uh well in the last year i've been doing
vulnerability research on
robust devices and so far i managed to
find several of critical vulnerabilities
[Music]
yeah so this is my
screenshot from my previous research
that was introduced in
ccc and uh back then in
19 before the coronavirus
uh going to places was a thing so here
you can see me
actually talking at a real conference
which is exciting although online is
good as well
um okay so i'll just would like to
introduce myself
uh really quickly so my name is garlitz
rohr
i'm a research team leader at alf
research
by hcl appscan and i've been
doing uh vulnerability research for some
time
i like to focus on embedded devices
research in particular
and i would also like to do a quick
recap for my previous research
so in that research i demonstrated three
different
ways to execute code on rockers devices
all the vulnerabilities were found on
the
device web interface the first
rce was credential leakage with
ssh jailbreak the second
was unauthenticated stack buffer
overflow
and the third one was command injection
that was reachable without
authentication
by writing a web page
all right and for this talk i
will be using ruckus r 510
unleashed the unleashed version are
access points that don't rely on
a specific wi-fi controller and
moreover all access points in in that
list
are shared the same vulnerable code base
and besides of that i also noticed that
some vulnerabilities
works on the zone director product line
which is the wi-fi controllers for the
access points
okay so uh what's new with this research
so um this research began
right after i downloaded roku's fix
for my previous research i noticed that
they did not fix one of my
vulnerabilities correctly
and i then decided to try to re-enable
it
and um well besides of that my first
research
was done entirely on based on device
simulation
uh now i own an actual device and i can
try to understand if i got something
wrong with the emulation or something
like that
okay uh oops sorry i forgot uh
i forgot the last bullet and um so
before i get into
into the vulnerabilities itself i would
like to introduce
a really cool jitter script that really
helped me with this specific research
so um i'd first like to introduce my
previous
um uh script so in my previous research
i wrote a jirah script that
fetches function name from log strings
that ruckus left in their binaries
here we can see that they provide a lot
of information in their
uh logging and um
this script helped me rename function by
parsing these long lines that contains
the function name
as you can see here on line 38 there's
the
the long number and i just getting i can
fetch the function name from it
we also got a generic version for
already for that script so
feel free to check our uh github for
this script and um well
the thing is that this script really
helped me with
most of the ruckus binaries but there
were some binaries
that were not written by ruckus
so well it's a common thing in embedded
devices vendor to use
open source project in their devices
rockers decided to base their web server
on
a popular project called embed this so
they extended its functionality by
adding
some code to it and since embedded
sources i
are public i don't really need to
reverse the entire
uh web server binary and it was just
easier for me to review the code itself
but the problem is what about the parts
that ruckus
added i would like to be able to mark
them
and see them on gidra
so i'll know i'll have to actually
reverse them
so for that i wrote an additional gitra
script
in my new script i try to extract as
many function name as i can
from the embed this source code
luckily i discovered a debug function
that contains the exact
c file name and line number in the
embedded
sources uh here we can see that for this
unnamed function from the web server
binary
we get that um yeah we get that this
function
appears in server.c file
around the line number one three eight
so if we go to this line number as they
embed these
sources will be able to extract many
function name from it
um yeah and so this is the function in
gidra
after the conversation
and these are actually all the function
name that i was able to extract
from the source code into gitra
and let's have another another example
let's take a look
at this function call graph this
function
called macriae create web server
it's being called from main and as you
can see it calls other
function so on the right side we can see
all the function name i was able to
fetch from the sources
by using the script i just introduced
and on the bottom left side you can see
the function name i was able to fetch by
using the script from my
previous research because rockers still
use their
logging convention that contains
function names
and as you can see they are still
unnamed function
but still the majority of function here
are now
named and this is a very good example of
how these
two function help me get plenty of
information
and save me a lot of time on reversing
so um well now i work on
writing a generic version for that
script
that won't rely on a specific debug
information
and once it's done i'll share it in our
other
github account so meanwhile feel free to
check it
and check other tools we got in this
github as well
okay cool so now we're ready for this
uh for some exploit and this is my first
in this attack i found another stack
buffer overflow that was reachable
without authentication
with a web request and uh
now we're gonna go for uh online live
demo and there are so many things that
can go wrong
so please demo god spare me on this one
okay so let me just open my terminals i
will
use uh and first i would like to
show you guys the uh stock overflow
payload itself
let me just use bi for that okay so as
you can see here
this is uh the payload and um
okay so this is the payload and um
we're going to use a netcat that's going
to create a reverse shell to my machine
this is why i'm using two
uh terminals so in my second terminal
i'll just gonna listen to port 1337
of course okay now i'm listening and
all i have to do is just uh use
wget uh to
send the payload so here we can see i'm
just
using a standard wget that gonna send
this payload
uh to this specific uh page
on this is my my router this is my
router ip address and that's it wish me
luck
oh yeah i think things happen uh let's
see if ls works
awesome so this is a remotely a remote
shell
and i can check that i am
what's my user so i'm the admin and
admin user is part of the
root group which means i
totally own this device awesome and it
went well as well
okay
so before i get into this specific
vulnerability
um here's a quick recap for my previous
talk
just to create the right context so
there are three imported binaries
in the web interface the first one
is slash bin slash webs this is the
actual
embed this web server and it handles
http request
and executes handlers according to its
configuration
and it then sends command through a unix
domain socket
to emfd slash b emfd
is an executable that contains the web
interface
logic it maps function from
web pages to their own function and
it's then implement web interface
commands such as
uh backup network configuration
retrieve system information and much
more
the last one is the library lib emf
this library is used by emfd
for mainly for web authentication input
validation
and sometimes even code execution
just one just one more thing uh please
note
that in my previous research most of the
vulnerabilities
were related to emfd
however now the stack overflow i'm about
to demonstrate or about to talk about
is in the web interface
in the web server and now let's look at
this in a diagram
so first webs listen to http
https if it receives a jsa page request
it uses egs handler to pass a function
name to
emfd emfd
then checks if the function name is map
and if so
it calls the write function function
pointer
eventually emfd runs some kind of
shell command uh for example um
i've config ip tables routes and things
like that
okay and since the web server contained
embed this uh code and rockers code
i decided to mark rutgers function with
rks prefix ruckus has added a new
function that registers new egs
functionality
egs is a handler that runs if the web
server
receive jsp our page request
so here we can see there are 12
functions that were registered each
function
registration needs a function name
and a function pointer now let's
understand how we can reach
these functions with an http request
so for example when sending an http
request to
slash admin slash webpage slash wi-fi
network slash
wlan sys confirm jsp
the web server invokes an egs handler
and on this page we can see that egs
script have
has this special tag and egs functions
are being called from it um
web so webs maps every strings it
received to a function pointer
and then runs it here we can see
that a function called
e escape j str is being called
and here we can see another function
named
s which is also being called and
yeah uh they actually named a function
s i'm serious and yes this is by far
the worst naming convention i ever
see but well naming convention it's not
the only
lousy thing about these functions
when i reviewed these functions i
noticed that
s str escape js and
get cookie value are all using unsafe uh
string copy
whoops uh oh yeah that's okay
that means uh if i can find a web page
that
passes the user inputs to one of these
functions
i will be able to smash the web server
stack
um so to search for an input that leads
to one of this function
i decided to use justprep
i search if there's any calls to one of
this function
with a non-static value it also should
not be a
session related or session evaluated
value
because i might not be able to create
this uh
this session or manipulate this session
so um this is the
regex that make sure s doesn't get any
value
inside a double or a single quote
aka static content i managed to
found two jsp pages one was an
aero page which did not receive any user
input
and the other was this wlan sees
confirm.jsp
so let's have a look at this page
well we saw that s function
receives a non-static value called
content and thankfully the content
variable
is set directly by an http body
parameter called
content key so all i had to do is just
send the write request to wlan
sysconfig.jsp
and this is how i smash the stack
as for exploitation so uh r510 uses both
nx and aslr to overcome
nx i just decided to use a simple rope
gadget
um so these gadgets these two gadgets
run a system with a pointer to my
payload
and uh in this case i was using the
and the netcat to create a reverse shell
to my machine
and for aslr i just decided to
take the brute force approach and
that way i managed to overcome its nine
bits of randomness
okay um so before i continue with my
second attack
i would like to share other
vulnerabilities i
found that i think worth mentioning
so i found a cross-site scripting denial
of service
and information leakage that might lead
to another
jailbreak all of them were finally were
found
either in their web server or in emfd
i discovered uh the cross
site scripting on actually on my first
research
and well it's a pretty straightforward
uh vulnerability
so for every adjusts post request
to let's say slash admin slash
wla cmds.jsp
we have to to send this
updater attribute so
this attribute is simply
reflected without any validation
so all i had to do is just send
the right payload and for each uh
for each request we send to uh cmd.jsp
uh we can run uh in this example this
alert js
okay uh the other vulnerability was
denial of service
so while researching i actually
came across this uh vulnerability
this request that simply crashes the web
server
i must say i find it by i found it by
mistake
and i did not invest too much uh time in
this
uh in this specific vulnerability uh it
seems like a
null pointer and i don't think it's can
be more than a denial of service
um another thing i think it
may be even related to the web server
itself
but again i did not invest too much time
in this specific vulnerability
and um the last one is uh
is the information leakage so ruckus uh
they consider the device serial number
as a sensitive information in my
previous research
i came across some functions that
um some function in rocker cli
that rely on the this device
uh serial number to escape to uh
to busy box to get a uh to jabric
and uh in this research i noticed that
upnp.jsp page
is reachable without authentication and
well this page gives many useful
information on the device
and well it can be used for
fingerprinting
but the best part it can could be used
uh well we get the the serial number and
we could use it for potentially
jailbreak the device again
awesome so um this is
this is the time for my second rc
and this attack i found a way to reuse
my
command injection vulnerability from
previous research i then had to find a
new way to bypass authentication
and i did it by overwriting admin
credentials
okay so let's first understand
how the command injection used to work
in my previous research
so emfd execute code in a really messy
way
emfd sometimes uses libmf
other time calls a shell script called
syswrapper.sh
and sometimes it's just execute the
command itself by using lipstick
these are all the different functions
that emfd uses to execute
shell commands and as we can see here
there are many libsy system function so
i had to find a page that uses this
system function without input validation
and luckily i found four functions that
called
uh system and were vulnerable to command
injection
and i will be using uh for the
demonstration
uh i will be using the cmd import avp
ports function
okay so uh to reach the vulnerable
function
i had to send an adjust request to slash
admin slash
underscore cmdstat.jsp
this request uses an emfd
command called import avp port
and when emfd receives its request
it uses another function called cmd
import avp port a function inside
emfd and this function uses
lipsy system lipsy system function
uh just unsafely uh so let's have a look
on the function decompile code
so for my previous research um
uh the command for my previous command
injection all i had to do
is to pass a command injection in the
upload file attribute
and as you can see it just executed
without any input validation
the only problem uh was that i
had to be authenticated to reach this
function
as you can see we must have a valid uh
cookie
and a csrf token and this kind of stuff
okay so now that we understand the
previous command injection
let's have a look on how raku's
uh tried to fix it so they decided to
use
function called is validate input string
that's supposed to validate there's no
injection character
in uh the upload file attribute
and uh and this function so this is an
external util function
found in uh emf in in lib emfd
and this specific uh input validation
function is being used widely
for input validation in uh in
the entire system okay
so let's have a look at this validation
function
here are all the forbidden characters
for
a given input at first this validation
seems pretty solid however
some very important characters were
missing from
that list and something i like to do
when reviewing a validator
i try to create a set of all the
printable non-alpha numeric characters
that can pass this specific validator
and uh after some trial and error i
realize
that shebang sign which is a pound key
followed by
exclamation mark is a valid input
and i could also use the slash
so i could actually create a shebang
slash bin
sh well that was good
uh but not good enough i couldn't just
append
this uh shebang payload to uh
command and and to system command and it
won't just
runs it and this is because
shebang has to be in a line of its own
luckily i could also use a new line
character
yeah that's actually true newline
character as
a parameter input was not being
validated
not in the web server in emfd anywhere i
can just
send a new line and well the result of
shebang plus new line is
a match made in exploit heaven
uh okay so that was great news
i can now replace my injection with a
shebang
but there's uh one last thing left to
solve
space characters was well the space
character was not
valid input so i decided to replace
spaces with uh thefts
so here we can look on the new payload
as you can see semicolon was
replaced by shebang
and spaces were replaced by tabs
and that's it this is how i was able to
re-enable
my old command injection
the last thing i had to complete
i had to do to complete this exploit was
to
bypass authentication again because
raku's already fixed all the bypass
authentication i found in my first
research
okay so now i would like to
explain how the admin credentials are
stored on the device
so there's this system.xml
and this is the device general
configuration file
it contains the admin credentials as
well as other
important configuration and
here we can see that the admin xml
element
uh so we can see that in xml element
itself
and we can also see that its password
is being stored in the x password
attribute
another thing while i was working on
this specific exploit
i noticed that rukus has decided to use
the most secure mechanism for storing
sensitive
password so uh if you look at this
x password attribute you might think
that
there uh that my password for this
specific device is
two three four five bcd however this is
not the case
because the real password is one two
three four five
abc and yes uh ruckus
for some reason are offer skating the
password
by adding uh one to each character
and well if you don't get it neither do
i
i got no idea why would they do that but
that's how it is yeah
okay um but enough about that
um now let's have a look at
slash admin slash underscore
wla underscore conf jsp page
uh we can see that this page calls for
two functions
in emfd uh without login access check
and adjust conf please note
that we must first pass the login
without access check
function to get to the vulnerable adjust
conf
function
so without login access check expects
an adjust request xml
that contains either setconf
or do cmd action
the do cmd action in this case was very
limited
in its functionality so i just decided
to focus on the
setconf action
and so the setconfection uses an
eme emfd function called
check reset credentials conf para
this function expects an admin
xml element with following uh
with these following attributes and this
function
only validates there are eight
attributes
and it only checks that the attribute
names
not the value also they don't check you
got
any permission so that means i only need
to
to keep a certain format and i can
overcome this
specific function
okay so here we can see a valid adject
request
with admin element
so this request has all the right
attribute names
and it can reach to the vulnerable adjux
conf function
and now let's talk about adjective so
adjust conf is a big function
that does all sorts of things one of
them is using
an adapter called adapter setconf
to update different configuration files
and in particular it can update the main
system.xml configuration
as we saw without login access check
forces me
to use a specific xml element
but thankfully this is the admin
credentials element
so uh let's understand how the
adapter set conf works
uh okay so uh this is how the adapter
setconf function looks like
it receives the request component
attribute
and the adjust request itself
i also realized that if the component
equals to
system then it can only update a
specific
xml element which was not the admin
element that i was hoping to actually
change
so i can't just override the admin
credentials with a simple request
however if the component attribute it's
not equal to system
it uses a function called repo get
curve child and this function
gets a component name and looks for
an xml configuration file with that name
so in other words i can access
any xml file in the air spider directory
which is the configuration directory
well
i can access every
every xml file except for system.xml
because as i said before adapter set
conf
make sure it it's excluded but the
credentials i want to override
is in system.xml which sucks
s
[Music]
yeah so this is where slash
come to our rescue i noticed that if i
add
a slash at the beginning of the of the
component attributes
it's no longer a system component it's
now
a slash system component
and this way i was able to pass the
system attribute check
and now repo get current child function
we look for the file system.xml
which is totally fine since in posix we
can add as many slashes as we want and
we'll still get
the right file
okay and um so this is it adapter
setconf has
replaced the admin credentials in
system.xml
which means i was able to override admin
credentials
now i just need to chain these two
vulnerabilities together
so first the overwrite
then command injection to pop a shell on
the device
and well since i tried to be a polite
person after getting a shell i can
obtain the original credentials
by grabbing slash var slash
run slash rpm key
by the way this uh this specific
file was the one i licked
in my first research to get
authentication bypass
so yeah fortunately as we saw
before rokus insists on saving passwords
as plain text so
thank you for that um okay so all you
have to do is to repeat the attack
with the original credentials and this
is
how we can also avoid leaving any
footprint on the device
okay um so this is the time for my
uh final and second demo uh for this
i'll
only use a single screen terminal
and okay first i would like to show you
guys the
override itself let's open it with vi
okay so as we saw before this is the
admin element xml element and
uh this is the password we can
just use a different password let's go
with
confidence 2020
and uh okay so this is it another
payload i would like to share with you
is the new command injection
uh and here as we saw there's the
upload file and here i'm using the
shebang with a new line
and i'm running a telnet with tabs
that's gonna listen to port 7331
but of course okay so let's start with
the
the credentials override
um yeah okay so again this is a standard
w
get request with the payload to uh
to admin um wla
conf and um
this is it uh the credentials were
override
now i would like to do a standard login
request
so here yeah i already got it saved but
here is the
the new um the new credentials
right admin and confidence 2020
and as we can see i got a cookie and i
got a csrf uh
now i would like to uh to run my command
injection
um so this is it
and i just need to update uh the
right cookie and we'll be good to go so
this is the
this is the cookie and let's uh why not
let's update the
uh csrf token as well okay so this is it
now we're gonna send
uh the payload uh that's gonna run a
telnet on the device
okay seems seems okay all i need to do
now is to telnet
my uh device on seven two two
three three one and yeah as you can see
i got a busy box shell
i am the roots and of course i'm the
yeah of course i'm part of the
roots group and yeah this is it so this
is the other way
we managed to hack the the access point
okay so um in conclusion
today i demonstrated uh two pre-off
rce the first one was pre-off
stack buffer overflow and the second
was command injection with credentials
overwrite
i will also shared my
new and improved guitar script that
really helped me with this
specific research
rockers networks were was informed about
these vulnerabilities
i requested six cvs and they incorporate
them all and in total
in this two research uh these two
research were concluded in
17 cbs that resulted in five different
rc's so as i usually say in my talk
if there are any ruckus users here
you should stop what you're doing and
check that you're running
the latest firmware uh if not
then tough luck
okay so uh well this is it uh
these two research were tons of fun i'm
really glad that i helped ruckus making
their
equipment better by the end of this
week i will post my second blog post
at alif research aleppsecurity.com
uh feel free to check our blog
for my previous research for this
research and other amazing research done
by our group
and this is it thank you very much for
listening
and stay safe and healthy
i think this is the time i passed the
microphone