Windows File Pseudonyms<br />Strange Filenames and Haiku<br />OR:<br />Pwnage and Poetry<br />Dan Crowley<br />Core Securi...
A quick disclaimer<br />		Most of the techniques presented here are demonstrated on web-based technologies.<br />		HOWEVER...
The Big Problem ™<br />Applications tend to do string-based analysis of file paths<br />Often, to decide how to handle fil...
8.3 Aliases<br />8 dot 3 format<br />It’s self explanatory<br />…only to a point<br />
8.3 Aliases<br />In DOS, file names must conform to the 8.3 format, meaning:<br />A basename of (max) 8 characters<br />Fo...
Why do I (audience) care?<br />Because “highlight.php” != “HIGHLI~1.PHP”<br />If your IDS is looking for the old PHPBB hig...
Web App Authentication Bypass<br />Consider the following scenario:<br />Admin.php checks for authentication<br />If authe...
But wait, there’s more!<br />Long file names<br />Maximum length: 255<br />Approx. char set size: 63000<br />Approx. possi...
Discarded trailing characters<br />“Let’s get rid of stuff<br />At the end of filenames!”<br />Must have once been said.<b...
Discarded trailing characters<br />Certain characters at the end of file names/paths are silently discarded by Windows!<br...
Equivalent file path examples<br />All of the following paths are valid and equivalent when given to the Windows shell:<br...
DOS special device files<br />Ancient dinosaurs<br />Used to redirect data<br />With some devices<br />
DOS special device files<br />Similar to device files on *nix<br />Allows file operations to be performed on devices<br />...
DOS special files quirk #1<br />They exist “everywhere”<br />Can be accessed from any path, even:<br />In directories whic...
DOS special files quirk #2<br />They can have any file extension, it’s ignored<br />The following examples are equivalent:...
Denial-of-Service<br />A theoretical application accepts file names and reads the associated files<br />This application b...
Buffer overflow<br />A Windows application takes in a file name<br />The file is verified as existing<br />If it exists, t...
You should know better!<br />Microsoft Windows ~ Hoist upon its own petard ~ You should know better!<br />
Defeating Windows file permissions<br />Normal users have access to CON<br />But not C:denied_dirdenied_file.txt<br />C:de...
TOOL:SFNBRUTE.PY<br />Enumeration<br />Filenames found through brute force<br />Despite permissions<br />
Controlling file handling<br />Don’t forget:<br />You can use ANY extension!<br />Files are often handled based on extensi...
Namespace prefixes<br />What an awful mess!<br />I can’t write haiku about<br />Namespace prefixes...<br />
Namespace prefixes<br />Used when files can’t be referred to with normal paths<br />Because they’re really devices<br />Be...
Minimal parsing prefix<br />An invalid name or path can sometimes be used anyway<br />MAX_PATH can be exceeded<br />Some r...
UNC (Short and Long)<br />Used to refer to files on SMB shares<br />Can be used to refer to files across the Internet<br /...
NT device namespace prefix<br />Used to refer to device namespace<br />These paths start with <br />Examples include:<br /...
NTLM credential capture<br />When accessing SMB shares, authentication may be requested<br />If an attacker runs the SMB s...
Directory traversal<br />“C:” doesn’t match:<br />C:<br />27.0.0.1C$<br />27.3.13.37C$<br />UNC127.0.0.1C$<br />GLOBALROOT...
Buffer overflow<br />Minimal parsing prefix allows for the use of paths exceeding MAX_PATH<br />Some developers don’t know...
Making Windows rootkits deadlier<br />Imagine that you’re a Windows sysadmin<br />Someone creates a file named “CON” with ...
Defeat AV systems<br />Make files with illegal names<br />(“con.exe”, “lol.exe.”, etc.)<br />Put something malicious in th...
Client-side Attacks<br />Switching security zones<br />Reference “C:file.txt”<br />NO THAT’S A LOCAL FILE BAD HACKER<br />...
DEMONSTRATION:nginx and php on windows<br />Now I understand,<br />But I still don’t believe you.<br />SHOW ME THE MONEY!<...
Questions?<br />There’s no dumb question…<br />“Is the computer plugged in?”<br />Is pretty bad, though.<br />Dan Crowley<...
Upcoming SlideShare
Loading in …5
×

Windows File Pseudonyms

8,062 views

Published on

A presentation on using alternate ways to reference file names and paths in Windows systems to bypass security measures.

There's a relevant haiku on every slide, so if you get bored, you can always read the haiku.

Published in: Technology
0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
8,062
On SlideShare
0
From Embeds
0
Number of Embeds
56
Actions
Shares
0
Downloads
77
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide

Windows File Pseudonyms

  1. 1. Windows File Pseudonyms<br />Strange Filenames and Haiku<br />OR:<br />Pwnage and Poetry<br />Dan Crowley<br />Core Security Technologies<br />dcrowley@coresecurity.com<br />
  2. 2. A quick disclaimer<br /> Most of the techniques presented here are demonstrated on web-based technologies.<br /> HOWEVER, the techniques and principles explained should apply to any application which takes a file path or name of any sort from user input which will be used on a Windows system.<br />(Furthermore, I will provide a bottle of delicious beer to anyone who finds a use for these techniques which isn’t in this presentation!)<br />Each slide of this talk ~ Shall hence be accompanied ~ By clever haiku<br />
  3. 3. The Big Problem ™<br />Applications tend to do string-based analysis of file paths<br />Often, to decide how to handle files<br />Or whether or not files should be served<br />Or whether the file path may be malicious in nature<br />We can reference one file or directory with many different equivalent strings<br />Applications may not expect some of these strings<br />The OS interacts with the filesystem, not the app<br />Developers may not even be aware that their application will accept such names!<br />Some of these names are based on undocumented features<br />One cannot expect ~ To judge books by their covers ~ And find success<br />
  4. 4. 8.3 Aliases<br />8 dot 3 format<br />It’s self explanatory<br />…only to a point<br />
  5. 5. 8.3 Aliases<br />In DOS, file names must conform to the 8.3 format, meaning:<br />A basename of (max) 8 characters<br />Followed by one period<br />Followed by a (max) three character extension<br />Windows likes backwards compatibility<br />Each file (and directory!) created on default Windows installations has a DOS-compatible name<br />If the name isn’t 8.3 compatible, a second name (an 8.3 alias or short file name [SFN]) is made<br />Simplified, they are generated as follows:<br />Remove some characters (0x80-0xff) and convert some characters to underscores (like + and space)<br />Start with the first six characters<br />Add a tilde<br />And a digit to distinguish from other files starting with the same characters<br />Add a period<br />And up to the first three characters of the file extension<br />Windows might as well ~ Be backwards-compatible ~ With the abacus<br />
  6. 6. Why do I (audience) care?<br />Because “highlight.php” != “HIGHLI~1.PHP”<br />If your IDS is looking for the old PHPBB highlight command exec flaw, it may not find it<br />Because “.htpasswd” != “HTPASS~1”<br />Your forbidden files may no longer be forbidden<br />File type may be determined by user input<br />Whatever follows the last dot is the file extension<br />So perhaps you can upload file.phPWNED<br />And request FILE~1.PHP<br />Use removed characters to force an extension <3 chars<br />And you will know me ~ By the trail of characters ~ After the last dot<br />
  7. 7. Web App Authentication Bypass<br />Consider the following scenario:<br />Admin.php checks for authentication<br />If authenticated, several external scripts can be called through Admin.php at the whim of the user<br />DeleteUser.php, AddUser.php, UpdateWebPage.php<br />These external scripts cannot be called directly<br />if($_SERVER[‘PHP_SELF’] == ‘/admin/DeleteUser.php’){ die(‘O RLY?’);}else{ do_something_privileged(); }<br />YA RLY<br />‘/admin/DeleteUser.php’ != ‘/admin/DELETE~1.PHP’<br />I’m taking a break ~ From sensible haiku now ~ Tonsillectomy<br />
  8. 8. But wait, there’s more!<br />Long file names<br />Maximum length: 255<br />Approx. char set size: 63000<br />Approx. possible names:63000^255 = 6.78E+1223<br />Short file names (8.3 aliases)<br />Maximum length: 12 (-1 for dot)<br />Approx. char set size: 59<br />Approx. possible names:59^11 = 3.01E+18<br /> If every file on a Windows box has an 8.3 compatible name (and by default, this is the case) we can immensely reduce the time and resources needed to guess filenames when trying to enumerate file names by brute-force. This can be further reduced if the file extension is known, reducing the complexity to 59^8 = 1.46E+14, or approx. 146,000,000,000,000 possibilities!<br />Huge complexities ~ Collapsing conveniently ~ To simplicity<br />
  9. 9. Discarded trailing characters<br />“Let’s get rid of stuff<br />At the end of filenames!”<br />Must have once been said.<br />
  10. 10. Discarded trailing characters<br />Certain characters at the end of file names/paths are silently discarded by Windows!<br />In Windows API calls, the following items are discarded:<br />Periods<br />Spaces<br />The Windows shell will also allow, in specific configurations:<br />Double quotes (as long as they are closed properly)<br />Angle brackets (only in certain configurations)<br />Extraneous current directory markers (“/.”)<br />Extraneous parent directory markers with arbitrary items (fake or real)<br />Trailing characters ~ Of certain varieties: ~ Removed, silently.<br />
  11. 11. Equivalent file path examples<br />All of the following paths are valid and equivalent when given to the Windows shell:<br />file.txt<br />file.txt.....<br />file.txt<spaces><br />file.txt””””<br />file.txt<<<>><><<br />file.txt/././././.<br />nonexistant/../file.txt<br />Different technique, similar use<br />“highlight.php” != “highlight.php.”<br />“restricted.txt” != “restricted.txt<space>”<br />Flexibility ~ In Windows nomenclature ~ Borders on silly<br />
  12. 12. DOS special device files<br />Ancient dinosaurs<br />Used to redirect data<br />With some devices<br />
  13. 13. DOS special device files<br />Similar to device files on *nix<br />Allows file operations to be performed on devices<br />Examples include:<br />CON, the console<br />PRN, a parallel printer<br />COM1, the first serial port<br />NUL, a bit bucket (/dev/null equivalent)<br />Pretty well known already, BUT…<br />When you speak to me ~ I redirect all of it ~ To slash-dev-slash-null.<br />
  14. 14. DOS special files quirk #1<br />They exist “everywhere”<br />Can be accessed from any path, even:<br />In directories which you are denied access to<br />With an existing file as a “directory” which “contains” the file<br />Examples of equivalent paths to CON:<br />CON<br />C:CON<br />C:CON<br />C:..........CON<br />C: estricted_dirCON<br />C:existing_file.txtCON<br />Like apparitions ~ They exist in every place ~ And yet in no place<br />
  15. 15. DOS special files quirk #2<br />They can have any file extension, it’s ignored<br />The following examples are equivalent:<br />CON<br />CON.bat<br />CON.php<br />CON.conf<br />CON.thisisalongandarbitraryfileextension<br />CON.<1000x”A”><br />Mr. Shakespeare knows ~ A rose by another name ~ Still smells just as sweet<br />
  16. 16. Denial-of-Service<br />A theoretical application accepts file names and reads the associated files<br />This application blocks any file named “CON”, “AUX”, “PRN” etc. to prevent DoS<br />Applications will generally pause to read from a file until EOF<br />EOF may never arrive from devices like AUX<br />It does NOT block files named, for instance, “AUX.txt”<br />Which we know is equivalent to AUX<br />…And while we’re at it, ~ Since we’re speaking of Shakespeare… ~ All’s well that ends well!<br />
  17. 17. Buffer overflow<br />A Windows application takes in a file name<br />The file is verified as existing<br />If it exists, the program does something with the file name<br />And might trust that it doesn’t exceed NTFS limitations<br />What if the file name is “CON.<‘A’x1000>”?<br />Technically, it exists…<br />…but not in the filesystem, so it’s not bound to NTFS limitations<br />Why one needs all this ~ DOS file extension stuff ~ Is just beyond me<br />
  18. 18. You should know better!<br />Microsoft Windows ~ Hoist upon its own petard ~ You should know better!<br />
  19. 19. Defeating Windows file permissions<br />Normal users have access to CON<br />But not C:denied_dirdenied_file.txt<br />C:denied_dir on_existent_file.txtCON<br />No access<br />C:denied_dirdenied_file.txtCON<br />Access to console<br />Now you can check the existence of files which you cannot read in directories you cannot read!<br />It is easiest ~ To acquire forgiveness ~ And not permission<br />
  20. 20. TOOL:SFNBRUTE.PY<br />Enumeration<br />Filenames found through brute force<br />Despite permissions<br />
  21. 21. Controlling file handling<br />Don’t forget:<br />You can use ANY extension!<br />Files are often handled based on extension<br />DOS special files, then, can often be handled as ANYTHING YOU CHOOSE!<br />http://www.example.com/com1.php<br />What if COM1 was attached to a serial modem?<br />…Or more likely, a Bluetooth dongle?<br />A riddle for you… ~ When is a CON not a CON? ~ When it’s a dot-jar!<br />
  22. 22. Namespace prefixes<br />What an awful mess!<br />I can’t write haiku about<br />Namespace prefixes...<br />
  23. 23. Namespace prefixes<br />Used when files can’t be referred to with normal paths<br />Because they’re really devices<br />Because they don’t exist on the local filesystem<br />Because they have strange names<br />A distant echo ~ Of a victim, falling dead ~ The hunter shouts “PWNED!”<br />
  24. 24. Minimal parsing prefix<br />An invalid name or path can sometimes be used anyway<br />MAX_PATH can be exceeded<br />Some restricted characters can be used<br />Reserved basenames can be used<br />Just precede it with <br />Must be an absolute path<br />No current directory indicator ( ./ )<br />No parent directory indicator ( ../ )<br />You don’t like the rules? ~ Double wack, question mark, wack. ~ You’re welcome, buddy.<br />
  25. 25. UNC (Short and Long)<br />Used to refer to files on SMB shares<br />Can be used to refer to files across the Internet<br />erver_name_or_ipsharefile<br />This is “Short UNC”<br />Nothing terribly special<br />UNCserver_name_or_ipsharefile<br />This is “Long UNC”<br />Allows for the use of the prefix with UNC paths<br />What’s the best thing ~ About SMB traffic? ~ Credential replay!<br />
  26. 26. NT device namespace prefix<br />Used to refer to device namespace<br />These paths start with <br />Examples include:<br />airpcap00<br />An AirPcap card<br />GLOBALROOTDeviceHarddiskVolume1<br />The first hard disk volume on the machine<br />Might be equivalent to, for instance, C:<br />Doesn’t need an assigned drive letter!<br />CdRom0<br />The first disc drive on the computer<br />WinObj from Sysinternals will allow you to browse the NT device namespace<br />The device namespace ~ Allows access to devices ~ Using file paths<br />
  27. 27. NTLM credential capture<br />When accessing SMB shares, authentication may be requested<br />If an attacker runs the SMB server, you can bet it will<br />The SMB client machine will often send stored credentials automatically<br />And as you may know these credentials can be replayed or cracked<br />And we can trigger a machine to access an SMB share with a UNC path!<br />A replay attack ~ With SMB credentials ~ Should not still succeed!<br />
  28. 28. Directory traversal<br />“C:” doesn’t match:<br />C:<br />27.0.0.1C$<br />27.3.13.37C$<br />UNC127.0.0.1C$<br />GLOBALROOTDeviceHarddiskVolume1<br />…but they’re all equivalent!<br />I ought to mention ~ Directory traversal ~ Ed Skoudis said so!<br />
  29. 29. Buffer overflow<br />Minimal parsing prefix allows for the use of paths exceeding MAX_PATH<br />Some developers don’t know you can exceed MAX_PATH<br />…or assume that if the file exists that it can’t exceed MAX_PATH<br />NOP NOPNOPNOPNOP ~ NOP NOPNOPNOPNOPShellcode ~ Pointer to NOP sled<br />
  30. 30. Making Windows rootkits deadlier<br />Imagine that you’re a Windows sysadmin<br />Someone creates a file named “CON” with the minimal parsing prefix<br />You try “type CON” at the command line<br />Your command prompt “hangs”<br />None of your programs open it properly<br />Windows Explorer can’t delete it<br />You cry<br />You pretend it doesn’t exist<br />or convince yourself it really should be there<br />My reaction to ~ “Undocumented feature” ~ Is unbridled rage.<br />
  31. 31. Defeat AV systems<br />Make files with illegal names<br />(“con.exe”, “lol.exe.”, etc.)<br />Put something malicious in them<br />Execute them<br />???<br />PROFIT!!!<br />An AV system ~ Should reliably open ~ All suspect files<br />
  32. 32. Client-side Attacks<br />Switching security zones<br />Reference “C:file.txt”<br />NO THAT’S A LOCAL FILE BAD HACKER<br />Reference 27.0.0.1C$file.txt<br />A UNC path! I know these, they’re Intranet stuff. No prob, Bob.<br />Check out “Internet Explorer turns your personal computer into a public file server” <br />Jorge Luis Alvarez Medina, BH DC 2010<br />How do I pwn thee? ~ Let me count the ways; No, wait: ~ Just one is enough!<br />
  33. 33. DEMONSTRATION:nginx and php on windows<br />Now I understand,<br />But I still don’t believe you.<br />SHOW ME THE MONEY!<br />
  34. 34.
  35. 35. Questions?<br />There’s no dumb question…<br />“Is the computer plugged in?”<br />Is pretty bad, though.<br />Dan Crowley<br />Core Security Technologies<br />dcrowley@coresecurity.com<br />

×