Terminology

Obviously, if you are going to exploit a NAS (Network Attached Storage) you better know what NAS is. Same goes for some other terms and technologies. So, I thought that defining some terms would be a good starting point!

Encryption

The art of encryption is "the process of converting information or data into a code, especially to prevent unauthorized access." Encryption is in our everyday lives; it protects our livelihood from attackers constantly.

There are two main types of encryption: symmetric and asymmetric. Symmetric is really fast for encryption and decryption; it has been around since the days of Cesar, with the classic cipher being the Cesar Cipher. But, this has the issue of getting the key of the encryption to the other person. Asymmetric encryption is really slow, but can solve this problem of needing to have a shared key! There is a public key, which everyone knows, to encrypt the information. Then, there is a private key, that is used to decrypt the information, that only the receiver knows. The only algorithm we need to know for this video is AES(Advanced Encryption Standard). But, the Cesar Cipher is a good reference to understand what is going on.

Disassemble

Nmap

URL Encode

Other

Humble Beginnings

Goals

What is the goal of any penetration test? Well, let's think like a hacker here. The goal of a hacker is to have as much of a foothold on the system as possible. So, looking for command injections, unauthenticated requests and privilege escalation are all great ways to have as much of a foothold on the router as possible. Before watching this video, I did not understand what to look for during a penetration test in order to compromise the system. Now, though, this seems to be more clear to me.

Information Gathering

Playing around with the device to understand how the device works is very crucial. Josh messes around with a few of the NAS's interfaces before proceeding much further. Events, such as adding users, adding files and a few other things were being tested. From this, he figured out, through viewing Burps view of web requests, that PHP was being used. PHP is known for having remote code execution vulnerabilities everywhere, just because of the nature of the language. So, this was a great thing to see. Further, he figured out that input validation was not being done very well. Within the first few minutes, when adding a user, a XSS(Cross Site Scripting) vulnerability and command injection were both possible. Again, understanding the attack vector is immensely important! So, what to do next?

Base Knowledge

Reading The Source Code

Discovery Of PHP Files

Meyer wanted to view the PHP source code to search for functions like 'exec', 'system', 'shell_exec' among others. But, when he went to view the .PHP files from the network requests that he had made, it was a garbled mess! He ran the file command on the PHP file to see that it was a binary data file. How could this be, it is labeled as a PHP file but its just a mess?

Thought Process After Seeing The Files

Getting the Key

First of all, Meyer had an incredible amount of knowledge to figure out this. I would really like to tip my cap to the man for deciphering this puzzle. The first thing he did was disassemble the PHP interpreter into assembly with binary ninja.

Now that he has the code for the system, where is a good place to start looking? This interpreter must be gigantic...Again, having a overall knowledge of the cyber security world has helped us again! Josh made two key assumptions that enabled him to find the key so quickly: 1) Assuming the key must be a symmetric key algorithm of some kind. I assume he made this call because the interpreter must decrypt the source code really quickly for the file. From this, he deduced that 2) the AES encryption algorithm is probably being used, by the sheer amount of popularity and usage of it as a symmetric encryption algorithm. These two claims made finding the key a simple string search of "AES" away from finding the key.

After reading a little Assembly, he figured out that AES is used to encrypt the files. Further, this value is then hashed with the MD5 hashing algorithm, to add a little bit of indirection. So, now, we have the key!

Decrypting The Source Code

Entering the Exploitation Zone!

Hmm, So Many Holes

Mr. Meyer then searched for 'exec' to find hundreds of examples of its usage. Obviously, with very little input validation, command injections were going to be everywhere inside this. However, let's think like an attacker again...Will I have credentials to log onto the device to add a user? Yeah, that is not the case. At this point, he decided to look for unauthenticated requests in the code for a more useful attack. He could have searched for privilege escalation vulnerabilities, then used the command injection. But, that seemed to require too many steps.

Decision Time

After searching for a while, he came to one particular function that did not require authentication that used an exploitable command without input validation. The process of finding/choosing this was not discussed in the video; but, I am sure this took a long time to find. I wish that this would have been discussed in a little more detail, personally.

Fun Time!

After identifying a vulnerable target, he encoded a telnet connection in his request. Even though it was a pretty simple command, it caught my eye. Typically, when I want to execute a command, I use keywords like cat or something. However, his request looked like this:

 
usr/sbin/telnetd -l /bin/sh -p 12345

In order to test to see if the exploit worked, he runs a quick Nmap scan on the target NAS device. Once he sees the newly opened telnet port, he has successfully created a backdoor onto the network. From, here, simply connect, using telnet, to take files, steal credentials or whatever mischievous things there are to do!

Personal Takeaways

Automation

Going through every single file to find all the command injection points just did not seem feasible. Further, decrypting every single file one by one also has a waste of time. So, in both cases, this was automated! Creating the automation step can take some time; but, in the long run this saves an immense amount of time. Automate, automate, automate...

The Flow

Understanding how the flow of program works is incredibly useful. This includes which parameters are needed for certain branches to be taken, the necessary values for the parameters, where the execution flow goes from file to file... There are so many parts that contribute to the flow of program. Without having an understanding of the flow, this exploit most likely would not have been found. This summer, while working at Faithlife, I traced an immense amount of code, attempting to debug it. I am very happy that I got this opportunity, as it has really helped my ability to understand how a piece of software works.

Another example of understanding the flow was when the PHP files were a garbled mess. Mr. Meyer knew that the files had to be decrypted at some point. So, he was able to figure out that the PHP interpreter itself was doing this.

Systematic

A few days ago I was playing around with OWASP Juice Box, which is a purposely vulnerable Web App to practice pen-testing on. After a few hours of trying to find a particular vulnerability I decided to see what I had missed. Well, instead of checking for XSS by bypassing the client-side validation on every request I tried on almost all. This mistake was made because I randomly decided what to test and how to test it. From this, I gathered that my penetration testing techniques needed to be systematic, automated when possible and intentional. Alongside being systematic means writing ideas, plans and scripts down for later usage/collection of thought also seems like a good idea.

By understanding what has been tested, and how, tests will not be skipped or duplicated. It is hard to see how many notes, ideas and other things are done doing the actual process of the penetration test. Over the summer, I took diligant notes about what I was doing, which helped me slow down and make better design decisions. But, it is safe to assume the documentation of the penetration test is recorded well. While I was watching this stream, I realized the importance of being intentional with a penetration test.

Another reason I bring this up was because during the presentation, Meyer seemed a little lost at trying to find a particular function towards the end of the stream. If he would have been more intentional about taking better notes, then this would not have happened on a live stream of this exploit.

Deep Breath Goes a Long Ways

As I mentioned before I was really taken aback by the solution to the PHP files being a mess of binary data. I personally would not have ever came to that solution at first glance. At this point, it would have been a very valuable decision to take a step back.To me, taking a deep breath to regather myself goes quite a long ways! If I do not do this, then I get pigeon holed on a certain solution to a problem. So, the real takeaway from this is to take a step back, take a deep breath and think about the problem from a different angle once I'm stuck.

Conclusion

At home, please give Joshua Meyer a hand! These sorts of videos/walk-throughs are very beneficial to the up and coming penetration testing community. Please keep up the good work Josh! Further, if you or an ISE employee is reading this article, please contact me! I would love to discuss this vulnerability and the process of discovering it more! My email is in the footer or on my github mdulin2.

To start with, I want to give a huge shout out to the ISE(Independent Security Evaluators) for running the IoT village and the SOHOpelessly Broken challenge at DEFCON 26. I really enjoyed the village, contest, people and the talks! Please keep up what you're doing!

Going into my last day at work, I thought it was appropriate to reflect on my previous 3 months at the company. Faithlife is an amazing place to work, constantly winning awards for the best company to work at. The internship program is no different. There are brilliant people all around, major opportunities for growth and fun projects to work on. I would love to give a huge shoutout to David Mitchell, the 13 year veteran of the company, for taking ownership of the intern program! It has been a fantastic learning experience to the point where I have virtually no complaints about the internship. Thanks for making this such a great experience.