Unexpected Journey #2 – Taking Down Entire Domain Using Vulnerabilities of a SIEM Product

Share this…

As I said on my previous article, being a penetration tester makes us feel like a group of traveler. Today, I would like to share a details about yet another 0day vulnerability we’ve found during penetration test which later lead us to take down entire domain network.

Several days ago, Mucahit -who is also author of pentest.blog- from our pentest team came to me with an IP address that runs a paid service named as Eventlog Analyzer from ManageEngine. He had already found a default credentials, which was admin/admin, and had logged in. Once you got an access to the SIEM product where every single line of event logs recorded, you much likely have an opportunity to mine sensitive logs. So we did. I wanted Mucahit to look for records of failed login attempts.

When someone failed to login a Windows machine, Windows Security Log Event ID 4625 will be generated. This event must be captured by SIEM product with a details of username and password pair. But this type of event doesn’t mean cyber attack in every case. People usually use 4-5 different password in their life time. So once someone got a failed login error, probably he gonna try another password that he might be used in the past. Or it could be a very simple typo. Thus, I was hoping a find a failed login attempt record that contains used credentials in a plain-text. If we managed to find this event log, we could try to login by using SMB or we can guess actual password considering the possibility of typo.

 

Come on! chope, chope

To be honest, I was hoping find a useful information at previous step. But we failed. It was the moment when I decided to go big! We downloaded the software from vendor page and started analyzing it. Since it’s a Java project, it contains hell of jar file. It’s almost impossible to decompile every single jar file and then find a vulnerability. Even if you managed to find one, you gotta find a relavent url path definition where you can reach a spotted point. That requires too much time to spend and this is not a vulnerability researching project, we’re at the middle of the pentest..! Thus, I usually follow reverse direction while analyzing these type of projects.

I opened up a configration files and start looking for a keywords such as run and execute. Developers tend to give such a names when executing/running query or background job. I’ve found a following endpoint in a 5 second.

Looks like there is console where you can execute a postgresql query wihtin Eventlog. It’s really good finding for beginning. While enumerating database tables I realised a very important thing that I’ve missed. Here is the question that popped in my mind.

How this product is getting log from windows machines ?

I’ve rushed to the “Manage Host” section and then choose one of the windows machine. If it’s getting record by performing windows authentication, username and password should be recorded at the database which we can execute any query we want.

Sweet..! But it seems we have a one problem. Password field is not populated while creating a form. Let’s find these host details directly from database.

It was very odd. How did it manage to mask password field even from database query result ? It should be performing blacklisting over returned array from database. If it sees a column named such as password, it replaces actual data with *****. We could bypass this protection by using as  operator that changes column name ?

Yes, you are right. Column named must be PRODAFT_BYPASS instead of INVICTUS_BYPASS, I’ve forgat to change it. Sorry.

Here is the actual data stored at PASSWORD field. Ofcourse we jumped in and tried this as a password but it didn’t worked. These data is 32 lenght and very looks like md5. But how it gonna use it during authentication ? It could be NT or LM hashes but I believe we are the only one who know hash works as well for windows authentication ? One reasonable answer is: encryption..!

Finding Encryption Method

If this data is encrypted, encryption process should be placed on module where we are creating a new record. Thus, I navigate the Add Host module (https://12.0.0.150/event/index2.do?url=addHostForm&helpP=newHost&tab=system) and found out that addHostForm value from URL. Since almost all Java developers love the seperate Form and Action into the different classes. I started to looking for addHostAction class instead of addHostForm. This process took a hours due to decompiling all jar files.

Following code is the where application performs encryption over password field. (Location at EventLogAnalyzedJSP.jar)

  1. password = (String)rM.invoke(rO, rOA);
  2. if ((password != null) && (!password.isEmpty()))
  3. {
  4. String dePassword = EnDecryptImplSingleton.getInstance().encrypt(password);
  5. LOGGER.log(Level.FINE, “Encoded password = {0}”, dePassword);
  6. password = dePassword;
  7. }
  8. hostIP = selectObj.getString(“ipaddress”);
  9. Long defaultslid = SaUtil.getSLID();

Now we need to find out EnDecryptImplSingleton class. After trying to guess relavent jar file, I’ve found following code. (Location at AdventNetInstallUtil.jar)

  1. package com.adventnet.la.util;
  3. import com.zoho.framework.utils.crypto.EnDecryptImpl;
  5. public class EnDecryptImplSingleton
  6. {
  7. public static EnDecryptImpl instance = null;
  9. public static synchronized EnDecryptImpl getInstance()
  10. {
  11. if (instance == null) {
  12. instance = new EnDecryptImpl();
  13. }
  14. return instance;
  15. }
  16. }

Now we have another target. We gotta find jar file that contains com.zoho.framework.utils.crypto.EncDecryptImpl (Location at framework-tools.jar)

  1. package com.zoho.framework.utils.crypto;
  3. import java.io.PrintStream;
  4. import java.util.logging.Level;
  5. import java.util.logging.Logger;
  6. import javax.crypto.Cipher;
  7. import javax.crypto.SecretKey;
  8. import javax.crypto.SecretKeyFactory;
  9. import javax.crypto.spec.DESKeySpec;
  11. public class EnDecryptImpl
  12. implements EnDecrypt
  13. {
  14. private static final Logger LOGGER = Logger.getLogger(EnDecrypt.class.getName());
  15. private static final String DES_KEY = “MLITE_ENCRYPT_DECRYPT”;
  16. private static final String ENCODING = “UTF-8”;
  17. private static final char[] HEX = { ‘0’, ‘1’, ‘2’, ‘3’, ‘4’, ‘5’, ‘6’, ‘7’, ‘8’, ‘9’, ‘a’, ‘b’, ‘c’, ‘d’, ‘e’, ‘f’ };
  18. private static SecretKeyFactory desKeyFactory = null;
  19. private static SecretKey desSecretKey = null;
  21. public EnDecryptImpl()
  22. {
  23. initializeKey();
  24. }
  26. private void initializeKey()
  27. {
  28. try
  29. {
  30. DESKeySpec desKeySpec = new DESKeySpec(“MLITE_ENCRYPT_DECRYPT”.getBytes(“UTF-8”));
  31. desKeyFactory = SecretKeyFactory.getInstance(“DES”);
  32. desSecretKey = desKeyFactory.generateSecret(desKeySpec);
  33. }
  34. catch (Exception e)
  35. {
  36. LOGGER.log(Level.SEVERE, “Keygeneration failed”);
  37. }
  38. }
  40. public String encrypt(String plainText)
  41. {
  42. try
  43. {
  44. Cipher desCipher = Cipher.getInstance(“DES”);
  45. desCipher.init(1, desSecretKey);
  46. byte[] cleartext = plainText.getBytes(“UTF-8”);
  47. byte[] ciphertext = desCipher.doFinal(cleartext);
  48. return BASE16_ENCODE(ciphertext);
  49. }
  50. catch (Exception e)
  51. {
  52. LOGGER.log(Level.SEVERE, “Encryption failed”);
  53. }
  54. return plainText;
  55. }
  57. public String decrypt(String cipherText)
  58. {
  59. try
  60. {
  61. Cipher desCipher = Cipher.getInstance(“DES”);
  62. desCipher.init(2, desSecretKey);
  63. byte[] ciphertext = cipherText.getBytes(“UTF-8”);
  64. byte[] dc = desCipher.doFinal(BASE16_DECODE(cipherText));
  65. return B2S(dc);
  66. }
  67. catch (Exception e)
  68. {
  69. LOGGER.log(Level.SEVERE, “Encryption failed”);
  70. }
  71. return cipherText;
  72. }
  74. private static String BASE16_ENCODE(byte[] input)
  75. {
  76. char[] b16 = new char[input.length * 2];
  77. int i = 0;
  78. for (byte c : input)
  79. {
  80. int low = c & 0xF;
  81. int high = (c & 0xF0) >> 4;
  82. b16[(i++)] = HEX[high];
  83. b16[(i++)] = HEX[low];
  84. }
  85. return new String(b16);
  86. }
  88. private static byte[] BASE16_DECODE(String b16str)
  89. {
  90. int len = b16str.length();
  91. byte[] out = new byte[len / 2];
  92. int j = 0;
  93. for (int i = 0; i < len; i += 2)
  94. {
  95. int c1 = INT(b16str.charAt(i));
  96. int c2 = INT(b16str.charAt(i + 1));
  97. int bt = c1 << 4 | c2;
  98. out[(j++)] = ((byte)bt);
  99. }
  100. return out;
  101. }
  103. private static int INT(char c)
  104. {
  105. return Integer.decode(“0x” + c).intValue();
  106. }
  108. private static String B2S(byte[] bytes)
  109. {
  110. StringBuilder buffer = new StringBuilder();
  111. for (byte c : bytes) {
  112. buffer.append((char)c);
  113. }
  114. return buffer.toString();
  115. }
  117. public static void main(String[] args)
  118. {
  119. EnDecrypt encryptor = new EnDecryptImpl();
  120. for (String plainText : args) {
  121. System.out.println(plainText + “=” + encryptor.encrypt(plainText));
  122. }
  123. }
  124. }

You must realized the issue about above code. It doesn’t get encryption key from configuration file or doesn’t create a new one while saving record into the database. Either we don’t see a code something like getConf() or any process about generating new one.

Source:https://pentest.blog