00:00:00.067-->00:00:05.038 >>Good morning Las Vegas. I its not really morning, but I always wanted to say this. My name is 00:00:05.038-->00:00:10.210 Gil Cohen, I'm and I'll be your host at uh, this almost last lecture. I want to thank you all 00:00:10.210-->00:00:15.415 for attending this lecture, its not trivial that uh all of you stayed. I know that uh many went 00:00:15.415-->00:00:20.420 home or just uh staying out at the pools, so uh a big shout for you for uh uh coming. And today 00:00:25.125-->00:00:30.130 I am going to talk about eh em eh remote vulnerabilities in named pipes. So lets begin. Uh 00:00:33.700-->00:00:38.272 first I'll start off with some eh eh introduction of myself. I'm going to tell you about my 00:00:38.272-->00:00:43.710 past. Or the thing that I can tell you at least. Eh then we going to talk about some key 00:00:43.710-->00:00:49.416 terms of uh Windows named pipes in general an interesting process communication. Eh then 00:00:49.416-->00:00:53.854 I'm going to show you how to connect m- to named pipes and named pipes access control list 00:00:53.854-->00:00:59.326 in the wild. Enumerating and sniffing named pipes, fuzzing named pipes, exploitation then 00:00:59.326-->00:01:05.799 we'll eh uh re- we will move onto the audience favorite part which is like demos and then 00:01:05.799-->00:01:10.804 I'll show you some mitigations and a conclusion of my talk. So let's start. My name is Gil I'm 00:01:13.574-->00:01:18.045 thirty-four years old and I'm a CTO of Comsec Global. I'm going to tell you a little bit about 00:01:18.045-->00:01:24.384 my company at the end of this lecture. Uh this is the biggest company in Israel and uh most 00:01:24.384-->00:01:30.424 veteran one uh thirty years. One hundred fifty consultants and I've been a hacker for about 00:01:30.424-->00:01:36.430 thirteen years now. I started in Israel in military eh I was a penetration tester of all kind. 00:01:36.430-->00:01:42.669 Application and infrastructure. They and I even worked with the some Israel security agencies. I 00:01:42.669-->00:01:46.340 cannot tell which then because then I have to kill you and I don't want to kill you at the 00:01:46.340-->00:01:51.345 beginning of my presentation and you are more than I so uh I'll just spare the details. Uh so 00:01:53.747-->00:01:58.752 I've been a hacking to a lot of stuff including Windows app- windows application and during 00:01:58.752-->00:02:04.825 one of my eh penetration tests in my hacks I came across this uh vulnerability technique that 00:02:04.825-->00:02:06.827 I'm going to show you, that was uh completely unknown or forgotten by penetration testers 00:02:06.827-->00:02:11.832 and this was the motivation for my talk. But before I talking about the vulnerability itself 00:02:16.036-->00:02:22.776 let's start with some key terms. Just in case you are not familiar with it. So 00:02:22.776-->00:02:29.316 Inter-Process Communication, eh this is operating system mechanism that allows processes 00:02:29.316-->00:02:35.722 and applications to manage shared data. You can either use uh for example internal sockets, 00:02:35.722-->00:02:40.761 which uh are probably most of you know. And you have different kinds of uh inter-process 00:02:40.761-->00:02:46.566 communication as well. uh each and every participant in this communication is considered 00:02:46.566-->00:02:52.072 either a client or the server and it can be both and you can have multiple clients and 00:02:52.072-->00:02:57.077 multiple servers M to M communication. Uh and of course both clients and servers can be 00:03:00.313-->00:03:06.286 uh defined together. So uh windows named pipes is one of the methods to perform 00:03:06.286-->00:03:12.692 inter-process communications in Windows. It can either be half a one way or a two way eh uh two 00:03:12.692-->00:03:17.697 uh four duplex uh and it utilizes uh unique file system that is called NPFS, Named Pipe 00:03:21.001-->00:03:27.908 Filesystem. It can be accessed by any process in your uh local operating system. Uh subject to 00:03:27.908-->00:03:33.947 security checks which is obviously ACLs. So all instances of the same named pipe a 00:03:33.947-->00:03:38.752 connection to a named pipe is called an instance. Uh have the same name. If you have a main uh 00:03:38.752-->00:03:44.257 named pipe called Gil, then everyone who uh talks to this named pipe uh will create an in- 00:03:44.257-->00:03:49.262 instance with the same name. So there are mirroring many configurations and variations of 00:03:51.364-->00:03:56.703 named pipes. Half the, half duplex or full duplex, byte-oriented or packet-oriented 00:03:56.703-->00:04:01.641 local or network. And this is what people miss. So inter-process communication uh 00:04:06.113-->00:04:11.118 uh I un unlock unlike its name is not only internal. Its not only internal eh interface uh in 00:04:14.654-->00:04:19.659 your operating system it can be um um it can be used remotely. Named pipe communication is not 00:04:23.463-->00:04:29.269 encrypted so if you have any named pipe that is connected remotely eh it will eh use 00:04:29.269-->00:04:34.274 either SMB port four four five or RPC uh which is port one hundred and thirty-five and it 00:04:36.943-->00:04:43.183 is totally encrypted so you can obviously just sniff it and replay and in some cases even 00:04:43.183-->00:04:48.188 perform a man in the middle attack. RPC. Some of you um most of you just uh probably know it 00:04:51.758-->00:04:56.096 but I'm going to tell it anyway. This is a protocol that allows one program to invoke services 00:04:56.096-->00:05:00.934 from a program located on another computer. Just call uh eh or another service another 00:05:00.934-->00:05:06.940 process. You just call it um uh from one computer to the other uh it uses ports one hundred 00:05:06.940-->00:05:11.945 thirty-five and DCE/RPCs just a variant or a subtype- uh subtype of RPC which allows a programmer 00:05:14.080-->00:05:20.020 to think that uh the uh de- procedure is calling is actually local. When it fact it is a 00:05:20.020-->00:05:25.025 remote one. So you just make the programmers lar- life a little bit convenience. SMB uh or 00:05:27.260-->00:05:32.265 Server Message Block. This is a famous protocol. Uh it can be used for an uh file sharing um 00:05:35.135-->00:05:40.073 and printer serial port et cetera. Its mostly used for file sharing and probably most of you 00:05:40.073-->00:05:46.213 know it through uh links like this. URLs that look like this. You can see uh one hundred 00:05:46.213-->00:05:51.985 ninety-two, one sixty-eight, one one slash c dollar this is an SMB connection or slash slash 00:05:51.985-->00:05:58.425 file server. This is the famous SMB protocol. It uses port number four four five, so if you 00:05:58.425-->00:06:03.363 have any of this ports open you can connect to named pipes as well. But there are actually two 00:06:07.500-->00:06:13.874 kinds of named pipes. Not only there regular named pipes. You also have unnamed pipe or 00:06:13.874-->00:06:20.380 anonymous pipes. Not the famous synonymous that you see on the right. But an an named pipe with 00:06:20.380-->00:06:26.886 a random name. This named pipe is used only between a parent process and each child process. 00:06:26.886-->00:06:31.925 Uh and it cannot uh uh be used for communication over the network and this is why I 00:06:31.925-->00:06:36.763 haven't focused it during my research because I wanted to show to a to see which named 00:06:36.763-->00:06:41.768 pipes can be con- connected remotely. So, how can you connect to a named pipe? All 00:06:47.307-->00:06:52.312 pipes are placed in a root directly of NPFS which is slash slash sl- eh the IP address of 00:06:54.314-->00:07:00.020 the computer can be dot for example if its the the local computer. Slash pipe slash pipe 00:07:00.020-->00:07:06.059 name. This is how you connect to a pipe. But you cannot just open your windows run command and 00:07:06.059-->00:07:10.297 just connect to it. Uh you need a special connection. You ca- you are going to need to do it 00:07:10.297-->00:07:17.170 using programmer's code or co- dedicated tool that I'm going to show you. Uh in the next slides. 00:07:17.170-->00:07:22.842 So here is a a a URL for example for a connec- connecting to a named pipe. You can see slash 00:07:22.842-->00:07:28.481 slash dot slash slash pipe slash foo. This is a connection to a local pipe. And if you want to 00:07:28.481-->00:07:33.853 ge- connect to the same pipe remotely and the ACL allows it you just the IP address instead 00:07:33.853-->00:07:38.858 of the dot character. So uh the best tool in order to connect to named pipes is IO Ninja. This is 00:07:44.864-->00:07:49.169 uh a commercial tool it used to be free for all and no commercial usage but the the 00:07:49.169-->00:07:56.009 just changed uh their a uh license agreement. Uh so now it is paid only and you can uh have 00:07:56.009-->00:08:02.382 a non-registered um copy of it uh and this is like the Swiss army knife of communication in 00:08:02.382-->00:08:07.220 general in named pipes specifically. Uh you don't necessarily need to use it for 00:08:07.220-->00:08:12.826 regular TC/IP communication because you have net cat and M Up and many other great tools. 00:08:12.826-->00:08:18.865 But uh this is the only good tool for main pipes communication uh and this uh 00:08:18.865-->00:08:24.637 this is the tool I was using during my research. So how does the communication looks like 00:08:24.637-->00:08:29.642 when you open Wireshark. Because I told you that named pipes can be remotely. Uh accessed. So 00:08:34.214-->00:08:38.685 this is how it looks like you can see here uh Wireshark window. And you can see that the 00:08:38.685-->00:08:43.690 named pipe is using SMB communication and here at the bottom, you can see that this is 00:08:46.359-->00:08:51.364 total query text. So whatever is being transferred to a remote named pipe, can be sniffed. But 00:09:01.207-->00:09:06.913 there are some limitations. If you're a programmer and you uh uh start your named pipe, you 00:09:06.913-->00:09:11.918 you listen to a named pipe, you can protect it. So how can you do it? Using a ACLs. Named pipes 00:09:13.920-->00:09:20.193 are implemented by a file system driving windows and just started in windows eight in fact. And uh 00:09:20.193-->00:09:25.198 they follow the uh ACLs or eh DACLs, discretionary access control lists, permissions uh 00:09:27.834-->00:09:34.140 that are but the default uh value is that the permission is set to anyone or anonymous 00:09:34.140-->00:09:40.547 login. So if you create your own named pipe and you don't, you don't set the ACLs specifically, 00:09:40.547-->00:09:45.552 anyone can connect to it. So when many uh named pipes allows uh either anonymous access or 00:09:48.188-->00:09:52.859 only domain user access, but obviously its still a lot of users that can exploit 00:09:52.859-->00:09:59.632 vulnerabilities in it. Uh you can modify uh ACLs uh and to make a only specific users 00:09:59.632-->00:10:05.338 access uh named pipe. But a this is not the default behavior and unfortunately I witnessed a lot 00:10:05.338-->00:10:10.343 of named pipes that just didn't do it. And I'm going to show you some examples. So here is a 00:10:16.349-->00:10:21.821 named pipe for example, it's called uh this is a windows built in named pipe, it it is 00:10:21.821-->00:10:26.826 called init shutdown. And you can see, that the permissions for this named pipe is everyone 00:10:29.262-->00:10:35.335 anonymous and administrators. Which actually has no affect because everyone can access it. 00:10:35.335-->00:10:41.641 So anyone can access init shutdown and um named pipe and this is a built in windows 00:10:41.641-->00:10:46.646 operating system named pipe. And named pipe unlike any other um interface you know uh either a 00:10:51.918-->00:10:57.590 regular SMB files or sockets have additional feature which- which is called maximum 00:10:57.590-->00:11:04.297 instance. Uh a connection to a named pipe is called an instance named pipe instance. And on the 00:11:04.297-->00:11:10.403 left you can see the um uh the different named pipes and their current number of instances and 00:11:10.403-->00:11:16.109 on the right you can see that there are there is a maximum volume uh for some of them. Eh 00:11:16.109-->00:11:22.315 if the valu- the value is minus one there then there is no uh limitations. But if this is not 00:11:22.315-->00:11:28.321 minus one then the- there can be a number, maximum number of connections or instances to this 00:11:28.321-->00:11:33.626 named pipes. So you can see here, uh several named pipes with a value of one or the value 00:11:33.626-->00:11:38.631 of seven, so it means that you cannot just connect to it without any limitation. So lets 00:11:43.002-->00:11:49.642 talk about named pipes in the wild. Most of you probably heard about the conficker worm or 00:11:49.642-->00:11:54.647 conficker virus. Uh that uh was detected in November 2008. Uh it used flaws in windows operating 00:11:57.784-->00:12:03.289 system uh and it used dictionary attacks on administrator passwords to propagate while 00:12:03.289-->00:12:08.461 forming a bonnet. And used advanced malware techniques similarly to the recently 00:12:08.461-->00:12:13.466 discovered notpetya and wanna cry they're fans-wares and malwares. So uh it uh infected 00:12:16.636-->00:12:21.641 un a lot of computers. Millions of computers in one one hundred and ninety countries. And it had 00:12:24.477-->00:12:29.482 several variations. This is how it look likes. Very nice. One variation which is dot net 00:12:34.420-->00:12:39.425 variation C, creates a named pipe over which it pushes URLs for downloadable downloadable 00:12:42.662-->00:12:47.700 payloads for other infected computers in your LAN. So if you have one computer that is 00:12:47.700-->00:12:52.939 infected and it gets the command from the command control center, it just propagate this command 00:12:52.939-->00:12:59.112 through named pipe in order to make sure that the rest of uh the affected computer gets the 00:12:59.112-->00:13:05.551 same command as well. And this is uh not only used by Conficker but by others as well such as 00:13:05.551-->00:13:10.556 Moker and ZxShells and even the famous, now famous, Petya. So how can you enumerate? And scan 00:13:15.695-->00:13:20.667 for named pipes? If you want to have a look at your own named pipes in your own windows 00:13:20.667-->00:13:26.406 computer, you an just use the sys internals pipe list. This is the best tool for enumerating 00:13:26.406-->00:13:32.812 named pipes. Uh and you can just uh run it and immediately see what we just witnessed in the uh 00:13:32.812-->00:13:37.684 in the previous slide. All of the pipe names, the current number of instance instances and 00:13:37.684-->00:13:43.122 the maximum number of instances uh so this is what you should use if you want to, to see what 00:13:43.122-->00:13:48.127 named pipes are listening in your own computer. The are a there are uh multiple tools of 00:13:50.930-->00:13:56.569 uh checking the uh uh access control list for named pipes. This is a deprecated tools, it 00:13:56.569-->00:14:03.276 is c- called behind security pipe security editor um but unfortunately it is unmaintained 00:14:03.276-->00:14:09.549 and deprecated because uh it only works in windows xp or older. Uh but you can see that 00:14:09.549-->00:14:16.522 uh this tool uh used to allow you to edit named pipes permissions in real time. Just 00:14:16.522-->00:14:22.261 like as you do with files. So unfortunately there are no similar tools for newer versions 00:14:22.261-->00:14:27.266 of windows. This and this uh a deprecated tools. But for current w- windows versions, you 00:14:29.435-->00:14:34.440 can use the sys internals pipe ACL. It comes with a same package. Its pipe list. And one- 00:14:36.542-->00:14:42.515 once you activate it, you see the output that we saw earlier. Which uh which tells you which 00:14:42.515-->00:14:48.921 uh the groups have permissions for the current named pipe that you're checking in this example 00:14:48.921-->00:14:54.794 I was checking the another windows operating system. Um named pipe which is called 00:14:54.794-->00:14:59.799 lsarpc and here again anonymous access to everyone. So how can you remotely enumerate named 00:15:05.371-->00:15:11.244 pipes. There aren't many tools for doing it, but there are several scripts in Metasploit uh 00:15:11.244-->00:15:17.150 not very common scripts and not well knows. Uh but uh you can see it to uh non the less. This 00:15:17.150-->00:15:22.922 is called pipe editor and you can uh use it in order to remotely uh scan for named 00:15:22.922-->00:15:28.661 pipes. If you want use uh scan it using SMB, uh you use the original pipe editor script. If 00:15:28.661-->00:15:33.666 you want to use it uh to scan it using RPC you use pipe dcerpc auditor. So you can see an 00:15:35.701-->00:15:40.706 example of it executing uh pipe dcrpc auditor and it allows you to uh to scan remotely. It uh 00:15:43.676-->00:15:49.715 this uh script has their own uh database of a named pipe names because its not like scanning 00:15:49.715-->00:15:54.687 for ports. You don't know all of the values of the default values uh so you need to have a list of 00:15:54.687-->00:16:00.026 uh a named pipes. I don't know how this is well maintained or not uh but you can still try to 00:16:00.026-->00:16:02.028 use it. So, how can you sniff content of named pipes. Lets say you want to discover a new 00:16:02.028-->00:16:04.030 vulnerability, a new remote code execution or a new denial of service. The first thing that 00:16:04.030-->00:16:08.067 you need to do is to get a valid communication. So how can you do it? So IO Ninja to the rescue. 00:16:08.067-->00:16:13.072 Yet again. The IO Ninja uh as I told you earlier is uh Swiss army knife of named pipes. Uh 00:16:28.588-->00:16:33.893 you can use it both to connect named pipes, to listen to named pipes if you want. You can even 00:16:33.893-->00:16:38.898 create a named pipe server and also to use it as a named pipe sniffer. A this is a new model 00:16:41.601-->00:16:46.606 in IO Ninja. So you can see my own computer. I can start it. It has some bugs because every now 00:16:52.144-->00:16:56.782 and then it finds named pipes. Anonymous named pipes that it cannot print. But if you wait a 00:16:56.782-->00:17:01.721 little bit. Let's see if I see some named pipes communication. As I told you its a rather new 00:17:07.627-->00:17:12.632 uh model so its not perfect yet, but. It just wait for a second or two. This is the windows 00:17:21.574-->00:17:26.579 operating system I'm waiting for. Come on Bill Gates now. Ok I'll just show you in the 00:17:30.149-->00:17:36.789 presentation. Should. So this is how it looks like. When you see communication is uh so you can 00:17:36.789-->00:17:43.729 see the open named pipes in this example its mms server and you can see the entire communication 00:17:43.729-->00:17:50.503 totally pure text. Unless of course the protocol itself uh embeds uh encryption of any 00:17:50.503-->00:17:55.508 kind. So a key process of finding vulnerabilities uh either in uh if you want to jail 00:18:04.016-->00:18:09.021 break iPhone or you want to find any uh unmatched code vulnerabilities uh is fuzzing. 00:18:11.490-->00:18:16.228 And this is what we were doing. If you are not familiar with fuzzing, lets just quickly uh go 00:18:16.228-->00:18:22.068 through the the uh basic uh termin- terminology definition of it. Fuzzing or fuzz testing 00:18:22.068-->00:18:26.706 is an automated software testing technique that involves providing invalid, unexpected or 00:18:26.706-->00:18:31.711 random data. You just bombard the interface with any unexpected values. But uh it 00:18:31.711-->00:18:37.984 sounds a little bit like QA, but this is done automatically. QA is usually done manually. You 00:18:37.984-->00:18:44.690 have the QA guy that just write the script and send it a- and um buzzers do it for you, the 00:18:44.690-->00:18:50.196 automatic fuzzing tools do it for you in the fuzzing process. Uh you then monitor uh the 00:18:50.196-->00:18:54.634 program that you are trying to crush or to find vulnerability in and if anything's wrong, you 00:18:54.634-->00:18:59.638 know that you can uh uh further investigate. Usually a buzzers are used to test unmanaged code. 00:19:01.974-->00:19:07.980 C and C plus plus uh because usually you want to find any sort of buffer overflows and for 00:19:07.980-->00:19:14.920 example Microsoft uh embeds fuzzing processes in their um in their development operation for 00:19:14.920-->00:19:21.894 any product they do. For example if you have uh Microsoft office they perform multiple fuzzing uh 00:19:21.894-->00:19:28.467 on each and every uh application of it and they found multiple vulnerabilities in their passes. 00:19:28.467-->00:19:33.472 So this is a very uh useful technique in finding s- bugs. And but there are in fact two 00:19:35.608-->00:19:42.381 kinds of fuzzings. Dumb fuzzing or black box fuzzing. And smart fuzzing. Dumb fuzzing is a you 00:19:42.381-->00:19:47.586 just go over a- ay- a- go go over all the possible inputs without undespe- uh understand 00:19:47.586-->00:19:52.224 the expected one. You just bombard it with random data or with sequential data and you 00:19:52.224-->00:19:56.629 don't understand what's the purpose of the parameter that you're trying to fuzz. This is 00:19:56.629-->00:20:01.667 simple to implement, very fast to implement. Sometimes to impossible to execute uh because 00:20:01.667-->00:20:07.206 you have multiple multiple options and the code coverage is very poor. You don't cover all 00:20:07.206-->00:20:12.578 of the different options in the programmer's code. On the other hand, there is the smart fuzzing 00:20:12.578-->00:20:18.784 or white box fuzzing and this uh technique you understand the expected inputs. You understand 00:20:18.784-->00:20:24.156 each parameter that is being sent to the interface in this example. The named pipes and you 00:20:24.156-->00:20:29.161 modify slightly modify and test uh using uh in in the edges of these uh um the valid values to 00:20:32.798-->00:20:39.205 check for uh bugs and errors. Uh so this smart data generation and uh if you have for example 00:20:39.205-->00:20:44.944 five and you have a checksum field so in smart fuzzing you need to calculate it and of 00:20:44.944-->00:20:49.949 course it is harder to implement. Uh in ComSec we don't have a lot of resources like 00:20:49.949-->00:20:54.320 different companies that presented before uh before me, so uh we weren't doing a lot of 00:20:54.320-->00:20:59.458 smart fuzzing. Mostly focused on dumb fuzzing, but still we found very very interesting 00:20:59.458-->00:21:03.929 vulnerabilities and the reason that I show you this presentation is I want others to 00:21:03.929-->00:21:08.934 move forward and uh use smart fuzzing as well to find new use these vulnerabilities. So we 00:21:12.338-->00:21:18.878 also found uh like this nice little script that is called advance pipe fuzzer. You can 00:21:18.878-->00:21:25.684 download it from this URL. Uh and um it was written many years ago but uh as I told you not 00:21:25.684-->00:21:31.190 many people know that uh named pipes are ac- can be accessed remotely so it was a hard coded 00:21:31.190-->00:21:35.427 for local named pipes only. So we slightly modified it and improved it a little bit and we 00:21:35.427-->00:21:39.331 used it uh in our research in order to find the vulnerabilities that I'm going 00:21:39.331-->00:21:44.336 to show you in our live demo. So lets see uh some examples of e- uh exploitation and impacts. So 00:21:51.777-->00:21:57.249 many pieces of uh software work with hidden or undocumented APIs. This can either be a web 00:21:57.249-->00:22:02.655 server or a windows application server that a listens to a named pipe which is totally 00:22:02.655-->00:22:08.561 undocumented. Uh the forgotten nature of named pipes leaves uncharted territory of 00:22:08.561-->00:22:13.132 socket-like interfaces that contains vulnerabilities. Remote in out of service, buffer 00:22:13.132-->00:22:17.736 overflows, remote code execution and any kind of vulnerabilities that you can think of. Named 00:22:17.736-->00:22:23.309 pipes fall in between application penetration tests and infrastructure penetration 00:22:23.309-->00:22:28.380 test. If you are an application penetration tester you probably usually uh just uh use the 00:22:28.380-->00:22:35.120 normal ports which is obviously HTTP and uh many uh uh every once in a while you use other 00:22:35.120-->00:22:41.860 variance as well but you never look at RPC or SMB in the first place. If you see are eh RPC or 00:22:41.860-->00:22:46.866 SMB you just keep it. And most time most of the times you you barely look at it. Or even don't 00:22:49.134-->00:22:54.440 know where it is, so uh uh application penetration test doesn't look at it. Uh don't 00:22:54.440-->00:23:00.212 look at it and if you are in infrastructure penetration test, whenever you see an RPC or SMB 00:23:00.212-->00:23:06.785 port, uh which is open, you try to brute force it. You try to brute force credentials and and 00:23:06.785-->00:23:12.558 use your um use a new password, mean use a new password and you try to uh uh get valid 00:23:12.558-->00:23:16.829 credentials in order to hack into the system, but you never look at the named pipes that 00:23:16.829-->00:23:21.834 listens behind these open ports. If you are an EDR expert, end point detect and response, uh 00:23:25.604-->00:23:31.277 multiple products to try to defend your uh your endpoint a user station, uh you probably 00:23:31.277-->00:23:36.282 don't sp- take special notice to remote connections. You know what named pipes are, you know 00:23:36.282-->00:23:41.487 that you can use it in order to hack into stuff and to elevate privileges but you don't think a 00:23:41.487-->00:23:47.159 lot about remote uh remote nature uh that is possible. Remote connection of the named 00:23:47.159-->00:23:52.164 pipes. So if you're software if your windows installed software reads data from named pipes 00:23:54.733-->00:23:59.638 without validation, its like any appl- vulnerable application, you can have multiple 00:23:59.638-->00:24:05.177 vulnerabilities including buffer overflow that can be can lead to denial of service or even in 00:24:05.177-->00:24:10.182 some cases, remote code execution. So if named pipe ACL access control list allow remote 00:24:14.586-->00:24:20.993 access, then remote denial of service or remote code execution can be triggered. Research of 00:24:20.993-->00:24:27.499 cause behind the crush will allow the attacker to facilitate it as zero day vulnerability. If 00:24:27.499-->00:24:32.504 you find um um vulnerability in one of windows named pipe interfaces that can be connected 00:24:35.574-->00:24:42.247 remotely and there are server such interfaces, this can be use in order to spread malewares, 00:24:42.247-->00:24:47.252 like wanna cry or notpetya. Imagine the new notpetya two. Or something similar that can 00:24:49.588-->00:24:54.593 utilize named pipes vulnerabilities. And of course remote denial service is game 00:25:01.133-->00:25:06.138 over. So lets see a case study of some interesting vulnerabilities that we se- uh 00:25:09.308-->00:25:14.313 we saw in three different windows application. Viber, qBittorrent and SugarSync. You 00:25:19.718-->00:25:24.456 probably all know Viber, but just in case you just landed from Mars or from the moon, this 00:25:24.456-->00:25:30.229 is a cellular and endpoint social communication uh application uh the most common 00:25:30.229-->00:25:35.834 one is installed on your mobile device, but there is another version that you can install on 00:25:35.834-->00:25:41.240 your windows operating system. It allows you to uh uh to perform free calls texts, 00:25:41.240-->00:25:46.945 picture uh this is a comp- the major competitor of WhatsApp. And it had eight eight hundred 00:25:46.945-->00:25:53.786 million users worldwide. qBittorrent, this is uh uh torrent client, probably most of 00:25:53.786-->00:25:58.791 you know what torrent is. This is a cross platform client for a bit torrent protocol. Free and 00:26:02.194-->00:26:07.666 open-source written in C plus plus. And SugarSync, the last application that I'm going to 00:26:07.666-->00:26:13.639 show you the demo for, this is a cloud service that enables active synchronization of files 00:26:13.639-->00:26:18.777 across computers and other devices. Similar to dropbox. Using uh for file backup, 00:26:18.777-->00:26:23.248 access, synching, sharing, supports variety of operating system including windows. And 00:26:23.248-->00:26:28.253 this is what I found interesting. And the three applications has one common 00:26:31.423-->00:26:36.428 feature, they all use the va- uh the widely used QT framework. Uh as part of their application. 00:26:39.198-->00:26:43.402 This is a cross platform application development framework for desktop. Embedded 00:26:43.402-->00:26:50.008 mobile. Uh it also supports you a windows and in the windows implementation of QT framework 00:26:50.008-->00:26:57.015 there were a vulnerability in the uh uh feature functionality that is called qtsingleapp. Uh 00:26:57.015-->00:27:01.019 this is responsible for writing temporary file probably to make sure that your application runs 00:27:01.019-->00:27:06.024 only once and you don't open multiple instances of the same application. So by fuzzing named 00:27:08.260-->00:27:13.765 pipes, we perform just a dumb fuzzing on this. In fuzz we found uh remote denial of 00:27:13.765-->00:27:19.571 service or a we could remotely crash the programs that I just show you and in Qbitorrent, we 00:27:19.571-->00:27:25.511 also uh a we were also able to a perform a remote command injection which I'm going to 00:27:25.511-->00:27:30.516 show you. So I'm now silently pray to the demo Gods if you know the pray just join me. I 00:27:34.419-->00:27:39.424 encourage you to. So this is the virtual machine. I'm going to do the demo with. This is the IP 00:27:50.669-->00:27:55.674 address and first I'm going to activate Viber. Oh wait. Just a second. Before I activate Viber 00:27:58.844-->00:28:05.350 Viber, let me just show you the different pipes. So I activate pipe list which is the sys 00:28:05.350-->00:28:11.290 internal tool for enumerating main pipes and you can see different windows named pipes 00:28:11.290-->00:28:16.295 init shutdown that we saw earlier, uh lsass, ntsvcs, probably scv host uh and other 00:28:19.731-->00:28:24.736 services. And once I start Viber and execute it once again you would see that only I have this 00:28:30.242-->00:28:35.247 named pipe which contains Fiber in it so obviously this is qtsingle app, Viber. And now I'm 00:28:38.183-->00:28:43.188 going to exploit it. So let's get back to my computer. And now this is IO Ninja. I'm going to 00:28:46.825-->00:28:51.830 open a file string that allows me to remotely connect to a named pipe. Just put the right 00:28:57.002-->00:29:01.940 IP in here. What was it again? Thirty-one. One thirty-two. Pipe slash pipe name. Oh just a 00:29:15.020-->00:29:20.025 second. Some problems. Uh you need to be a um a um domain user in this example, so I need to 00:29:25.697-->00:29:30.702 put a valid set of credentials. To have access to any named pipe in this example. So I'll just 00:29:36.241-->00:29:41.246 put username and password. Ok, now I'm connected to Viber's named pipe remotely and if I put 00:29:50.789-->00:29:57.496 just a single character this is all what is needed for this vulnerability. If I hit the send 00:29:57.496-->00:30:02.501 button, you would see that now Viber is no longer responding. [applause] And this is the case 00:30:19.751-->00:30:25.657 with SugarSync as well, but this time I'm going to perform for uh dumb fuzzing using the script I 00:30:25.657-->00:30:30.662 just showed you. So its starting. And you can see that here I have a very similar name. 00:30:36.568-->00:30:43.041 Named pipe, which is called qtsingleapp SugarSync or Sugar S and I'm going to copy it. And uh 00:30:43.041-->00:30:49.114 la- uh this might look like random characters but this is in fact a fixed values, so if you 00:30:49.114-->00:30:54.119 have Viber or you have SugarSync you know that these named pipes uh are fixed. So now I'm going 00:31:02.094-->00:31:07.099 to activate the fuzzer we're using. Ok. You can see that just after two requests this is all 00:31:19.144-->00:31:24.149 it needed. And SugarSync is also dead. And the last example I'm going to show you. This is the 00:31:27.686-->00:31:32.691 coolest example we found. This is qBittorent. So I'll just copy it and paste the named pipe's 00:31:40.198-->00:31:45.203 name. But this time I won't just send a single character. We witnessed a very interesting 00:31:53.145-->00:31:59.918 behavior in this named pipe. For some reason they actually use values from this named pipe in 00:31:59.918-->00:32:05.757 order to perform commands. So you can see that I sent two A characters with a space 00:32:05.757-->00:32:10.762 afterward and I sent Def Con twenty-five and if I send it, we get this error, torrent file Def 00:32:15.000-->00:32:20.005 Con twenty-five does not exist. And now I prepared this rickroll torrent link. And I just replace 00:32:29.381-->00:32:34.386 Def Con twenty-five with the rickroll link. Let me just discon- reconnect to it. And 00:32:39.658-->00:32:44.663 now, qBittorent is never going to give you up. [laughter] [applause] Thank you. So lets 00:32:48.967-->00:32:53.972 talk about the mitigation and the defense for the attack I just showed you. For the 00:32:59.978-->00:33:05.483 developers point of view, if you are a developer you should know the risk if you're using named 00:33:05.483-->00:33:11.256 pipes in your windows application. You should create named pipes with access control 00:33:11.256-->00:33:17.896 list uh for specific users. You should al always follow the least privilege approach. Don't 00:33:17.896-->00:33:23.735 give any redundant permissions that are not needed in order for your application to act- to 00:33:23.735-->00:33:30.041 activate correctly. Uh so uh I just give minimal permissions, uh the minimum number of users 00:33:30.041-->00:33:35.881 if it is not uh remote it if it uh, the named pipe should not be remotely accessed just pluck it 00:33:35.881-->00:33:41.152 all together uh and make it local only. This is al- also an option. And if you have uh the 00:33:41.152-->00:33:46.157 possibility, just limit the maximum number of instances uh for your named pipe. For users 00:33:50.095-->00:33:55.100 or third party software clients. Know the risk. Just block all unnecessary SMB and RPC 00:33:57.102-->00:34:03.008 services. One hundred and thirty-five and four four five, obviously. Uh especially over uh 00:34:03.008-->00:34:09.481 the internet. If you have RPC and SMB open to the internet you have big problems. Unrelated to 00:34:09.481-->00:34:16.421 named pipes. So just block it all together. Um segment your networks so at least if one uh 00:34:16.421-->00:34:20.792 computer is affected, it won't uh be able to spread to other computers as well or or if you 00:34:20.792-->00:34:24.930 have uh an attacker in one section of your network, he won't be able to exploit this 00:34:24.930-->00:34:29.401 vulnerabilities in other sections as well. And always install latest software security 00:34:29.401-->00:34:35.707 patches. In just in recent ja- the days it was found that in uh malware bytes, the famous 00:34:35.707-->00:34:41.046 anti-software, there were uh uh similar vulnerability to the one I just show you that allowed you 00:34:41.046-->00:34:47.886 to inject commands uh as uh as system user. So uh they fixed it so you need to install the 00:34:47.886-->00:34:53.858 latest version. Uh and the my favorite point of view which is the hackers point of view. Just 00:34:53.858-->00:34:58.863 know the opportunity and hack. Uh you should uh uh just uh use the technique that I showed you 00:35:01.099-->00:35:07.739 uh and in order to search for remote code execution and remote denial service uh whenever you 00:35:07.739-->00:35:13.845 see open SMB and RPC ports and uh just have fun. You can use it and utilize it in order to find 00:35:13.845-->00:35:20.552 your vulnerabilities that are completely uncharted. Uh so a some closing remarks, windows 00:35:20.552-->00:35:24.990 named pipes are forgotten, remotely accessible, socket-like interface. You don't need to put 00:35:24.990-->00:35:29.995 your uh socket number, you need to put in uh named pipe name. Uh this is a whole newly 00:35:29.995-->00:35:34.132 rediscovered potentially world of local and remote vulnerabilities inc- increased 00:35:34.132-->00:35:39.070 attack surface and don't ignore it because it can lead to significant uh significant 00:35:39.070-->00:35:44.075 vulnerabilities. If you liked uh the presentation, uh I encourage you to contact us in in ComSec 00:35:47.679-->00:35:52.083 uh we are a small consulting company, we are not as big as uh the companies that were 00:35:52.083-->00:35:58.690 presenting, so uh in order to support our work, uh and to work with professionals uh I wi- I 00:35:58.690-->00:36:03.628 encourage you contact us uh I have my email un in the end. We are small company so we pretty 00:36:05.663-->00:36:11.770 uh uh we have the speed and agility uh and multiple uh services um that includes 00:36:11.770-->00:36:18.343 penetration test of all kind, uh security development life cycle uh architecture design um uh GRC 00:36:18.343-->00:36:23.348 services is uh twenty-seven oh oh one and PCI DSS and also red teaming uh DL simulation and uh 00:36:25.717-->00:36:31.790 offensive security uh services of all kind. So if you have any question uh or you want to 00:36:31.790-->00:36:37.662 contact me following my presentation or of course if you want to um to contact me 00:36:37.662-->00:36:44.069 regarding uh working with ComSec uh you have my twitter and my LinkedIn and e-mail. Uh and I 00:36:44.069-->00:36:50.708 want to thank uh everyone that participated in this research uh and uh also I want to thank 00:36:50.708-->00:36:57.048 Viber who are the only one to take this vulnerability. We tried to op- to contact other uh 00:36:57.048-->00:37:01.820 application owners as well, but we couldn't. Uh so we want to thank Viber as well and uh 00:37:01.820-->00:37:06.357 Audie, happy birthday in Masalto. And uh thank you. [applause]