start	end	text
5350	9510	Okay, don't ruckus again, take one million.
11210	14610	Hi everyone, and thank you for watching my talk
15110	17550	and thanks DEF CON for inviting me
17550	20290	and not giving up on this year con.
20510	22690	This is the first time I speak on DEF CON
22690	26310	and I could really use a welcome round shot,
26310	28230	but since I'm not in Vegas,
28230	31550	well, I think I'm gonna save it for another time.
33670	36990	This talk will present my recent research
36990	39510	on Ruckus Wireless.
39510	44610	Ruckus is a wireless solution company owned by Comscope.
44610	46550	I've come to realize that Ruckus
46550	49230	is pretty popular in the States.
49230	51290	They even partnered with Black Hat
51290	54210	for conference Wi-Fi solution.
54410	58330	Actually, this is how I first noticed them.
58330	61510	In the last year, I've been doing vulnerability research
61510	63990	on Ruckus access points,
63990	67470	and so far I managed to find several critical vulnerabilities
68070	69990	in many of these devices.
71070	73770	My previous research was introduced
73770	76430	in the recent CCC convention,
76430	79850	back when traveling places was a real thing.
81130	82330	But before I begin,
82330	85970	I would like to go over the obligatory who am I part.
85970	87670	So my name is Galt Swar.
88010	91210	I'm a research team leader at Aleph Research
91210	93770	by HCL AppScan.
94130	96830	I'm recording this talk from our lovely office
96830	99410	in Herzliya, Israel.
99510	103750	And I've been doing reversing for more than a decade.
103750	108030	I try to focus on offensive embedded devices research.
109250	113350	All right, I would like to begin with a quick recap.
113350	114830	In my previous research,
114830	117670	I demonstrated three ways to run code
117670	122090	on Ruckus unleashed and zone director devices.
122090	125920	All vulnerability were found on the device web interface.
127010	134270	My first RCE was credential leakage with SSH jailbreak.
134390	139750	My second RCE was unauthenticated stack buffer overflow.
140710	145250	And the last RCE was command injection vulnerability,
145250	147310	which was reachable without authentication
147310	149590	by writing a new page.
153230	157090	In this talk, same as in my previous one,
157090	162090	I will be using Ruckus R510 unleashed.
162110	164250	Ruckus has an unleashed version
164250	167190	for every access point they provide.
167190	172450	Unleashed access points don't rely on Wi-Fi controllers.
173030	177270	Well, all access point in the list you can see here
177270	180030	share the same vulnerable code base.
180230	182550	And I also noticed that some vulnerabilities
182550	185950	works on zone director product line,
185950	188530	which is the Wi-Fi controllers.
190550	192310	Okay, so what's new?
192310	196870	Well, this research began right after I got Ruckus patch
196870	198930	for my first research.
199230	204230	I noticed that they did not fix my vulnerability correctly.
204230	207270	So I decided to try and re-enable it.
207930	211850	Besides that, my first research was 100%
211850	214530	based on device emulation.
214670	216950	Now that I bought an actual device,
216950	219190	I can try to see if I missed something
220110	222090	that I couldn't emulate.
223250	225990	Well, but before I begin with the new vulnerabilities,
225990	229030	I would like to talk about a new Jidra script
229030	231910	that I used for this research.
234630	239130	My previous research and this one was done relatively fast.
239130	240970	Thanks to a Jidra script,
240970	245670	I wrote that fetches function name from log strings
245670	248430	Ruckus has left in their binaries.
248430	253010	Here you can see some of them from one of the binaries.
254990	257850	This script helped me rename function
257850	262830	by parsing these log lines that contained the function name.
262830	264690	For more information about the script
264690	267430	and its generic version,
267430	271950	please check my previous talk or our GitHub.
272390	274810	All in all, this script was super useful
274810	280490	for binary compiled with Ruckus code,
280490	283520	but not all binaries were like that.
286160	288870	It's a common thing for embedded devices vendor
288870	293170	to use open source project in their devices.
293350	296000	Ruckus web server is a good example for that.
297610	301110	Ruckus added new functionality by adding code
301110	305150	to a popular web server called Embed This.
306250	309670	Since Embed This sources are public,
309670	313930	I didn't really need to reverse the entire web server binary.
313930	317570	It was easier for me just to review the source code.
318750	321850	But what about the parts that Ruckus added?
321850	325530	I would like to be able to mark these parts in JITRA,
325530	327970	so I'll know I'll have to reverse them.
328530	331830	So for this, I wrote an additional JITRA script.
334090	337810	My new script tries to extract as many function names
337810	341170	as it can from the Embed This sources.
341600	345270	I use different methods to extract this information,
345270	350030	things like string matching and function call trace.
350510	352270	But the thing that helped me the most
352270	357830	were debugging functions that contain the exact C filename
357830	362150	and line number in the Embed This sources.
363080	366470	Here we can see that for this unnamed function
366470	369550	from the web server binary,
369550	375110	we get that this function appears in server.c file
375110	378830	around the line number 138.
380770	385050	So if we go to this line in the Embed This sources,
385050	387590	we'll be able to extract many function names
387590	389150	from the sources.
389990	394470	This is the function in JITRA after conversion.
397540	401120	These are all function name that I was able to extract
401120	404040	from the source code to JITRA.
406380	411240	Okay, so let's take this function coin graph, for example.
411360	416440	This function is called macreateWebServer,
416440	420140	and it's being called from the main.
420300	423180	And it also calls other functions.
424100	426800	Well, on the right-hand side,
426800	429340	we can see that all of the function names
429340	432320	I was able to fetch from the sources
432320	435440	by using the script I just introduced.
437320	439620	On the bottom left-hand side,
439620	442740	we can see the function names I was able to fetch
442740	446340	by using the script from my previous research,
446340	450080	the one that uses the log strings.
450980	454700	And as you can see, there are still unnamed function left,
454700	458240	but still the majority of functions are now named.
458580	460520	So this is an excellent example
460520	464220	of how these two scripts help me retrieve
464220	467400	plenty of information and save me so much time
467400	470040	and effort on reversing.
473670	476850	I'm also in the progress of writing a generic version
476850	480590	for this script that won't rely
480590	483150	on specific debug information.
483390	485070	I will share all of my script
485070	487890	in our Aleph Research GitHub account,
487890	491450	so feel free to check it out.
491450	492690	And while you're there,
492690	497050	you can also check other tools that we got there.
498690	500270	All right, cool.
500270	502630	So now we're ready for some exploits.
502630	504670	This is my first RCE.
504670	509130	In this attack, I found another stack overflow
510330	515150	that was reachable with unauthenticated web request.
517730	520470	And I would like to start with a demo.
520470	523730	Well, this is clearly not a live demo,
523730	528990	but I will still try to do it in a live demo style.
529190	534410	So yeah, let's see how it goes.
535490	542490	Okay, so for that, I need my demo screen
545190	547150	and my listener screen.
549070	551950	Okay, so this is the terminal
551950	559090	that I'm gonna listen to port 1337.
559190	564090	And my exploit will create reverse shell to this port.
565090	569010	Let's just start listening.
569870	575050	And now, okay.
575870	584290	And now let's have a look on my stack overflow.
584450	586810	So this is my overflow.
586810	590850	Wait, let me open it in a different way.
590850	594070	Okay, so this is my overflow, as you can see here.
594770	603210	And I am creating this reverse shell by using Netcat.
603530	608050	And let's just go ahead and send this.
608050	615070	So I will be posting this file to this address.
617410	622170	And okay, hopefully everything will work.
622170	626570	Connection refused, it's a good indication.
626570	629320	Let's see what's going on with my listener.
630190	633840	Okay, so connection received, looking good.
634700	639250	As you can see, I managed to run ls
639780	645460	and my user is admin.
645830	652150	And this user is part of the root group.
652850	654670	Yeah, so this is it.
654670	658890	This is my demo.
666200	669360	Okay, before I get into the vulnerability,
669360	673560	I would like to do a quick recap on my previous talk.
673760	677340	This slide and the next one were actually taken
677340	680480	from my previous talk, but I'll go over them
680480	682660	just to create the right context.
683290	688440	There are three important binaries in the web interface.
688440	692200	The first one is slash bin slash webs.
692200	695860	This is the actual embeddice web server.
695860	700140	It handles HTTP requests and executes handlers
700140	702090	according to its configuration.
702680	706020	It then sends commands through a Unix domain socket
706020	708150	to emfd.
708740	712100	Slash bin slash emfd is an executable
712100	715060	that contains the web interface logic.
715060	720280	It maps function from web pages to their own function,
720280	721940	to its own function.
722150	725120	It then implements web interface commands
725120	729180	such as backup, network configuration,
729800	733180	retrieve system information and much more.
733180	735980	And the last one is libemf.
735980	741580	This library is used by emfd for web authentication,
741580	745520	input validation and some code execution.
746940	750780	And now let's look at this in a diagram.
751060	755300	So webs listen to HTTP slash HTTPS.
755300	759280	If it receives a JSA page request,
759740	766020	it uses EGS handler to pass a function name to emfd.
766360	770700	Emfd then checks if the function name is mapped.
770700	773200	So it calls the right function pointer.
776100	780400	Eventually emfd runs some kind of shell commands,
780400	785500	for example, ifconfig, IP tables, routes, et cetera.
788820	792500	Since the web server contains both Embedish code
792500	795180	and Ruckus code,
795180	802080	I decided to mark Ruckus function with an RKS prefix.
802160	805120	Ruckus has added a new function
805120	810300	that registers new ESP functions.
810320	813520	ESP again is the handler that runs
813520	817420	if the web server receive a JSP request.
818780	823020	So here we can see that 12 functions are being registered.
823340	826920	Each function registration needs a function name string
826920	828900	and a function pointer.
828900	832080	Now let's understand how we can reach this function
832500	834440	with an HTTP request.
837020	839080	Okay, so for example,
839080	841580	when sending an HTTP request to
841580	845960	slash admin slash webpage slash Wi-Fi network
845960	850860	slash wlan sysconfirm.jsp.
850860	854260	Please remember this page because it's a very long one.
855680	859740	The web server invokes an EGS handler.
860140	864780	On this page, we can see that EGS script has a special tag
865760	867940	right at the beginning, right?
867940	871840	And EGS function are being called from it.
873920	876080	Webs maps every string it received
876080	879180	to a function pointer and then runs it.
879880	882920	So here we can see that a function called
882920	887040	escape JSTR is being called.
888500	894700	And another wonderful function named S is also being called.
894780	896280	Yeah, S, yeah.
896440	898540	A great, a really great example
898540	901000	of a shitty naming convention.
901940	904680	But the naming convention is not the only lousy thing
904680	906420	about this function.
906780	910600	When I reviewed this edit functions,
910600	916480	I noticed that S, STR, escape JS and get cookie value
916940	920100	are all using unsafe string copy.
921300	923800	That means if I can find a webpage
923800	928240	that passes user inputs to one of these function,
928240	932080	I will be able to smash the web server stuck.
934820	938740	All right, so to search for an input
938740	941600	that leads to one of these functions,
941600	945160	I decided to use the good old grab command.
945160	948920	So I would like to search if there are any calls
948920	953100	to one of these function with a non-static value.
953460	957280	It also should not be a session related values
957280	960820	because I might not be able to manipulate them.
960820	963260	Let's say session cookie or something like that
963260	967040	that is being generated behind the scene.
968740	972680	So here I used a regex that made sure S
972680	978160	don't get any value inside a double or single quote.
978480	982020	I managed to find two JSP pages.
982020	984680	One was an error page,
984680	988540	which did not receive any user inputs, the second one.
988540	994180	And the first one was that page with a very long name
994180	996300	that I don't really want to say it again.
996300	999780	So I just have a look on that page.
1001100	1007580	Okay, so we saw that S function receive
1007860	1011140	a non-static value called content.
1012020	1015620	And luckily the content variable is set directly
1015620	1019960	by a user parameter called content key.
1022400	1025160	So I just needed to send the right request
1025160	1031840	to wlan sysconfirm.jsp and that's it, I smashed the stack.
1033260	1040260	As for exploitation, R510 uses both NX and ASLR.
1041180	1045280	To overcome NX, I decided to use rope gadget.
1045280	1047500	Actually, I use the same gadgets
1048580	1052240	as for my previous stack overflow.
1053300	1056940	So these are two gadgets that run system
1058230	1060560	with a pointer to my payload.
1060620	1063920	And in this case, I'm using NC
1063920	1066800	to create a reverse shell to my machine.
1067060	1072740	As for ASLR, same thing as my previous stack overflow,
1072740	1074880	I can just brute force my way
1074880	1078180	and overcome its nine bit of randomness.
1079260	1080460	All right.
1083780	1087380	So before I continue with my second attack,
1087380	1089480	I would like to share other vulnerabilities
1089480	1095920	I found in this research that I think worth mentioning.
1096960	1100900	So I also found a cross-site scripting,
1101060	1103600	a denial of service and information leakage
1104270	1108060	that may lead to another jailbreak.
1108200	1112000	All of them were found in either the web server
1112000	1114300	or EMFD.
1115840	1119000	So let's talk about the XSS.
1119060	1123060	I discovered that, I discovered this cross-site scripting
1123060	1124560	on my first research
1124980	1127780	and actually it was pretty straightforward.
1128560	1133460	So every Ajax request to slash admin slash
1133460	1138960	underscore WLA underscore CMD stats dot JSP
1139800	1144240	has to contain an updater attribute.
1145060	1148880	This attribute is simply reflected without any sanitation,
1150460	1152660	as any validation, sorry.
1153240	1157300	So all I had to do is to send this payload
1157300	1161720	and it just runs the, you know, the alert message.
1164280	1167980	XSS in embedded devices is not that big of a deal,
1167980	1170380	but I decided to report it anyway.
1171500	1175880	All right, so let's go over the denial of service.
1176240	1180280	So while I was researching, I came across this request
1180720	1183400	that simply crashed the server.
1183540	1186560	I must say I did not invest too much time
1186560	1188480	understanding this bug.
1188900	1192840	This is a web server related bug, of course,
1192840	1196800	that caused either by an old version of embeddice
1196800	1200740	or in the code Ruckus has added.
1204260	1207440	All right, and now for the information leakage.
1207440	1211320	So Ruckus are considering the device serial number
1211320	1214140	as sensitive information.
1214140	1216920	In my previous research, I came across functions
1216920	1222500	in Ruckus CLI that rely on the device serial number
1222720	1226760	to get to a busy box shell, to jailbreak.
1226760	1231180	In this research, I noticed that upnp.jsp page
1231180	1234660	is reachable without any authentication.
1235820	1238740	And this page gives away many useful information
1238740	1242100	on the device that can be used for fingerprinting,
1242100	1243180	let's say.
1243740	1246980	But the best part is that I can get the device
1246980	1250660	serial number and probably jailbreak.
1252580	1258280	Okay, so now is the time for my second RCE.
1258340	1261800	In this attack, I found a way to reuse
1261800	1263300	the command injection vulnerability
1263880	1265860	from my previous research.
1265860	1269420	I then had to find a new way to bypass authentication
1269840	1272820	by overriding admin credentials.
1275860	1279060	So let's first understand how the command injection
1279060	1282140	used to work in my previous research.
1282420	1286860	So embed this, I'm sorry, EMFD execute code
1286860	1288700	in a really messy way.
1288700	1293640	EMFD sometimes uses libemf, other time calls
1293640	1298040	the shell script sys underscore wrapper.sh
1298700	1302680	and sometimes just run the command itself using libc.
1303640	1307120	These are all the different function that EMFD
1307120	1309660	uses to execute shell commands.
1311340	1316220	As you can see, there are many libc system function code.
1316220	1320380	So I had to find a page that uses this system function
1320800	1322440	without validation.
1324580	1328840	And I found four functions that call system
1328840	1331780	and were vulnerable to command injection.
1332060	1335400	And I will be showing the injection on the last one,
1335400	1339160	which is CMD import AVP port.
1340920	1343600	To reach the vulnerable function,
1343600	1347680	I had to send an Ajax request to slash admin
1347680	1351680	slash cmdstat.jsp.
1353700	1362060	This request use an EMFD command called import AVP port.
1362900	1366120	And when EMFD received this request,
1366120	1371420	it uses a function called CMD import AVP port.
1371420	1375200	And this function just uses libc system function
1375200	1377240	just like that, unsafely.
1378620	1381740	Here you can see the function decompiled code
1381740	1385000	as it used to be in my previous research.
1385360	1387620	So for my previous research,
1388360	1391580	all I had to do is to pass a command injection
1391580	1394380	in the upload file attribute.
1394380	1398600	As you can see, it just executed without any validation.
1400560	1403600	But the problem was that I had to be authenticated
1403960	1405820	to reach this function.
1405820	1408100	I had to use a valid cookie.
1412290	1415490	Okay, so to fix this,
1415490	1417950	Ruckus decided to use a function called
1418370	1420990	is validate input string.
1421190	1422710	That's supposed to validate
1422710	1424890	there are no injection characters
1424890	1427860	in the upload file attributes.
1429370	1435030	This is an external util function found in lib EMF.
1435030	1438840	And it's being used widely for input validation.
1444060	1447890	So let's have a look at this validation function.
1450010	1454840	Here are all the forbidden characters for a given input.
1454840	1458780	Well, at first, this validation seems pretty solid.
1458800	1460780	However, some very important characters
1460780	1463520	are missing from that list.
1465280	1468760	So something I like to do when reviewing a validator
1468760	1472380	is to create a set of all the printable
1472380	1476800	non-alphanumeric characters that can pass this validator.
1477400	1480840	And well, this is the moment I would ask you guys
1480840	1487300	if you think of a payload using this set of characters.
1487300	1490620	But thanks to coronavirus, I can't really do this shtick.
1490620	1492240	So nevermind.
1492400	1496760	And anyway, after some trial and error,
1496760	1499600	I realize a shebang sign,
1499600	1502640	which is pound followed by exclamation mark
1502640	1504120	is a valid input.
1504120	1509900	So I can also use slash and I can also use slash.
1511020	1515980	So I can use shebang slash bin slash sh.
1516720	1519720	So this is good, but not good enough.
1519720	1524580	I can't just append this payload to a command run by system.
1525040	1528360	And well, this is because shebang should be
1528360	1530120	in a line of its own, right?
1530120	1532040	It's usually the header.
1533260	1537020	Luckily, I could also use a newline character.
1537020	1539580	Yeah, that is correct.
1539580	1541840	A newline character as a parameter input
1541840	1547160	is not being sanitized, not in the web server, nor EMF.
1547160	1548820	Amazing, right?
1549060	1553960	Well, shebang plus a newline,
1553960	1557280	it equals sweet, sweet exploit love.
1558380	1559300	Yeah.
1559300	1563180	Okay, so that was good news.
1563780	1568140	I can now replace my injection with shebang,
1568140	1572740	but there was one thing left to solve.
1573800	1577880	Space characters is also not a valid input.
1577880	1582860	So I simply replaced them with tab characters.
1583860	1587000	Let's have a look on my new payload.
1589120	1592380	You can see that for semicolon,
1593200	1598120	so I replaced semicolon with shebang plus a newline
1600180	1603700	and spaces were replaced by tab.
1605020	1606260	And that's it.
1606260	1610100	This is how I was able to reuse
1610100	1612500	my command injection vulnerability.
1612500	1615860	The last thing I had to do to complete this exploit
1616240	1618880	is bypass authentication again.
1621320	1624920	Okay, so now I would like to explain
1624920	1628980	how the admin credentials are stored in the device.
1630420	1636260	So system.xml is the device general configuration file.
1636260	1638100	It contains the admin credential
1638100	1641400	as well as other important configuration.
1642500	1646280	Here you can see that the admin element
1646280	1651740	and its password is stored in the x-password attribute.
1652340	1654000	While working on this exploit,
1654000	1656280	I noticed that Ruckus has decided
1656600	1659680	to use the most secure mechanism
1659680	1663560	for storing sensitive passwords, as you can see here.
1663560	1666520	So you might look at this x-password attribute
1666520	1672120	and think that my password is 12345BCB,
1672280	1674400	but that's not the case.
1674400	1680200	My actual password is 12345ABCD.
1680200	1682600	Yes, yes, yes.
1682600	1685360	Ruckus are obfuscating the password
1685360	1688210	by adding one to each character.
1688980	1692660	Gosh, gosh, I just don't understand
1692660	1696080	why won't they use a simple hash function.
1696080	1697280	Don't get it.
1697280	1700100	But nevermind about that.
1700980	1703480	Let's have a look at slash admin,
1703480	1710880	slash underscore WLA underscore conf dot JSP page.
1711080	1716840	We can see that this page calls for two functions in EMFD,
1717100	1722040	login without access check and AJAX conf.
1722520	1725960	Please keep in mind that we must pass the first function
1725960	1730080	to get to AJAX conf, which is the vulnerable function.
1731960	1735080	So without login access check,
1735080	1738380	expects an AJAX request XML
1738880	1746560	that contains either set conf action or do conf action.
1746780	1752620	The do, sorry, either set conf or do CMD action.
1752620	1756380	The do CMD action in this case was very limited
1756920	1761440	and I decided to focus only on set conf.
1763620	1767940	So set conf action calls an EMFD function
1767940	1773100	called check research credentials configuration parameter.
1774660	1779320	This function expects an admin XML element
1779320	1781640	with the following attributes.
1783560	1788280	And please note that this function only validate
1788590	1792380	the number of elements, eight in this case,
1792380	1796660	and it only validate that the attributes names
1796660	1799520	matches the one we see here.
1799520	1801620	That means it won't check the value
1801620	1805780	only that a certain request contains eight elements
1805780	1808460	that matches with this name.
1808840	1815480	And it doesn't check for any permissions whatsoever.
1816720	1820300	Okay, so here we can see a valid AJAX request
1820300	1822820	with an admin element.
1824200	1826800	So this request has all the right attributes
1826800	1829900	as you can see eight and then the right,
1829900	1834240	and it can reach the vulnerable AJAX conf function.
1835240	1839320	Okay, so let's move to AJAX conf.
1839790	1844120	This is a very big function that does all sorts of things.
1844120	1849080	One of them is to use adapter set conf
1849310	1852050	to update different configuration file.
1853410	1855280	In particular, it can update
1855280	1859780	the main system dot XML configuration.
1859780	1865120	Okay, as we saw, without login access,
1865120	1869440	forces me to use a specific XML element.
1870020	1875440	But thankfully, this is the admin credentials XML element.
1875440	1879760	So now let's understand how adapter set conf works
1879760	1884360	and may be manipulated to write these credentials.
1885360	1892080	So this is how adapter set conf function looks like.
1892680	1896820	It receives the request component attributes
1897400	1902060	and the AJAX request itself.
1903100	1909200	I realized that if the component equals to system,
1909200	1913140	then it can only update a specific XML element,
1913140	1915860	which is not the admin element.
1915860	1919320	So I can just override the admin credentials
1919320	1920980	with this request.
1923920	1928620	However, if the component attribute is not equal to system,
1928620	1933360	it uses a function called repo get curr child.
1934340	1937540	And this function gets a component name
1937540	1943120	and looks for an XML configuration file with that name.
1944140	1948020	So that means I can access any XML file
1948020	1950540	in the air spider directory.
1950540	1954540	Well, all of them except for the system XML
1954540	1959960	because adapter set conf make sure it's excluded.
1960260	1962380	But the credentials I want to override
1962380	1967460	are in the system dot XML, which sucks, right?
1968520	1972840	So this is where slash come to our rescue.
1973300	1976380	I noticed that if I add a slash
1976580	1980020	at the beginning of the component attributes,
1980020	1982900	it's no longer a system component.
1982900	1987120	It's now a slash system component.
1987780	1991760	So now I can pass this system attribute check
1992620	1997340	and now get a repo get curr child function
1997340	2001400	will look for the file slash system dot XML,
2001400	2006280	not system dot XML, which is perfectly fine in POSIX
2006280	2009780	since we can add as many slashes as we want.
2013390	2016330	Okay, and that's about it.
2016330	2020010	Adapter set conf has replaced the admin element
2020010	2024010	in system dot XML, which means I was able
2024010	2026790	to override the admin credentials.
2026790	2031390	Okay, now I just need to chain
2031390	2033810	these two vulnerabilities together.
2034890	2038390	So first the override, here I'm overriding
2038870	2042330	the admin credentials with password 1234.
2045450	2050810	Then run the command injection to pop a shell on the device.
2052150	2055910	Well, since I consider myself a polite person,
2055910	2059310	after getting a shell, I can obtain the original credentials
2059310	2065910	by grepping slash var slash run slash RPM key asterisks.
2066750	2070950	This was the file that I was able to leak
2070950	2073250	in the first research.
2073250	2076430	Fortunately, Ruckus insist on saving passwords
2076430	2078230	as plain text.
2078230	2081650	So all is left to do is to repeat the attack
2081650	2084750	with the original credentials and avoid leaving
2085090	2087010	any footprint on the device.
2087010	2089730	Cause we're not that rude, right?
2090930	2091990	Okay.
2098030	2102030	So this is the time for my final demo.
2102030	2105130	Again, I'll try to do it live-ish.
2106650	2110910	Okay, so for that I need my terminal again.
2111850	2116690	Okay, so first I would like to override the credentials.
2116690	2122090	So let me just show you the payload.
2122090	2125610	So this is the request.
2125750	2132210	And let's just, you know, change the passwords to DEF CON.
2132210	2133170	Why not?
2133170	2136050	And 28 safe mode.
2136710	2137810	Awesome.
2139770	2140810	Okay.
2140810	2142090	Yes.
2142090	2146810	And now I would like to post this XML.
2146810	2155070	So I'm just posting it to this admin wla-conf-jsp.
2156650	2157650	And this is it.
2157650	2160350	I overrode the credentials.
2160350	2163930	Now I'll have to authenticate again to log in.
2167250	2172070	So let's go with, what was it?
2172090	2176110	DEF CON 28 safe mode.
2176110	2180090	So this is just a standard login request.
2180410	2184350	And I get the CSRF token and a set cookie.
2185010	2187950	And now for my new,
2189550	2193070	oh wait, I just want to show you guys my injection.
2193070	2194850	So this is my new command injection
2195410	2200130	where I use shebang and then new line,
2200130	2201470	telnet top tab,
2201470	2207450	and I'm going to open a port in 7331 on the device.
2208030	2209630	Yes.
2210250	2211210	Okay.
2211390	2212590	So this is it.
2212590	2217350	Let me just update the credentials real quick.
2219650	2225190	This is the first one and that's the cookie.
2225870	2227470	Okay.
2229650	2230290	Okay.
2230290	2230930	Great.
2231190	2235610	So let's just run it.
2237230	2239070	Okay, that's it.
2239070	2241990	And now for the moment of truth,
2241990	2247050	I'll log in, I'll tell it to 7331.
2247230	2253950	And as you can see here, I'm the root and this is it.
2254910	2256170	Okay.
2263540	2270780	So in conclusion, today I demonstrated two pre-auth RCEs.
2270780	2275220	The first one was pre-auth stack buffer overflow.
2275220	2277320	And the second was command injection
2277320	2279700	with credentials overwrite.
2281380	2286140	I will also share my new and improved Jidra script
2286140	2288920	that really helped me with this research.
2289760	2294500	Ruckus Networks was informed about these vulnerabilities.
2294500	2298000	I requested six CVEs and they confirmed them.
2299320	2306440	So in total, these two research concluded in 17 CVEs
2306440	2310240	that resulted in five different RCEs.
2312600	2315060	And as I said in my previous talk,
2315060	2318420	if there are any Ruckus users who are watching this,
2318420	2319740	you should stop what you're doing
2319740	2324320	and check that you're running the latest firmware update.
2324320	2330260	If not, you may be a victim to some very serious stuff.
2331520	2334480	Okay, so that's it.
2334480	2338020	These two research were tons of fun.
2338160	2340380	I'm really glad that I helped Ruckus
2340380	2342940	making their equipment more secure.
2342940	2346660	I will post a second blog post with all the specific
2346660	2349940	at alephsecurity.com.
2349940	2353400	Feel free to check our blog for my previous research
2353400	2358200	and other amazing research done by our group.
2359960	2360720	That's it.
2360720	2362920	Thank you very much for your attention.
2362920	2364760	Stay safe and healthy.
2367080	2368260	Woohoo!