1
00:00:00,000 --> 00:00:05,580
This talk is about my search for a good UPnP hacking tool.

2
00:00:06,340 --> 00:00:11,340
So what we're going to go over today is just some introductions to tell you who I am.

3
00:00:12,020 --> 00:00:16,320
First I'll start talking about what is UPnP and why should you care about UPnP?

4
00:00:16,560 --> 00:00:20,120
Why was I looking for a tool to hack UPnP in the first place?

5
00:00:20,620 --> 00:00:29,680
I'll talk about some of the tools that are out there right now and what I found to be their shortcomings and why I thought that they weren't quite sufficient.

6
00:00:29,980 --> 00:00:39,360
I will show you a new, an updated tool that I put a lot of updates into and I'll talk about the features of that.

7
00:00:39,360 --> 00:00:44,000
And throughout we'll do some demos of that functionality and about UPnP in general.

8
00:00:44,580 --> 00:00:51,600
Q&A was going to be in the Discord chat, but I know Discord is down at the moment or there's some issues with it.

9
00:00:51,600 --> 00:00:58,760
So if that still happens, we'll probably just keep the Q&A here in the Twitch channel.

10
00:00:59,880 --> 00:01:01,360
All right, so who am I?

11
00:01:01,360 --> 00:01:03,620
Real name is Trevor Stavato.

12
00:01:03,620 --> 00:01:06,880
I've been in offensive security for over 10 years.

13
00:01:07,580 --> 00:01:13,160
Different positions, mostly in web app and network pen testing.

14
00:01:13,480 --> 00:01:17,880
A couple of years ago, I founded this cool little company called LabMath Security.

15
00:01:19,400 --> 00:01:28,340
Before I was in hacking, I was a software developer and I did that for a number of years and then realized all the mistakes I was making once I became a hacker.

16
00:01:29,220 --> 00:01:32,740
I try to be an active member of the security community.

17
00:01:32,780 --> 00:01:37,140
As Sam said, I help do some IoT village stuff in Canada.

18
00:01:37,140 --> 00:01:38,380
I help sometimes in the U.S.

19
00:01:38,380 --> 00:01:39,200
as well.

20
00:01:40,200 --> 00:01:42,680
I like to dabble a little bit in RFID.

21
00:01:42,680 --> 00:01:45,280
So we do an RFID village here in Canada.

22
00:01:45,280 --> 00:01:53,320
And I do some red teaming for the pros versus Joe CTF, which unfortunately didn't happen this year because of all this COVID stuff.

23
00:01:54,360 --> 00:02:01,400
Maybe one of my proudest achievements so far is the DEF CON 26 black badge win at the IoT CTF.

24
00:02:02,640 --> 00:02:06,220
All right, so let's talk about what UPnP is.

25
00:02:06,220 --> 00:02:09,320
So UPnP is Universal Plug and Play.

26
00:02:09,320 --> 00:02:22,100
And it's a protocol defined, I think back in 2008 was the original publication of this protocol, allowing for devices on network to discover and interact with each other.

27
00:02:22,100 --> 00:02:25,820
It's based around a principle called zero configuration networking.

28
00:02:26,260 --> 00:02:44,140
Really what they wanted to be able to do was to have a device that just plugged into a network, found other devices and was able to talk to and communicate with the other devices and have them configure themselves according to their needs without anybody having any actual input and hands-on keyboard configuration.

29
00:02:44,700 --> 00:02:47,140
Sounds like a great idea to me.

30
00:02:48,200 --> 00:02:55,740
So UPnP is a protocol that uses pretty standard services like HTTP, XML, and SOAP.

31
00:02:55,740 --> 00:03:01,760
And it defines a way for services to describe their functionality and interact with other devices.

32
00:03:02,220 --> 00:03:06,100
A lot of the common uses for this are for network services.

33
00:03:06,100 --> 00:03:12,840
So small office, home office routers will use this for configuring port forwarding.

34
00:03:13,480 --> 00:03:25,660
There's data sharing services for network storage, media streaming, for example, Chromecast, or some of the original versions of Chromecast use UPnP to initiate the streams.

35
00:03:25,680 --> 00:03:31,000
And it's also used commonly in smart home control, which will be one of the demos that we're doing later on today.

36
00:03:33,200 --> 00:03:43,080
So in the spec, UPnP talks about kind of six capabilities or six things that are required for proper UPnP functioning.

37
00:03:43,300 --> 00:03:45,140
The first one is addressing.

38
00:03:45,620 --> 00:03:53,340
It's not as important for the tool because we can't really talk to it unless it has a device, but the device needs a way to get an IP address.

39
00:03:53,340 --> 00:03:55,820
And this is typically done through DHCP.

40
00:03:57,160 --> 00:04:01,080
The second one, more interesting to us, is a discovery protocol.

41
00:04:01,080 --> 00:04:10,700
The devices need to be able to advertise their presence on the network, or other devices need to be able to search for other UPnP devices on the network.

42
00:04:10,700 --> 00:04:18,280
So there's a protocol called Simple Service Discovery Protocol, SSDP, that is used to do this advertisement.

43
00:04:18,280 --> 00:04:21,920
And I'll show one of those requests later and show how that works.

44
00:04:23,240 --> 00:04:28,820
Once you know what devices are on the networks, you need to know what those devices can do.

45
00:04:28,820 --> 00:04:34,400
And then there's a device description XML file that gives this detail.

46
00:04:34,400 --> 00:04:44,420
And when the devices broadcast their presence or another device searches for them, the URL to that XML file is part of the response that comes back.

47
00:04:47,030 --> 00:04:49,270
The next part is control.

48
00:04:49,270 --> 00:04:53,430
So once you know what it can do, you need to know how to control that device.

49
00:04:53,430 --> 00:05:01,370
You need to know what endpoint to send the request to, what parameters you need to include in the request.

50
00:05:01,370 --> 00:05:06,630
Once you have this information, now that's enough information to start interacting with that device.

51
00:05:07,270 --> 00:05:11,690
There are still a couple of other parts to UPnP.

52
00:05:11,690 --> 00:05:13,870
The fifth one is event notification.

53
00:05:13,870 --> 00:05:18,930
So you can subscribe to specific state variables on a device.

54
00:05:18,930 --> 00:05:22,690
And if that state variable changes, it'll send a notification to you.

55
00:05:23,030 --> 00:05:27,110
And then the last part of UPnP protocol is a presentation.

56
00:05:27,810 --> 00:05:36,730
For the topic of this talk, that's not as important, because that just gets into sort of regular web app hacking, less UPnP hacking.

57
00:05:36,730 --> 00:05:41,330
So we're going to focus on two to five with this talk.

58
00:05:41,990 --> 00:05:53,370
So I'm going to show you just a brief view of a device description and what that kind of looks like.

59
00:05:53,370 --> 00:05:58,170
So over here, I'm going to run a search.

60
00:05:58,370 --> 00:06:00,210
And you'll see the discovery message.

61
00:06:00,210 --> 00:06:03,370
And I'll make this bigger, because this might not be easy for people to see.

62
00:06:07,200 --> 00:06:12,680
So there's a discovery message that uses a custom HTTP verb called msearch.

63
00:06:12,820 --> 00:06:17,080
It posts to a broadcast address.

64
00:06:17,080 --> 00:06:20,600
And this is just a fixed... this is the same on every network.

65
00:06:21,340 --> 00:06:34,080
It's got a message saying, try SSDP discover, and the service type in this case is SSDP all, which basically says, all devices respond to me.

66
00:06:34,320 --> 00:06:44,960
And you can see the responses come back here from all the different devices, showing you here is the location of my device description.

67
00:06:45,000 --> 00:06:50,700
And it'll also give you some information about what kind of device it is.

68
00:06:51,040 --> 00:06:55,660
So you can see on my network, there are a couple devices that have a lot of different services.

69
00:06:55,660 --> 00:07:01,260
Because we said SSDP all, all the services are responding separately.

70
00:07:02,420 --> 00:07:06,660
So now I'm going to... we're going to take a look at one of these.

71
00:07:06,720 --> 00:07:11,500
And we'll show you what a device description looks like.

72
00:07:12,460 --> 00:07:17,130
And make this bigger.

73
00:07:19,070 --> 00:07:23,430
So this here, you can see my setup here on the other screen.

74
00:07:23,430 --> 00:07:30,050
I have an Asus router, I have a WeMo switch, and that is, there's a little lamp plugged into that WeMo switch.

75
00:07:30,450 --> 00:07:34,450
So the device description we're seeing here is for the Asus router.

76
00:07:34,910 --> 00:07:41,230
It shows you the model number, the version numbers, serial number, a lot of information about it.

77
00:07:41,250 --> 00:07:49,270
When we get down into this section, the service list, this is where we see the different services, the UPnP services that it supports.

78
00:07:49,310 --> 00:07:56,510
So it'll show you the URL that you need to send control requests to, the URL to send event requests to.

79
00:07:57,350 --> 00:08:12,910
And it'll also have, not in this one, but in some of them, it'll have the, oh yeah, no, here it is, the SCDP, so the service controlled description, so the service description.

80
00:08:12,910 --> 00:08:22,970
So if we copy this, and we put this on here, we'll now put a double X bar, there we go.

81
00:08:23,230 --> 00:08:31,350
Now we'll see all the actions that this service supports, action name, and all the arguments.

82
00:08:31,350 --> 00:08:36,890
So we can collapse all this, and you can see there's gonna be a bunch of actions for this service.

83
00:08:36,890 --> 00:08:41,230
And then we get into this server state table that talks about all the state variables.

84
00:08:41,290 --> 00:08:46,610
And some of these won't send events, so the send events is no, but some of these do.

85
00:08:46,890 --> 00:08:48,830
And those are the ones that we can subscribe to.

86
00:08:48,830 --> 00:08:57,030
So physical link status is a variable that we can subscribe to and get notifications when that status changes.

87
00:08:57,190 --> 00:09:05,950
So you can see how this can be used by devices to monitor what's happening in the network and be able to control it.

88
00:09:06,330 --> 00:09:14,210
So that's the overview of how the service descriptions and device descriptions work and what they look like.

89
00:09:17,720 --> 00:09:23,000
So one thing that's missing from this spec is that there's no authentication.

90
00:09:23,120 --> 00:09:28,000
Even on the control endpoints, when you're sending a control message, they are unauthenticated.

91
00:09:28,260 --> 00:09:34,280
It's a very old protocol, as I said, 2008, so they probably didn't think about that part of it.

92
00:09:34,440 --> 00:09:43,540
There have been some updates, some other optional pieces that you can tack on to add some authentication and some security to it.

93
00:09:43,540 --> 00:09:47,880
But those really, from my experience, I haven't seen any devices that use those.

94
00:09:47,880 --> 00:09:51,600
So most of this is just fully done unauthenticated.

95
00:09:53,600 --> 00:09:56,060
So why does this relate to IoT?

96
00:09:56,060 --> 00:09:57,620
Why is it in IoT Village?

97
00:09:57,620 --> 00:10:01,880
A lot of IoT devices are using UPnP.

98
00:10:01,880 --> 00:10:05,000
It makes them very simple for setup and control.

99
00:10:05,140 --> 00:10:08,280
A lot of consumer devices, they just want to make it simple.

100
00:10:08,280 --> 00:10:10,760
You take it home, you plug it in, and it works.

101
00:10:10,860 --> 00:10:13,660
So that's why UPnP is helpful for that.

102
00:10:14,460 --> 00:10:18,360
But as a hacker, we can look at what can we do with that.

103
00:10:18,360 --> 00:10:21,980
So we can do things like turning smart home devices on and off.

104
00:10:21,980 --> 00:10:25,960
And I'll do a demo later of the Wemo switch turning that on and off.

105
00:10:27,020 --> 00:10:44,820
One of the other things that UPnP has gotten the news a lot for is the ability to update the router's configuration and open ports on the router so that you can forward from the WAN side, the internet side, into the internal network.

106
00:10:45,040 --> 00:10:47,860
And then, as I said, you can also control media devices.

107
00:10:47,860 --> 00:10:52,500
So I thought IoT has already so many vulnerabilities.

108
00:10:52,660 --> 00:10:55,540
There's got to be some UPnP vulnerabilities, right?

109
00:10:55,540 --> 00:11:01,020
So that's why I wanted to look at UPnP as sort of an attack path.

110
00:11:02,220 --> 00:11:07,000
As I said, there's been a couple of notable exploits in the news.

111
00:11:07,000 --> 00:11:14,320
Back in 2017, Akamai released a paper talking about UPnProxy, UPnProxy.

112
00:11:15,000 --> 00:11:25,180
Basically, a lot of devices were configured to expose the UPnP interface on their WAN, on the WAN side.

113
00:11:25,180 --> 00:11:32,660
So you could send control events, things like port forwarding from the WAN side.

114
00:11:32,660 --> 00:11:40,080
So somebody on the internet could control your router and could set port forwarding to get internal access to your network.

115
00:11:40,080 --> 00:11:46,060
And even some of the rules, the way that they were doing the port forwarding, they're not validating the field.

116
00:11:46,060 --> 00:11:54,380
So you could port forward a port on the WAN side and forward it to a completely different URL somewhere else on the internet.

117
00:11:54,380 --> 00:12:03,600
So people were using this as a proxy, as their UPnProxy, to hide where they're coming from and sort of disguise their attacks.

118
00:12:04,260 --> 00:12:23,220
Back in 2019, there was a pretty famous attack from HackerGiraffe, where they used basically that same functionality, routers that were allowing configuration on their WAN side, to port forward to the Chromecast device.

119
00:12:23,440 --> 00:12:29,980
And then from there, they could control the Chromecast device, because it used UPnP as a way to stream a video to it.

120
00:12:29,980 --> 00:12:34,780
So they could control the Chromecast device and put a video of their choosing on.

121
00:12:34,780 --> 00:12:39,840
And they decided to put up an advertisement to subscribe to PewDiePie.

122
00:12:40,100 --> 00:12:42,060
So that got a lot of news headlines.

123
00:12:42,760 --> 00:12:48,480
One of the more recent ones that I've come across is this vulnerability called Call Stranger.

124
00:12:49,020 --> 00:12:51,420
And it's a 2020 vulnerability.

125
00:12:51,420 --> 00:13:01,520
It's really interesting when you look at this, because basically what he did is he looked at the UPnP spec and just noticed that there's some bad design in the spec.

126
00:13:02,060 --> 00:13:07,000
So I talked about the event subscription part of this.

127
00:13:07,360 --> 00:13:10,100
There's a callback of the event subscription.

128
00:13:10,100 --> 00:13:12,800
So you tell it where to call back when something changes.

129
00:13:12,800 --> 00:13:16,660
But there's no validation at this point done on that callback.

130
00:13:16,660 --> 00:13:21,540
So you can have that be some other address on the internet.

131
00:13:21,540 --> 00:13:25,460
You can use it to... you can add query strings on it.

132
00:13:25,460 --> 00:13:29,940
So you could use it for data exfiltration, if you wanted to get stuff out of a network kind of sneakily.

133
00:13:30,520 --> 00:13:43,040
There's also some amplifications type ramifications to this, because you send a very small request, and the request that comes back or gets forwarded to that notification server is much larger in size.

134
00:13:43,040 --> 00:13:48,120
So you can potentially do some sort of denial of service using that amplification.

135
00:13:48,740 --> 00:13:51,900
So we'll look at that and show you how that's done.

136
00:13:54,690 --> 00:14:01,530
So when I went looking for the UPnP tool, there's basic things that I would want a UPnP tool to do.

137
00:14:01,530 --> 00:14:04,450
First, I want it to discover all the devices on my network.

138
00:14:05,270 --> 00:14:06,970
I don't want to have to go out there and look for it.

139
00:14:06,970 --> 00:14:08,810
I want this tool to be able to find them.

140
00:14:08,990 --> 00:14:14,170
Once it finds them, it should be able to parse the description, find the services and actions and events.

141
00:14:14,290 --> 00:14:16,930
You know, XML is pretty straightforward and easy to parse.

142
00:14:16,930 --> 00:14:18,590
So that should be straightforward.

143
00:14:18,730 --> 00:14:31,990
And then to be able to build and manipulate the UPnP requests, that needs to be something simple that I can easily do, and potentially, ideally, fuzz that interface.

144
00:14:34,270 --> 00:14:39,110
So let's look at some of the tools that are out there and how I found that they worked.

145
00:14:39,110 --> 00:14:42,970
Now, this isn't an exhaustive presentation of what's out there.

146
00:14:42,970 --> 00:14:45,490
These are just the more common ones that I've come across.

147
00:14:46,150 --> 00:14:48,190
The first one is Miranda.

148
00:14:48,190 --> 00:14:50,730
And it's available in Kali out of the box.

149
00:14:50,950 --> 00:14:54,590
Has a nice command line syntax, if you like that kind of thing.

150
00:14:54,850 --> 00:14:58,930
But on the con side of things, I found it doesn't always work.

151
00:14:59,830 --> 00:15:03,610
In the case, I just ran it yesterday on my home network.

152
00:15:03,830 --> 00:15:10,130
It can find the devices by doing an msearch, but it seems to have trouble parsing some of the service description files.

153
00:15:10,130 --> 00:15:16,770
So it comes back with an empty list of services, and it can't do any sort of control of the actions.

154
00:15:17,010 --> 00:15:23,130
Also, command line syntax, in my opinion, isn't as nice for interacting with these requests.

155
00:15:23,130 --> 00:15:27,130
And I just don't find it as nice to use.

156
00:15:28,850 --> 00:15:34,790
The next tool that I looked at, and I was actually really excited about this tool, was the Burp UPnP B-Hunter.

157
00:15:34,830 --> 00:15:37,150
It's available in the Burp app store.

158
00:15:37,750 --> 00:15:44,430
Because UPnP is HTTP based, XML soap, all that kind of stuff works really well in Burp.

159
00:15:44,450 --> 00:15:47,910
And it works really well in Burp's other tools, like Intruder and Repeater.

160
00:15:47,990 --> 00:15:51,630
So I thought this was a great place to have that kind of functionality.

161
00:15:52,110 --> 00:15:58,150
But when I started using it, there were some major problems that I had where it wouldn't detect all the devices on the network.

162
00:15:58,150 --> 00:16:02,370
Some of the devices that I knew were there, it wasn't picking them up.

163
00:16:03,250 --> 00:16:05,450
And sometimes the parsing wasn't working.

164
00:16:05,450 --> 00:16:14,030
It wasn't able to parse the service descriptions and get access to all the different control points.

165
00:16:14,550 --> 00:16:17,190
Lastly, I found the interface just wasn't so easy.

166
00:16:17,770 --> 00:16:21,570
My home network, I do have a lot of IoT devices plugged in.

167
00:16:21,930 --> 00:16:26,150
And when I do a UPnP scan, I get back five or six devices.

168
00:16:26,150 --> 00:16:32,950
Each of them have many service descriptions and lots of control endpoints.

169
00:16:33,090 --> 00:16:42,190
And the version that's in the app store right now basically has very little fine-grained control over what requests you send to Intruder or Repeater.

170
00:16:42,250 --> 00:16:45,430
And sometimes even you don't have control over where you send it to.

171
00:16:45,430 --> 00:16:46,710
It's either one or the other.

172
00:16:46,870 --> 00:16:56,250
But I was ending up with, you know, a hundred Repeater tabs of requests and trying to dig through a hundred tabs to find the one request that I wanted to fuzz or test.

173
00:16:56,390 --> 00:16:59,630
It's just not very user-friendly, in my opinion.

174
00:17:01,010 --> 00:17:05,650
So, you know, what's a wannabe UPnP hacker guy like me going to do?

175
00:17:05,710 --> 00:17:07,330
As I said, there's other tools.

176
00:17:07,330 --> 00:17:10,610
There are things like uFuzz that's based on Miranda.

177
00:17:10,610 --> 00:17:13,350
So it's going to have the same sort of shortcomings that Miranda has.

178
00:17:13,630 --> 00:17:18,150
There's some .NET tools, but I don't really work on a Windows laptop very much.

179
00:17:18,150 --> 00:17:21,530
So .NET is not that conducive for me.

180
00:17:22,590 --> 00:17:26,050
So, you know, I was kind of looking at a few different options.

181
00:17:26,050 --> 00:17:28,790
I keep looking, see if there's other tools out there.

182
00:17:28,870 --> 00:17:34,170
I build a new tool from scratch or I modify an existing tool that's already out there.

183
00:17:34,310 --> 00:17:39,850
So being Canadian, I turned to my good friend and my neighbor, Drake, and I said, what should I do?

184
00:17:39,870 --> 00:17:42,210
He told me, don't build a new tool from scratch.

185
00:17:42,210 --> 00:17:45,190
You got to modify something that's already existing out there.

186
00:17:46,630 --> 00:17:51,630
So that brings me to my version of Burp's UPnP Hunter.

187
00:17:51,630 --> 00:18:02,950
I thought that it had the best sort of, you know, potential for a tool because of its integration into Burp and some of the other tools that you can use with Burp.

188
00:18:03,150 --> 00:18:07,150
But first we had to get through some of the bugs that it was facing right now.

189
00:18:07,150 --> 00:18:17,190
So the first one, the fact that it didn't detect all the UPnP devices on the network, I found that this comes down to some devices just don't follow the spec very well.

190
00:18:18,230 --> 00:18:25,930
It was sending the msearch using an ssdp-all, which I showed earlier, and all devices are supposed to respond to that.

191
00:18:25,930 --> 00:18:27,790
But some devices, they just don't.

192
00:18:27,790 --> 00:18:30,450
So I added a different msearch.

193
00:18:30,450 --> 00:18:36,550
So it does two msearches, one using ssdp-all and one using another tag called root device.

194
00:18:36,670 --> 00:18:40,530
And only the root device is supposed to respond to that, not all the different services.

195
00:18:41,170 --> 00:18:47,510
That seemed, pardon me, that seemed to work a little bit better for some of the devices that were on my network.

196
00:18:47,510 --> 00:18:51,510
So I was able to find all the devices on my network at that point.

197
00:18:52,210 --> 00:18:56,210
I still had some issues though with parsing in this tool.

198
00:18:56,490 --> 00:19:00,050
There was an interesting unsigned integer conversion error.

199
00:19:00,050 --> 00:19:07,330
So Burp is written in Java and Java byte arrays go from negative 127 to positive 127.

200
00:19:07,510 --> 00:19:14,430
But Python, which this tool is written in, has byte arrays go from 0 to 256.

201
00:19:14,770 --> 00:19:21,110
So in most characters, that doesn't really matter because you're still in the 0 to 127 range.

202
00:19:21,190 --> 00:19:29,530
But when you get into special characters and you get an assigned byte array from Java going into Python, things don't work so well.

203
00:19:29,530 --> 00:19:36,810
So I had to do some tricks to convert that back to an unsigned byte array.

204
00:19:38,110 --> 00:19:46,730
So that, you know, no matter what we got in the service description, special characters or not, it wasn't going to work on me.

205
00:19:47,290 --> 00:19:59,930
I also found that the control URLs, the way that it was parsing the control URLs from the device description, it didn't account for the fact that some devices add query strings to the control URLs.

206
00:19:59,930 --> 00:20:09,090
So they have a generic control URL, they have a query parameter that it uses to determine what service you're trying to talk to.

207
00:20:09,190 --> 00:20:11,970
Without that, it just gave me back a bad request.

208
00:20:11,970 --> 00:20:18,090
So I had to modify the tool to actually use the query string that was part of the control URL.

209
00:20:20,010 --> 00:20:23,910
Lastly, there were still other issues with the parsing.

210
00:20:23,910 --> 00:20:27,270
It wasn't actually doing XML parsing in the first version.

211
00:20:27,270 --> 00:20:34,210
It was using a regex to try to search through the XML document to pull out the pieces that it needed.

212
00:20:34,330 --> 00:20:40,430
And if you had an XML document that wasn't structured the way it's expected, then it wouldn't work.

213
00:20:40,430 --> 00:20:45,670
So I switched it to use actual XML parsing because that just makes sense.

214
00:20:47,330 --> 00:20:50,190
I also changed the UI for the tool.

215
00:20:51,210 --> 00:20:59,910
Because I didn't want to have to dig through 100 tabs in repeater, I added some combo boxes where you can now select the IP, the service, and the action.

216
00:20:59,910 --> 00:21:04,250
So you can drill in on the specific request that you want to look at and play with.

217
00:21:04,450 --> 00:21:07,450
I added a full request viewer and editor.

218
00:21:07,490 --> 00:21:12,810
So you can look at that and maybe change things before you send it to intruder or repeater.

219
00:21:12,850 --> 00:21:15,310
And you have the option to send it to either.

220
00:21:15,310 --> 00:21:18,770
You're not sort of tied into one or the other like you were in the first version.

221
00:21:20,270 --> 00:21:23,990
And lastly, I added a couple new features to the tool.

222
00:21:23,990 --> 00:21:28,950
So I added the ability to subscribe to event notification.

223
00:21:28,950 --> 00:21:43,250
So it parses that service description, looks for state variables that have events turned on, and then it will build a request for you that you can generate a subscribe request to subscribe to those state variables.

224
00:21:43,650 --> 00:21:48,630
I also added an option to specify the single device description.

225
00:21:48,630 --> 00:21:54,230
So instead of searching your network, you can specify a remote service description.

226
00:21:54,290 --> 00:22:00,150
Searching only works on your local network because you're broadcasting to an address within your local network.

227
00:22:00,150 --> 00:22:03,070
So only devices within that local network are going to work.

228
00:22:03,250 --> 00:22:08,850
But if you go on Shodan, there's a lot of UPnP devices on Shodan that are exposed to the internet.

229
00:22:08,850 --> 00:22:16,910
If you want to play with those, now you can because you can paste that service description into there directly and load that and get all the actions.

230
00:22:17,430 --> 00:22:25,330
I also added some little buttons so you can view, pull up the service description and SCDP files directly from the tool.

231
00:22:25,370 --> 00:22:31,170
That was kind of more of a convenience for me as I was debugging and trying to figure out why things weren't working.

232
00:22:31,190 --> 00:22:37,510
To easily get to the device description and those files made it a little bit easier to see what I'm looking at.

233
00:22:39,070 --> 00:22:41,110
And now it's demo time.

234
00:22:41,110 --> 00:22:44,950
So we'll go through that tool and show you what it actually does.

235
00:22:47,050 --> 00:22:49,750
So UPnP Hunter 2.0.

236
00:22:49,750 --> 00:22:52,730
Right now it is not available in the Burp App Store.

237
00:22:52,730 --> 00:22:56,810
I do plan to push it to the Burp App Store at some point later.

238
00:22:56,810 --> 00:23:07,270
I first wanted to wait and give the original author a chance to pull in some of the changes that I pushed and maybe update the tool from there.

239
00:23:07,590 --> 00:23:10,010
He doesn't seem to have the interest to do that.

240
00:23:10,010 --> 00:23:13,230
So I will push this as a separate standalone version.

241
00:23:14,350 --> 00:23:15,510
So this is the tool.

242
00:23:15,510 --> 00:23:18,150
This is what it looks like in the Burp tab.

243
00:23:18,330 --> 00:23:21,470
And I'm just going to go ahead and start a discovery on my network.

244
00:23:22,370 --> 00:23:23,750
And this will take a few minutes.

245
00:23:23,750 --> 00:23:31,330
Because as I said, it's running the mSearch, reading back all the responses and then parsing out.

246
00:23:31,330 --> 00:23:35,430
So on this network, I have two devices that are running UPnP.

247
00:23:35,430 --> 00:23:38,050
This is the ACES router as we saw before.

248
00:23:38,050 --> 00:23:41,170
This one is the Belkin WeMo device.

249
00:23:41,170 --> 00:23:47,730
And this is the list of all the service endpoints that it understands.

250
00:23:48,110 --> 00:23:52,850
And if you look at the different actions, these are all the actions within that service endpoint.

251
00:23:52,850 --> 00:23:55,350
So I'll just pull up the SCDP here for a second.

252
00:23:55,930 --> 00:23:59,950
And so you can see, you know, action, get device information.

253
00:24:00,030 --> 00:24:01,470
That should be in here somewhere.

254
00:24:01,470 --> 00:24:03,050
Yeah, get device information.

255
00:24:03,170 --> 00:24:09,290
And then once you select it, it pulls up the request, builds out the request in this field here.

256
00:24:09,290 --> 00:24:14,850
So you can view it, see what different parameters it takes.

257
00:24:14,850 --> 00:24:18,850
And then you can send that straight to Repeater or to Intruder.

258
00:24:18,850 --> 00:24:21,310
And you'll see that Repeater picked it up.

259
00:24:21,350 --> 00:24:22,170
And now it's here.

260
00:24:22,170 --> 00:24:27,150
And I can send this request and get device information from that device.

261
00:24:28,950 --> 00:24:32,510
So that's, you know, very basically, that's how it works.

262
00:24:32,510 --> 00:24:36,990
So let's show you why this is cool and, you know, what we can do with this.

263
00:24:36,990 --> 00:24:46,290
So one of the things that's very easy to do with the Belkin WeMo device is controlling its on and off state.

264
00:24:46,290 --> 00:24:49,150
So it's called binary state.

265
00:24:49,930 --> 00:24:54,330
So we are going to find the request set binary state.

266
00:24:54,470 --> 00:24:57,690
And we can see there's a few different parameters here.

267
00:24:57,690 --> 00:25:03,510
And the parameter values are just filled with fuzz here to tell you where you can actually put input.

268
00:25:04,050 --> 00:25:05,550
And we'll send that to Repeater.

269
00:25:06,030 --> 00:25:09,090
We'll take all this fuzz here stuff out.

270
00:25:12,280 --> 00:25:18,880
And the only one that really is needed for most basic operation is the binary state.

271
00:25:18,880 --> 00:25:22,700
So I'm going to set the binary state to one, which should be on.

272
00:25:23,280 --> 00:25:32,260
And as you see over here, the light flips on and I get a response that now the binary state is on and some other information.

273
00:25:32,260 --> 00:25:36,720
And now I can set the binary state back to zero and the light goes off.

274
00:25:36,720 --> 00:25:41,320
So very simple, easy control of the device state through UPnP.

275
00:25:43,640 --> 00:25:49,980
Let's talk a little bit about event subscription.

276
00:25:50,380 --> 00:25:55,500
So in here, you will see a subscribe request.

277
00:25:55,900 --> 00:26:00,580
And it again uses a custom HTTP verb, subscribe.

278
00:26:01,280 --> 00:26:04,820
This is the path pulled out of the device subscription.

279
00:26:05,040 --> 00:26:07,840
And then again, there's a bunch of places where you can fuzz.

280
00:26:08,640 --> 00:26:15,340
Here in this section is where you put the parameters that where you want the callback to come to.

281
00:26:15,340 --> 00:26:21,060
You can set a timeout for how long you want to get notified of those event changes.

282
00:26:21,060 --> 00:26:29,800
And then this is a comma separated list of all the different parameters that this device will give event notifications for.

283
00:26:29,980 --> 00:26:33,320
So I already have one of these queued up over here.

284
00:26:33,940 --> 00:26:34,980
Let's see.

285
00:26:35,460 --> 00:26:47,480
So if everything is still working the way it should, I will get a device subscription, or sorry, event notification here saying the...

286
00:26:52,400 --> 00:26:54,360
that is not what I expected.

287
00:26:54,360 --> 00:26:55,340
Hang on a sec.

288
00:26:56,420 --> 00:26:58,100
Property change.

289
00:26:59,560 --> 00:27:01,440
Property state is zero.

290
00:27:01,440 --> 00:27:01,760
Okay.

291
00:27:01,760 --> 00:27:02,100
Sorry.

292
00:27:02,100 --> 00:27:03,340
That is what I expected.

293
00:27:03,860 --> 00:27:17,980
Now if I go back to the basic event request and I change the state back to one, now I get another notification coming in on that callback with the binary state is one.

294
00:27:17,980 --> 00:27:20,840
So we see the notifications and how they come back.

295
00:27:21,580 --> 00:27:32,580
What's interesting about the notifications and what this call stranger vulnerability sort of talks about is you can specify multiple endpoints that this calls back to.

296
00:27:33,120 --> 00:27:48,980
One of the neat sort of features of this is that if the first request doesn't... if the first URL doesn't... it can't reach it, it doesn't get a response from it, then it will try the next request, the next IP.

297
00:27:49,120 --> 00:27:56,000
So you can actually make use of this to do some internal port scanning of things on the network.

298
00:27:56,000 --> 00:28:06,220
If you can access this on the WAN side, for example, you can use this feature, specify a host and a port, and then specify a host and a port that you know it can reach.

299
00:28:06,340 --> 00:28:16,680
And if you get the callback coming to your IP address, you know that it wasn't able to connect to the previous one.

300
00:28:17,240 --> 00:28:22,460
So that's kind of a fun little thing you can do with the subscribe feature.

301
00:28:22,780 --> 00:28:27,840
But really, that's, I guess, sort of the end of my demonstration of this tool.

302
00:28:28,160 --> 00:28:35,400
I think it can be really powerful, especially being able to send stuff to intruder and do some fuzzing with this.

303
00:28:36,600 --> 00:28:47,280
And I can also show you here that if we just take this device description, paste it in here, then we get just that device descriptions services.

304
00:28:47,280 --> 00:28:48,160
We don't get all the other.

305
00:28:48,160 --> 00:28:52,760
So you can use that as well to sort of narrow down or look at remote ones, like I said.

306
00:28:54,540 --> 00:28:56,660
And I think that is it.

307
00:28:56,660 --> 00:28:59,460
So the repository for this is in our GitLab.

308
00:28:59,560 --> 00:29:00,780
The link is here.

309
00:29:01,580 --> 00:29:09,000
As I said, I do plan on pushing this to the Verp app store at some point in the future, but it's just not there right now.