start	end	text
0	5580	This talk is about my search for a good UPnP hacking tool.
6340	11340	So what we're going to go over today is just some introductions to tell you who I am.
12020	16320	First I'll start talking about what is UPnP and why should you care about UPnP?
16560	20120	Why was I looking for a tool to hack UPnP in the first place?
20620	25740	I'll talk about some of the tools that are out there right now and what I found to be
25740	29680	their shortcomings and why I thought that they weren't quite sufficient.
29980	37900	I will show you a new, an updated tool that I put a lot of updates into and I'll talk
37900	39360	about the features of that.
39360	44000	And throughout we'll do some demos of that functionality and about UPnP in general.
44580	50360	Q&A was going to be in the Discord chat, but I know Discord is down at the moment or there's
50360	51600	some issues with it.
51600	58760	So if that still happens, we'll probably just keep the Q&A here in the Twitch channel.
59880	61360	All right, so who am I?
61360	63620	Real name is Trevor Stavato.
63620	66880	I've been in offensive security for over 10 years.
67580	73160	Different positions, mostly in web app and network pen testing.
73480	77880	A couple of years ago, I founded this cool little company called LabMath Security.
79400	84380	Before I was in hacking, I was a software developer and I did that for a number of years
84380	88340	and then realized all the mistakes I was making once I became a hacker.
89220	92740	I try to be an active member of the security community.
92780	97140	As Sam said, I help do some IoT village stuff in Canada.
97140	99200	I help sometimes in the U.S. as well.
100200	102680	I like to dabble a little bit in RFID.
102680	105280	So we do an RFID village here in Canada.
105280	109260	And I do some red teaming for the pros versus Joe CTF,
109260	113320	which unfortunately didn't happen this year because of all this COVID stuff.
114360	121400	Maybe one of my proudest achievements so far is the DEF CON 26 black badge win at the IoT CTF.
122640	126220	All right, so let's talk about what UPnP is.
126220	129320	So UPnP is Universal Plug and Play.
129320	136800	And it's a protocol defined, I think back in 2008 was the original publication of this protocol,
138000	142100	allowing for devices on network to discover and interact with each other.
142100	145820	It's based around a principle called zero configuration networking.
146260	150660	Really what they wanted to be able to do was to have a device that just plugged into a network,
150660	154420	found other devices and was able to talk to and communicate with the other devices
154420	158760	and have them configure themselves according to their needs
158760	164140	without anybody having any actual input and hands-on keyboard configuration.
164700	167140	Sounds like a great idea to me.
168200	175740	So UPnP is a protocol that uses pretty standard services like HTTP, XML, and SOAP.
175740	181760	And it defines a way for services to describe their functionality and interact with other devices.
182220	186100	A lot of the common uses for this are for network services.
186100	192840	So small office, home office routers will use this for configuring port forwarding.
193480	200320	There's data sharing services for network storage, media streaming, for example, Chromecast,
200320	205660	or some of the original versions of Chromecast use UPnP to initiate the streams.
205680	207900	And it's also used commonly in smart home control,
207900	211000	which will be one of the demos that we're doing later on today.
213200	220720	So in the spec, UPnP talks about kind of six capabilities or six things that are required
220720	225140	for proper UPnP functioning. The first one is addressing.
225620	230700	It's not as important for the tool because we can't really talk to it unless it has a device,
230700	235820	but the device needs a way to get an IP address. And this is typically done through DHCP.
237160	241080	The second one, more interesting to us, is a discovery protocol.
241080	246980	The devices need to be able to advertise their presence on the network, or other devices need
246980	252860	to be able to search for other UPnP devices on the network. So there's a protocol called
252860	258280	Simple Service Discovery Protocol, SSDP, that is used to do this advertisement.
258280	261920	And I'll show one of those requests later and show how that works.
263240	268820	Once you know what devices are on the networks, you need to know what those devices can do.
268820	276240	And then there's a device description XML file that gives this detail. And when the devices
276240	282000	broadcast their presence or another device searches for them, the URL to that XML file
282000	290170	is part of the response that comes back. The next part is control. So once you know
290170	295050	what it can do, you need to know how to control that device. You need to know what endpoint to
295050	302290	send the request to, what parameters you need to include in the request. Once you have this
302290	306630	information, now that's enough information to start interacting with that device.
307270	314090	There are still a couple of other parts to UPnP. The fifth one is event notification. So
314710	320490	you can subscribe to specific state variables on a device. And if that state variable changes,
320490	327110	it'll send a notification to you. And then the last part of UPnP protocol is a presentation.
327810	333250	For the topic of this talk, that's not as important, because that just gets into sort
333250	339990	of regular web app hacking, less UPnP hacking. So we're going to focus on two to five with this
340450	352970	talk. So I'm going to show you just a brief view of a device description and what that kind of
352970	360210	looks like. So over here, I'm going to run a search. And you'll see the discovery message.
360210	363370	And I'll make this bigger, because this might not be easy for people to see.
367200	376180	So there's a discovery message that uses a custom HTTP verb called msearch. It posts to a
376180	383560	broadcast address. And this is just a fixed... this is the same on every network. It's got a
383560	390820	message saying, try SSDP discover, and the service type in this case is SSDP all, which basically
390820	396680	says, all devices respond to me. And you can see the responses come back here from all the
396680	405960	different devices, showing you here is the location of my device description. And it'll
405960	412780	also give you some information about what kind of device it is. So you can see on my network,
412780	417620	there are a couple devices that have a lot of different services. Because we said SSDP all,
417620	425540	all the services are responding separately. So now I'm going to... we're going to take a look at
425540	437130	one of these. And we'll show you what a device description looks like. And make this bigger.
439070	445030	So this here, you can see my setup here on the other screen. I have an Asus router,
445030	450050	I have a WeMo switch, and that is, there's a little lamp plugged into that WeMo switch.
450450	456550	So the device description we're seeing here is for the Asus router. It shows you the model number,
456550	462350	the version numbers, serial number, a lot of information about it. When we get down into
462350	467910	this section, the service list, this is where we see the different services, the UPnP services
467910	473950	that it supports. So it'll show you the URL that you need to send control requests to,
473950	483170	the URL to send event requests to. And it'll also have, not in this one, but in some of them,
483170	489690	it'll have the, oh yeah, no, here it is, the SCDP, so the service controlled
491410	497330	description, so the service description. So if we copy this, and we put this on here,
497330	507350	we'll now put a double X bar, there we go. Now we'll see all the actions that this service
507350	514010	supports, action name, and all the arguments. So we can collapse all this, and you can see there's
514010	519310	gonna be a bunch of actions for this service. And then we get into this server state table that
519310	525210	talks about all the state variables. And some of these won't send events, so the send events is no,
525210	530250	but some of these do. And those are the ones that we can subscribe to. So physical link status
530250	537030	is a variable that we can subscribe to and get notifications when that status changes.
537190	544630	So you can see how this can be used by devices to monitor what's happening in the network and be
544630	552150	able to control it. So that's the overview of how the service descriptions and device
552150	560340	descriptions work and what they look like. So one thing that's missing from this spec
561080	565440	is that there's no authentication. Even on the control endpoints, when you're sending a control
565440	571800	message, they are unauthenticated. It's a very old protocol, as I said, 2008, so they probably
571800	578460	didn't think about that part of it. There have been some updates, some other optional pieces
578460	584680	that you can tack on to add some authentication and some security to it. But those really,
584680	589800	from my experience, I haven't seen any devices that use those. So most of this is just fully
589800	599120	done unauthenticated. So why does this relate to IoT? Why is it in IoT Village? A lot of IoT devices
599120	606980	are using UPnP. It makes them very simple for setup and control. A lot of consumer devices,
606980	611200	they just want to make it simple. You take it home, you plug it in, and it works. So that's
611200	618780	why UPnP is helpful for that. But as a hacker, we can look at what can we do with that. So we can
618780	624520	do things like turning smart home devices on and off. And I'll do a demo later of the Wemo switch
624520	631680	turning that on and off. One of the other things that UPnP has gotten the news a lot for is the
631680	640220	ability to update the router's configuration and open ports on the router so that you can forward
640220	646400	from the WAN side, the internet side, into the internal network. And then, as I said, you can
646400	653340	also control media devices. So I thought IoT has already so many vulnerabilities. There's got to be
653340	661020	some UPnP vulnerabilities, right? So that's why I wanted to look at UPnP as sort of an attack path.
662220	668940	As I said, there's been a couple of notable exploits in the news. Back in 2017, Akamai
668940	679000	released a paper talking about UPnProxy, UPnProxy. Basically, a lot of devices were configured to
679000	688100	expose the UPnP interface on their WAN, on the WAN side. So you could send control events,
688100	695020	things like port forwarding from the WAN side. So somebody on the internet could control your
695020	700760	router and could set port forwarding to get internal access to your network. And even some
700760	706060	of the rules, the way that they were doing the port forwarding, they're not validating the field.
706060	713120	So you could port forward a port on the WAN side and forward it to a completely different URL
713120	718900	somewhere else on the internet. So people were using this as a proxy, as their UPnProxy,
718900	723600	to hide where they're coming from and sort of disguise their attacks.
724260	732720	Back in 2019, there was a pretty famous attack from HackerGiraffe, where they used basically
732720	738980	that same functionality, routers that were allowing configuration on their WAN side,
738980	744940	to port forward to the Chromecast device. And then from there, they could control the
744940	751040	Chromecast device, because it used UPnP as a way to stream a video to it. So they could control
751040	757420	the Chromecast device and put a video of their choosing on. And they decided to put up an
757420	762060	advertisement to subscribe to PewDiePie. So that got a lot of news headlines.
762760	768480	One of the more recent ones that I've come across is this vulnerability called Call Stranger.
769020	773360	And it's a 2020 vulnerability. It's really interesting when you look at this, because
773360	778620	basically what he did is he looked at the UPnP spec and just noticed that there's some
779240	788560	bad design in the spec. So I talked about the event subscription part of this. There's a callback
788560	792800	of the event subscription. So you tell it where to call back when something changes.
792800	800160	But there's no validation at this point done on that callback. So you can have that be some other
800160	806060	address on the internet. You can use it to... you can add query strings on it. So you could use it
806060	811240	for data exfiltration, if you wanted to get stuff out of a network kind of sneakily. There's also
811240	817320	some amplifications type ramifications to this, because you send a very small request,
817320	822740	and the request that comes back or gets forwarded to that notification server is much larger in
822740	828120	size. So you can potentially do some sort of denial of service using that amplification.
828740	838530	So we'll look at that and show you how that's done. So when I went looking for the UPnP tool,
838530	842870	there's basic things that I would want a UPnP tool to do. First, I want it to discover all
842870	847490	the devices on my network. I don't want to have to go out there and look for it. I want this tool
847490	852070	to be able to find them. Once it finds them, it should be able to parse the description, find the
852070	857130	services and actions and events. You know, XML is pretty straightforward and easy to parse. So that
857130	863930	should be straightforward. And then to be able to build and manipulate the UPnP requests, that needs
863930	871990	to be something simple that I can easily do, and potentially, ideally, fuzz that interface.
874270	879370	So let's look at some of the tools that are out there and how I found that they worked. Now,
879370	884310	this isn't an exhaustive presentation of what's out there. These are just the more common ones
884310	890730	that I've come across. The first one is Miranda. And it's available in Kali out of the box.
890950	896970	Has a nice command line syntax, if you like that kind of thing. But on the con side of things,
896970	903610	I found it doesn't always work. In the case, I just ran it yesterday on my home network.
903830	908810	It can find the devices by doing an msearch, but it seems to have trouble parsing some of the
908810	914730	service description files. So it comes back with an empty list of services, and it can't do any
914730	921230	sort of control of the actions. Also, command line syntax, in my opinion, isn't as nice for
921230	927130	interacting with these requests. And I just don't find it as nice to use.
928850	932530	The next tool that I looked at, and I was actually really excited about this tool,
932530	941090	was the Burp UPnP B-Hunter. It's available in the Burp app store. Because UPnP is HTTP based,
941090	946010	XML soap, all that kind of stuff works really well in Burp. And it works really well in Burp's
946010	950410	other tools, like Intruder and Repeater. So I thought this was a great place to have that
950410	955630	kind of functionality. But when I started using it, there were some major problems that I had
955630	959170	where it wouldn't detect all the devices on the network. Some of the devices that I knew
959170	965990	were there, it wasn't picking them up. And sometimes the parsing wasn't working. It wasn't
965990	974030	able to parse the service descriptions and get access to all the different control points.
974550	980010	Lastly, I found the interface just wasn't so easy. My home network, I do have a lot of IoT
980010	986850	devices plugged in. And when I do a UPnP scan, I get back five or six devices. Each of them have
986850	995430	many service descriptions and lots of control endpoints. And the version that's in the app store
995430	1000850	right now basically has very little fine-grained control over what requests you send to Intruder
1000850	1005670	or Repeater. And sometimes even you don't have control over where you send it to. It's either
1005670	1011490	one or the other. But I was ending up with, you know, a hundred Repeater tabs of requests and
1011490	1016250	trying to dig through a hundred tabs to find the one request that I wanted to fuzz or test.
1016390	1023890	It's just not very user-friendly, in my opinion. So, you know, what's a wannabe UPnP hacker guy
1023890	1029910	like me going to do? As I said, there's other tools. There are things like uFuzz that's based
1029910	1034130	on Miranda. So it's going to have the same sort of shortcomings that Miranda has. There's some
1034130	1040430	.NET tools, but I don't really work on a Windows laptop very much. So .NET is not that conducive
1040430	1047050	for me. So, you know, I was kind of looking at a few different options. I keep looking,
1047050	1052650	see if there's other tools out there. I build a new tool from scratch or I modify an existing
1052650	1058150	tool that's already out there. So being Canadian, I turned to my good friend and my neighbor,
1058150	1062210	Drake, and I said, what should I do? He told me, don't build a new tool from scratch.
1062210	1065190	You got to modify something that's already existing out there.
1066630	1073550	So that brings me to my version of Burp's UPnP Hunter. I thought that it had the best sort of,
1074970	1081230	you know, potential for a tool because of its integration into Burp and some of the other
1081230	1085150	tools that you can use with Burp. But first we had to get through some of the bugs that
1085150	1091110	it was facing right now. So the first one, the fact that it didn't detect all the UPnP devices
1091110	1097190	on the network, I found that this comes down to some devices just don't follow the spec very well.
1098230	1104310	It was sending the msearch using an ssdp-all, which I showed earlier, and all devices are
1104310	1110450	supposed to respond to that. But some devices, they just don't. So I added a different msearch.
1110450	1116550	So it does two msearches, one using ssdp-all and one using another tag called root device.
1116670	1120530	And only the root device is supposed to respond to that, not all the different services.
1121170	1126770	That seemed, pardon me, that seemed to work a little bit better for some of the devices that
1126770	1131510	were on my network. So I was able to find all the devices on my network at that point.
1132210	1138690	I still had some issues though with parsing in this tool. There was an interesting unsigned
1138690	1145490	integer conversion error. So Burp is written in Java and Java byte arrays go from negative 127
1145490	1154430	to positive 127. But Python, which this tool is written in, has byte arrays go from 0 to 256.
1154770	1161110	So in most characters, that doesn't really matter because you're still in the 0 to 127 range.
1161190	1166890	But when you get into special characters and you get an assigned byte array from Java going
1166890	1173850	into Python, things don't work so well. So I had to do some tricks to convert that back to
1173850	1182790	an unsigned byte array. So that, you know, no matter what we got in the service description,
1182790	1189770	special characters or not, it wasn't going to work on me. I also found that the control URLs,
1189770	1195270	the way that it was parsing the control URLs from the device description, it didn't account for the
1195270	1202070	fact that some devices add query strings to the control URLs. So they have a generic control URL,
1202070	1209090	they have a query parameter that it uses to determine what service you're trying to talk to.
1209190	1214310	Without that, it just gave me back a bad request. So I had to modify the tool to actually use the
1214790	1222750	query string that was part of the control URL. Lastly, there were still other issues with the
1223270	1229310	parsing. It wasn't actually doing XML parsing in the first version. It was using a regex to try to
1229970	1234210	search through the XML document to pull out the pieces that it needed.
1234330	1238070	And if you had an XML document that wasn't structured the way it's expected,
1238070	1245670	then it wouldn't work. So I switched it to use actual XML parsing because that just makes sense.
1247330	1254570	I also changed the UI for the tool. Because I didn't want to have to dig through 100 tabs in
1254570	1259910	repeater, I added some combo boxes where you can now select the IP, the service, and the action.
1259910	1264250	So you can drill in on the specific request that you want to look at and play with.
1264450	1270650	I added a full request viewer and editor. So you can look at that and maybe change things
1270650	1275310	before you send it to intruder or repeater. And you have the option to send it to either.
1275310	1278770	You're not sort of tied into one or the other like you were in the first version.
1280270	1288950	And lastly, I added a couple new features to the tool. So I added the ability to subscribe to event notification.
1288950	1295630	So it parses that service description, looks for state variables that have events turned on,
1295630	1300290	and then it will build a request for you that you can generate a subscribe request
1300850	1307950	to subscribe to those state variables. I also added an option to specify the single device
1307950	1314230	description. So instead of searching your network, you can specify a remote service description.
1314290	1318750	Searching only works on your local network because you're broadcasting to an address
1318750	1323070	within your local network. So only devices within that local network are going to work.
1323250	1328850	But if you go on Shodan, there's a lot of UPnP devices on Shodan that are exposed to the internet.
1328850	1332930	If you want to play with those, now you can because you can paste that service description
1332930	1339930	into there directly and load that and get all the actions. I also added some little buttons
1339930	1345330	so you can view, pull up the service description and SCDP files directly from the tool.
1345370	1349690	That was kind of more of a convenience for me as I was debugging and trying to figure out
1349690	1354170	why things weren't working. To easily get to the device description and those files
1354170	1361950	made it a little bit easier to see what I'm looking at. And now it's demo time. So we'll go through
1361950	1371410	that tool and show you what it actually does. So UPnP Hunter 2.0. Right now it is not available
1371410	1376810	in the Burp App Store. I do plan to push it to the Burp App Store at some point later.
1376810	1382270	I first wanted to wait and give the original author a chance to pull in some of the changes
1382270	1389190	that I pushed and maybe update the tool from there. He doesn't seem to have the interest
1389190	1395610	to do that. So I will push this as a separate standalone version. So this is the tool. This
1395610	1400370	is what it looks like in the Burp tab. And I'm just going to go ahead and start a discovery
1400370	1405350	on my network. And this will take a few minutes. Because as I said, it's running the
1407350	1412170	mSearch, reading back all the responses and then parsing out. So on this network,
1412170	1418050	I have two devices that are running UPnP. This is the ACES router as we saw before.
1418050	1425390	This one is the Belkin WeMo device. And this is the list of all the service endpoints that
1426170	1432150	it understands. And if you look at the different actions, these are all the actions within that
1432150	1437490	service endpoint. So I'll just pull up the SCDP here for a second. And so you can see,
1437490	1441630	you know, action, get device information. That should be in here somewhere. Yeah,
1441630	1446690	get device information. And then once you select it, it pulls up the request,
1446690	1453730	builds out the request in this field here. So you can view it, see what different parameters
1453730	1459670	it takes. And then you can send that straight to Repeater or to Intruder. And you'll see that
1459670	1464470	Repeater picked it up. And now it's here. And I can send this request and get device information
1464470	1473450	from that device. So that's, you know, very basically, that's how it works. So let's show
1473450	1479570	you why this is cool and, you know, what we can do with this. So one of the things that's very
1479570	1487330	easy to do with the Belkin WeMo device is controlling its on and off state. So it's
1487330	1495610	called binary state. So we are going to find the request set binary state. And we can see there's
1495870	1501530	a few different parameters here. And the parameter values are just filled with fuzz here to tell you
1501530	1508070	where you can actually put input. And we'll send that to Repeater. We'll take all this fuzz here
1508070	1519000	stuff out. And the only one that really is needed for most basic operation is the binary state. So
1519000	1525320	I'm going to set the binary state to one, which should be on. And as you see over here, the light
1525320	1532600	flips on and I get a response that now the binary state is on and some other information. And now I
1532600	1538600	can set the binary state back to zero and the light goes off. So very simple, easy control of
1538600	1552860	the device state through UPnP. Let's talk a little bit about event subscription. So in here, you will
1552860	1562100	see a subscribe request. And it again uses a custom HTTP verb, subscribe. This is the path
1562100	1566980	pulled out of the device subscription. And then again, there's a bunch of places where you can
1566980	1574500	fuzz. Here in this section is where you put the parameters that where you want the callback to
1574500	1581180	come to. You can set a timeout for how long you want to get notified of those event changes. And
1581180	1587960	then this is a comma separated list of all the different parameters that this device will give
1587960	1594980	event notifications for. So I already have one of these queued up over here. Let's see.
1595460	1602460	So if everything is still working the way it should, I will get a device subscription,
1602460	1615340	or sorry, event notification here saying the... that is not what I expected. Hang on a sec.
1616420	1623340	Property change. Property state is zero. Okay. Sorry. That is what I expected.
1623860	1631300	Now if I go back to the basic event request and I change the state back to one,
1632060	1638700	now I get another notification coming in on that callback with the binary state is one. So we see
1638700	1645220	the notifications and how they come back. What's interesting about the notifications and what this
1645220	1651320	call stranger vulnerability sort of talks about is you can specify multiple endpoints that this
1651320	1660040	calls back to. One of the neat sort of features of this is that if the first request doesn't... if
1660040	1665900	the first URL doesn't... it can't reach it, it doesn't get a response from it, then it will try
1665900	1672780	the next request, the next IP. So you can actually make use of this to do some internal port scanning
1672780	1680080	of things on the network. If you can access this on the WAN side, for example, you can use this
1680080	1685380	feature, specify a host and a port, and then specify a host and a port that you know it can
1685380	1694900	reach. And if you get the callback coming to your IP address, you know that it wasn't able to connect
1694900	1702460	to the previous one. So that's kind of a fun little thing you can do with the subscribe feature.
1702780	1708960	But really, that's, I guess, sort of the end of my demonstration of this tool. I think it
1708960	1714140	can be really powerful, especially being able to send stuff to intruder and do some fuzzing
1714140	1721620	with this. And I can also show you here that if we just take this device description,
1722160	1727960	paste it in here, then we get just that device descriptions services. We don't get all the
1727960	1732760	other. So you can use that as well to sort of narrow down or look at remote ones, like I said.
1734540	1740780	And I think that is it. So the repository for this is in our GitLab. The link is here.
1741580	1744800	As I said, I do plan on pushing this to the Verp app store
1744800	1749000	at some point in the future, but it's just not there right now.