The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
None
PR
The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction
None
UI
The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
Low
C
There is some impact on confidentiality, but the attacker either does not gain control of any data, or the information obtained does not have a significant impact on the system or its operations.
Integrity
Low
I
Modification of data is possible, but the attacker does not have control over what can be modified, or the extent of what the attacker can affect is limited. The data modified does not have a direct, serious impact on the system.
Availability
None
A
There is no impact on the availability of the system; the attacker does not have the ability to disrupt access to or use of the system.
Below is a copy: Microsoft IIS UrlScan Module Bypass
#Paper Title: Microsoft IIS UrlScan Module Bypass
#Date: 16 AUG 2017
#Software Link: https://www.iis.net/downloads/microsoft/urlscan
#Author: Steven Kaun (Gh0st)
#Contact: https://twitter.com/AngryMilks
#Website: https://gh0sthacks.blogspot.com/
#Category: WAF Bypass
Gh0st
`oooooooooooooooooooo
.mmmmmmmmmmmmmmmmmmmm
.........-mmmmmmmmmmmmmmmmmmmm..........
hdddddddddmmmmmmmmmmmmmmmmmmmmdddddddddd`
hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm`
sssssdmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmsssso
`mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmd
----:mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmd----.
dddddmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmddddy
dmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmh
dmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmh
dmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmh
dmmmmmmmmmmmmmmssssssssssmmmmmmmmmmyssssssssymmmmmmmmmmmmmmh
dmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmh
````dmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmh`````
shhhhmmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmdhhhhh
hmmmmmmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmmmmmmm
hmmmmmmmmmmmmmmmmmmmoooooooooommmmmmmmmmsoooooooosmmmmmmmmmmmmmmmmmmmm
hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
hmmmmmmmmd::::::::::mmmmmmmmmm::::::::::dmmmmmmmmd::::::::::mmmmmmmmmm
hmmmmmmmmd mmmmmmmmmm` hmmmmmmmmh `mmmmmmmmmm
hmmmmyyyyy----------yyyyyyyyyy----------syyyyyyyys----------yyyyhmmmmm
hmmmm` `mmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmd .mmmmm
hmmmm`````mmmmmmmmmm``````````dmmmmmmmmm.````````.mmmmmmmmmd````-mmmmm
hmmmmyyyyymmmmmmmmmmyyyyyyyyyymmmmmmmmmmyyyyyyyyyymmmmmmmmmmyyyyymmmmm
hmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
hmmmmmmmmmmmmmmmmmmmsssssmmmmmmmmmmmmmmmmmmmmsssssmmmmmmmmmmmmmmmmmmmm
hmmmmmmmmmmmmmmmmmmm .mmmmmmmmmmmmmmmmmmmm .mmmmmmmmmmmmmmmmmmmm
yddddmmmmmmmmmmddddd `dddddmmmmmmmmmmddddd `dddddmmmmmmmmmmddddd
`....dmmmmmmmmm-.... .....dmmmmmmmmm-.... .....dmmmmmmmmh.....
dmmmmmmmmm. dmmmmmmmmm. dmmmmmmmmh
+ooooooooo` +ooooooooo` +oooooooo/
########
Preface
########
Identified after coming up with null for help with bypassing a WAF identified as UrlScan. After identifying that a web application was filtering and essentially dropping most attacks and their associated payloads a delve into how to bypass this was constructed. This is as simple as bypasses can possibly get, but at the same time is unique enough to warrant writing about.
########
Situation
########
We all understand that WAFs are in place to identify and block malicious requests before the reach the application, so in effect I need to figure out exactly what makes it tick or how to make it tick for us. To that regard the development of this came after exhaustive research into UrlScan and trying to see if anyone had run across this in the professional or unethical realm. Well, guess you can figure out how well that went.
Anyways... I've identified the IIS module "UrlScan 3.1" running on a IIS6 machine (Note this can be IIS 7.5, 6, 5, etc.), I've identified that the application is filtering certain characters, but I'm stuck because whatever malicious requests I send get dropped or filtered by UrlScan anyways.
########
Eureka!
########
So after perusing developer forums, Microsoft technical documentation, and various SQLmap documentation and tamper methods I had learned that appending %00 (Null-Byte) can be performed by the tamper script "appendnullbyte". This however refused to work, and the UrlScan module picked it up right away. So what was I supposed to do? Well apparently UrlScan doesn't know how to handle or what to do when the prefix is the nullbyte, and as far as I'm aware there are no SQLmap tamper scripts that would perform this bypass.
So after formatting the sqlmap command with the real value of a parameter I know that this page exists and has dynamic content depending on the "users" integer value
Original Unmodified
http://somesite.com/blog?users=3389
I quickly learn that the appendnullbyte tamper script only modifys the payload like this (note this is just generic payload)
http://somesite.com/blog?users=3389' WAITFOR DELAY '0:0:10'--%00
So after analyzing the responses from the application it seemed like it wouldn't take it at all... However, not all is lost and after performing more research into the matter the solution became apparent after some random dev was complaining about UrlScan filter rule of %00 basically crashing their application. So what I can extrapolate from that is that %00 is a null value (obvious), but more so than that I can deduce that %00 is not only not interpreted by UrlScan, but its completely overlooked because of the null value where it expects something.
Imagine if you will, you are an application looking for a value of anything greater than 0, but then you encounter 0. Would you simply stop interpreting it because to you there is nothing there? Well if you said yes, your in the same boat as UrlScan's logic apparently.
########
The Attack
########
So I've come to the conclusion that UrlScan expects some value to interpret or inspect whether it be in the Url, Url parameter, or POST body. I've also come to understand that if the value is null UrlScan simply ignores it on the basis that there is nothing to inspect, thus giving us the path towards carnage.
So here I am, at the end of the road... Will it work or not?
http://somesite.com/blog?users=3389%00' WAITFOR DELAY '0:0:10'--
IT WORKS! This little null value gave me the ability to perform SQL injection where SQL had failed time and time before.
This also allowed XSS to any arbitrary parameter I wanted...
http://somesite.com/blog?%foobar=%00foo'><script>alert("XSS")</script>
########
Conclusion
########
In the end I've learned the following...
1. UrlScan's logic is flawed in the manner of interpreting null values - Expects 1, but gets 0 and does not continue inspection
2. %00 allows us to bypass UrlScan's logic to perform XSS and SQL injection where it would normally fail
3. %00 filtering within UrlScan breaks applications for whatever reason
4. SQLmap does not have a tamper script with which to bypass UrlScan, only has the ability to append %00 to end of payload where instead requires it be prepended to the payload
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum