HackFest Series: RouterControl

RouterControl is a new take on the old browser based attack that
tricks the user into allowing exploits of saved passwords to access
another site; in this case the "router".

Kaminisky demonstrated the specific RouterControl feature at RSA in
October 08.

Various RouterControl attacks also use CSRF to own the router by
repointing DNS to hostile servers so MITM attacks or DNS redirection
can be easily created.

http://ha.ckers.org/blog/20090120/persistent-cookies-and-dns-rebinding-redux/

Of course, as evidenced below, they could also give the router
additional open ports and DMZ or whatever they liked and the poor
private property owner would just see strange packet traffic and
usually (due to lack of training with regards to security) never
notice what is occurring, while being watched, tested, and essentially
stalked in a strange cat/mouse game.

Another wireless RouterControl goal would include loading Linux
powered firmware that would attack nearby APs using brute-force
password guessing techniques after association; of course this becomes
less trivial if the AP is running WPA/WPA2. That would be more
"wormlike". Essentially, own a device with CSRF and use it to own
nearby APs.
--
In the current successful example version of this "hack", you would
find the following access history in your browser to your local router
at say 192.168.1.1 for linux.js (which is a file not included in the
firmware, ahem!).

# linux.js

var DEBUG = false; // false for release


var separator = "\t"; // used for string=> multiple select list

// ====================================================== Submit Functions

function radioTable(fObj,radioObj,act_str)
{
    if (radioSelectedIndex(radioObj) > -1)
            stdAction(fObj,act_str);
    else alert("No entry selected. \nClick a radio button to select an entry.");
}

function stdAction(fObj,act_str)
{
    fObj.todo.value = act_str;
    dataToHidden(fObj);
    //submitDemo(fObj);
        fObj.submit();
}

//========================================================= Data
Transfer Functions

function optionSelected(sel_obj) // return true or false
{
    return (sel_obj.selectedIndex > -1 && sel_obj.selectedIndex <
sel_obj.options.length) ? true : false;
}

function getSelIndex(sel_object, sel_text)
{
    if (sel_text.length == 0)
        return 0;
    var size = sel_object.options.length;
    for (var i = 0; i < size; i++)
    {
        if (sel_object.options[i].value == sel_text)
            return(i);
    }
    for (var i = 0; i < size; i++)
    {
        if (sel_object.options[i].text == sel_text)
            return (i);
    }
    if (DEBUG)
        alert("DEBUG: " + sel_object.name + " (Select List) has invalid
value " + sel_text + "  Selecting 1st item instead");
    return 0;  // if no match
}

function getSelected(sel_obj)  // single select. Returns value. If
value blank, return text
{
    var index = sel_obj.selectedIndex;
    if (index >= 0)
        return (sel_obj.options[index].value != "") ?
sel_obj.options[index].value : sel_obj.options[index].text;
    else return "";
}

function getMultiSelected(sel_obj)  // multi select. Always use text, not value
{
    var size = sel_obj.options.length;
    var i;
    var str = "";
    if(isNaN(size))
        return str;
    if(size == 0)
        return str;
    str = separator;
    for(i = 0; i < size; i++)
        if (sel_obj.options[i].selected)
            str+= sel_obj.options[i].text + separator;
    return str;
}

function setSelected(sel_obj,list) // list has multiple items from select obj
{
    var selSize = sel_obj.options.length;
    var startTextPos;      var startValuePos;
    var textChar;             var valueChar;
    for ( var i =0 ; i < selSize; i++)
    {
        startTextPos = -1;
        startValuePos = -1;
        sel_obj.options[i].selected = false;
        startTextPos = list.indexOf(separator + sel_obj.options[i].text + separator);
        if(sel_obj.options[i].value.length > 0)
            startValuePos = list.indexOf(separator + sel_obj.options[i].value +
separator);
        if (startTextPos > -1)
            sel_obj.options[i].selected = true;
        if (startValuePos > -1)
            sel_obj.options[i].selected = true;
    }
}

function radioSelectedIndex(radio_object) // index of selected item, -1 if none
{
    if (!radio_object)
        return -1;
    var size = radio_object.length;
    if(isNaN(size))
    {
        if(radio_object.checked == true)
            return 0;
        else
            return -1;
    }
    for (var i = 0; i < size; i++)
    {
        if(!(radio_object[i]))
            return (radio_object.checked) ? 0 : -1;
        if (radio_object[i].checked)
            return(i);
    }
    if(radio_object.checked == true)
        return 0;
    else
        return -1;
}

function getRadioCheckedValue(radio_object)   // value of selected
item, "" if none
{
    var index = 0;
    if (!radio_object)
        return "";
    var size = radio_object.length;
    if(isNaN(size))
    {
        if (radio_object.checked == true)
            return radio_object.value;
        else
            return "";
    }
    for (var i = 0; i < size; i++)
    {
        if(!(radio_object[i]))
            continue;
        if (radio_object[i].checked == true)
            return(radio_object[i].value);
    }
    if (radio_object.checked == true)
        return radio_object.value;
    else
        return "";
}

function getRadioIndex(radio_object, checked_value)  // find index
matching checkecd_value, 0 if no match
{
    if (!radio_object)
        return 0;
    if(radio_object.value == checked_value)
        return 0;
    var size = radio_object.length;
    if(isNaN(size))
        return 0;
    for (var i = 0; i < size; i++)
    {
        if(!(radio_object[i]))
            continue;
        if (radio_object[i].value == checked_value)
            return  i;
    }
    if (DEBUG)
        alert("DEBUG: " + radio_object.name + " (Radio button) has invalid
value " + checked_value + "  Selecting 1st item instead");
    return  0;   // if no match
}

function getvalue(field_obj)
{
    var field_type = field_obj.type;
    if (field_type == "text" || field_type == "password" || field_type ==
"hidden" || field_type == "textarea")
        return field_obj.value;
    else if (field_type == "select-one")
        return getSelected(field_obj);
    else if (field_type == "select-multiple")
        return getMultiSelected(field_obj);
    else if (field_type  == "checkbox")
        return (field_obj.checked) ? "enable" : "disable" ;
    else if (field_type  == "radio")
        return getRadioCheckedValue(field_obj);
    else if (field_obj.length > 0 ) // must be radio, but type shows as undefined
        return getRadioCheckedValue(field_obj);
    else
        return field_obj.value;
}

function net_mask_test(net_mask,lan_ipaddr,wan1,wan2,wan3,wan4)
{    
    var lan_all;
    var lan_len;
    var lan_tmp;
    var mask_all;
    var mask_len;
    var mask_tmp;

    

    lan_all=lan_ipaddr.value;
    mask_all=net_mask.value;    

    

    //ip1
    mask_len=mask_all.length;
    mask_tmp=mask_all.indexOf(".");
    lan_len=lan_all.length;
    lan_tmp=lan_all.indexOf(".");
    if( (mask_all.substring(0,mask_tmp) & wan1.value) !=
(mask_all.substring(0,mask_tmp) & lan_all.substring(0,lan_tmp)) )
    return 0;

    //ip2
    mask_all=mask_all.substring(mask_tmp+1,mask_len);
    mask_len=mask_all.length;
    mask_tmp=mask_all.indexOf(".");
    lan_all=lan_all.substring(lan_tmp+1,lan_len);
    lan_len=lan_all.length;
    lan_tmp=lan_all.indexOf(".");
    if( (mask_all.substring(0,mask_tmp) & wan2.value) !=
(mask_all.substring(0,mask_tmp) & lan_all.substring(0,lan_tmp))  )
    return 0;

    

     //ip3
    mask_all=mask_all.substring(mask_tmp+1,mask_len);
    mask_len=mask_all.length;
    mask_tmp=mask_all.indexOf(".");
    lan_all=lan_all.substring(lan_tmp+1,lan_len);
    lan_len=lan_all.length;
    lan_tmp=lan_all.indexOf(".");
    if( (mask_all.substring(0,mask_tmp) & wan3.value) !=
(mask_all.substring(0,mask_tmp) & lan_all.substring(0,lan_tmp))  )
    return 0;

    //ip4
    mask_all=mask_all.substring(mask_tmp+1,mask_len);
    lan_all=lan_all.substring(lan_tmp+1,lan_len);
    if( (mask_all & wan4.value) != (mask_all & lan_all) )
    return 0;
    else
    return 1;

}

function ip1to4(ipaddr,ip1,ip2,ip3,ip4)
{
//  alert("name: " + ipaddr.name);
    var len;
    var tmp;
    var all;
    all=ipaddr.value;

    //ip1
    len=all.length;
    tmp=all.indexOf(".");
    ip1.value=all.substring(0,tmp);

    //ip2
    all=all.substring(tmp+1,len);
    len=all.length;
    tmp=all.indexOf(".");
    ip2.value=all.substring(0,tmp);

    //ip3
    all=all.substring(tmp+1,len);
    len=all.length;
    tmp=all.indexOf(".");
    ip3.value=all.substring(0,tmp);

    //ip4
    all=all.substring(tmp+1,len);
    ip4.value=all;
 }

function ip4to1(ipaddr,ip1,ip2,ip3,ip4)
{
    if (ip1.value.length>0)
        ipaddr.value=ip1.value+"."+ip2.value+"."+ip3.value+"."+ip4.value;
    else
        ipaddr.value="";
}

function mac1to6(macaddr,mac1,mac2,mac3,mac4,mac5,mac6)
{

    var len;
    var tmp;
    var all;
    all=macaddr.value;

    //mac1
    len=all.length;
    tmp=all.indexOf(":");
    mac1.value=all.substring(0,tmp);

    //mac2
    all=all.substring(tmp+1,len);
    len=all.length;
    tmp=all.indexOf(":");
    mac2.value=all.substring(0,tmp);

    //mac3
    all=all.substring(tmp+1,len);
    len=all.length;
    tmp=all.indexOf(":");
    mac3.value=all.substring(0,tmp);

        //mac4
    all=all.substring(tmp+1,len);
    len=all.length;
    tmp=all.indexOf(":");
    mac4.value=all.substring(0,tmp);

    //mac5
    all=all.substring(tmp+1,len);
    len=all.length;
    tmp=all.indexOf(":");
    mac5.value=all.substring(0,tmp);

    //mac6
    all=all.substring(tmp+1,len);
    mac6.value=all;
 }

function mac6to1(macaddr,mac1,mac2,mac3,mac4,mac5,mac6)
{
    if (mac1.value.length>0)
        macaddr.value=mac1.value+":"+mac2.value+":"+mac3.value+":"+mac4.value+":"+mac5.value+":"+mac6.value;
    else
        macaddr.value="";
}

function dataToVisible(form_obj)  // both hidden & visible fields in same form
{
    var form_size = form_obj.elements.length;
    var sourceField;     var last_name;      var radioIndex;  var baseRef;

    for (var i = 0; i < form_size; i++)
    {
         if (form_obj.elements[i].name.substr(0,3)=="c4_")
         {
            baseRef = "form_obj." + form_obj.elements[i].name.substr(3);
             ip1to4(form_obj.elements[i], eval(baseRef+"1"), eval(baseRef+"2"),
eval(baseRef+"3"), eval(baseRef+"4"));
        }

        if (form_obj.elements[i].name.substr(0,3)=="c6_")
         {
            baseRef = "form_obj." + form_obj.elements[i].name.substr(3);
             mac1to6(form_obj.elements[i], eval(baseRef+"1"),
eval(baseRef+"2"), eval(baseRef+"3"), eval(baseRef+"4"),
eval(baseRef+"5"), eval(baseRef+"6"));
        }

        sourceField = eval("form_obj.h_" + form_obj.elements[i].name);
        if(!(sourceField))
            continue;
        if(sourceField.value == "")
            continue;
        if (form_obj.elements[i].type=="select-one")
            form_obj.elements[i].selectedIndex =
getSelIndex(form_obj.elements[i], sourceField.value);
        if (form_obj.elements[i].type=="select-multiple")
            setSelected(form_obj.elements[i],sourceField.value);
        if (form_obj.elements[i].type == "checkbox")
            form_obj.elements[i].checked = (sourceField.value == "enable");
        if (form_obj.elements[i].type == "radio")
        {
            if (last_name == form_obj.elements[i].name)
                continue; // already done this one
            last_name = form_obj.elements[i].name;
            radioIndex =
getRadioIndex(form_obj.elements[form_obj.elements[i].name],sourceField.value);
            if(form_obj.elements[form_obj.elements[i].name][radioIndex])
                form_obj.elements[form_obj.elements[i].name][radioIndex].checked = true;
            else
                form_obj.elements[form_obj.elements[i].name].checked = true;
        }
    }
}

function dataToHidden(form_obj)  // both hidden & visible fields in same form
{
    var form_size = form_obj.elements.length;
    var destField;     var last_name;      var radioIndex;  var baseRef;

    for (var i = 0; i < form_size; i++)
    {
         if (form_obj.elements[i].name.substr(0,3)=="c4_")
         {
            baseRef = "form_obj." + form_obj.elements[i].name.substr(3);
             ip4to1(form_obj.elements[i], eval(baseRef+"1"), eval(baseRef+"2"),
eval(baseRef+"3"), eval(baseRef+"4"));
        }

        if (form_obj.elements[i].name.substr(0,3)=="c6_")
         {
            baseRef = "form_obj." + form_obj.elements[i].name.substr(3);
             mac6to1(form_obj.elements[i], eval(baseRef+"1"),
eval(baseRef+"2"), eval(baseRef+"3"), eval(baseRef+"4"),
eval(baseRef+"5"), eval(baseRef+"6"));
        }
        destField = eval("form_obj.h_" + form_obj.elements[i].name);
        if(!(destField))
            continue;
        if (form_obj.elements[i].type=="select-one")
            destField.value = getSelected(form_obj.elements[i]);
        if (form_obj.elements[i].type=="select-multiple")
            destField.value = getMultiSelected(form_obj.elements[i]);
        if (form_obj.elements[i].type == "checkbox")
            destField.value = (form_obj.elements[i].checked) ? "enable" : "disable";
        if (form_obj.elements[i].type == "radio")
        {
            if (last_name == form_obj.elements[i].name)
                continue; // already done this one
            last_name = form_obj.elements[i].name;
            destField.value =
getRadioCheckedValue(form_obj.elements[form_obj.elements[i].name]);
        }

    }
}

function ipsAppdataToHidden(form_obj)  // both hidden & visible fields
in same form
{
    var form_size = form_obj.elements.length;
    var index;

    for (var i = 0; i < form_size; i++)
    {
         if (form_obj.elements[i].name.substr(0,7)=="ipsano_" &&
form_obj.elements[i].checked)
         {
             form_obj.ipsano.value += form_obj.elements[i].name.substr(7);
              form_obj.ipsano.value += ",";
              form_obj.ipsano.value += form_obj.elements[i].value ==
"enable" ? "1;" : "0;";

        }

         if (form_obj.elements[i].name.substr(0,6)=="ipsim_" &&
form_obj.elements[i].checked)
         {
             form_obj.ipsim.value += form_obj.elements[i].name.substr(6);
              form_obj.ipsim.value += ",";
              form_obj.ipsim.value += form_obj.elements[i].value == "enable"
? "1;" : "0;";
        }

         if (form_obj.elements[i].name.substr(0,7)=="ipsp2p_" &&
form_obj.elements[i].checked)
         {
             form_obj.ipsp2p.value += form_obj.elements[i].name.substr(7);
              form_obj.ipsp2p.value += ",";
              form_obj.ipsp2p.value += form_obj.elements[i].value ==
"enable" ? "1;" : "0;";
        }
    }
}

// =================================== Development ========================

function show_data(form_obj)
// shows form information - used only for debugging
{
    var form_size = form_obj.elements.length;
    var debug_win =
window.open("","debug","width=540,height=360,menubar=yes,scrollbars=yes,resizable=yes");
    with(debug_win.document)
    {
        open();
        writeln('<html><head><title>Debugging Window</title></head>');
        writeln('<body><h2>Form being submitted</h2>');
        writeln('<p>Form Name: ' + form_obj.name);
        writeln('<br>Form Action: ' + form_obj.action);
        writeln('<br>Form Target: ' + form_obj.target);
        writeln('</p><h3>Form Data</h3><p>Following table shows ALL fields,
even if not submitted.</p>');
        writeln('<p><table border=1><tr bgcolor="#cccccc"><th nowrap>Field
Name</th><th>Type</th><th>Value</th></tr>');
        for (var i = 0; i < form_size; i++)
        {
            writeln('<tr><td nowrap>' + form_obj.elements[i].name + '</td>');
            writeln('<td nowrap>' + form_obj.elements[i].type + '</td>');
            writeln('<td nowrap>');
            if ((form_obj.elements[i].type=="select-one") ||
(form_obj.elements[i].type=="select-multiple"))
                writeln('Selected item: ' +
form_obj.elements[i].options[form_obj.elements[i].selectedIndex].text);
            else
                writeln(form_obj.elements[i].value);
            if ((form_obj.elements[i].type == "radio") && (form_obj.elements[i].checked))
                        write(' (Selected)');
            if ((form_obj.elements[i].type == "checkbox") &&
(form_obj.elements[i].checked))
                    writeln(' (Checked)');
            writeln('</td></tr>');
        }
        writeln('</table></body></html>');
        close();
    }
}

function submitDemo(form_obj)
{
    show_data(form_obj);
}

function writeForm(form_obj)
// shows form information - used for developement
{
    var form_size = form_obj.elements.length;
    var hfieldStr = ""; var hdemoStr = ""; var last_name = "";
    var i; var j;

    var debug_win =
window.open("","form_def","width=680,height=360,menubar=yes,scrollbars=yes,resizable=yes");
    with(debug_win.document)
    {
        open();
        writeln('<html><head><title>Form Definition Window</title></head>');
        writeln('<p>Form Name: ' + form_obj.name);
        writeln('<br>Form Action: ' + form_obj.action);
        writeln('<br>Form Target: ' + form_obj.target);
        writeln('<p>Following table shows checkboxes, radio buttons, selects
fields.</p>\n<pre>');
        for (var i = 0; i < form_size; i++)
        {
            if (form_obj.elements[i].type=="select-one")
            {
                write(form_obj.elements[i].type + " : " +
form_obj.elements[i].name + " &nbsp; ");
                for(j=0; j < form_obj.elements[i].options.length; j++)
                    write(" [" + j + "]" + form_obj.elements[i].options[j].text);
                writeln();
                hfieldStr += '\n<input type="hidden" name="h_' +
form_obj.elements[i].name + '" value="@'+ form_obj.elements[i].name +
'#">';
                hdemoStr += '\n<input type="hidden" name="h_' +
form_obj.elements[i].name + '" value="' +
form_obj.elements[i].options[1].text + '">';
            }

            else if (form_obj.elements[i].type=="select-multiple")
            {
                write(form_obj.elements[i].type + " : " +
form_obj.elements[i].name + "   ");
                for(j=0; j < form_obj.elements[i].options.length; j++)
                    write(" [" + j + "]" + form_obj.elements[i].options[j].text);
                writeln();
                hfieldStr += '\n<input type="hidden" name="h_' +
form_obj.elements[i].name + '" value="@'+ form_obj.elements[i].name +
'#">';
                hdemoStr += '\n<input type="hidden" name="h_' +
form_obj.elements[i].name + '" value="' +
form_obj.elements[i].options[1].value + '">';
            }

            else if (form_obj.elements[i].type == "radio")
            {
                if (last_name == form_obj.elements[i].name)
                    continue; // already done this one
                else
                {
                    last_name = form_obj.elements[i].name;
                    write(form_obj.elements[i].type + " : " +
form_obj.elements[i].name + "   ");
                    for (var j = 0; j <
form_obj.elements[form_obj.elements[i].name].length; j++)
                        write(" [" + j + "]" +
form_obj.elements[form_obj.elements[i].name][j].value);
                    writeln();
                    hfieldStr += '\n<input type="hidden" name="h_' +
form_obj.elements[i].name + '" value="@'+ form_obj.elements[i].name +
'#">';
                    hdemoStr += '\n<input type="hidden" name="h_' +
form_obj.elements[i].name + '" value="' +
form_obj.elements[form_obj.elements[i].name][1].value + '">';
                }
            }

            else if (form_obj.elements[i].type == "checkbox")
            {
                writeln(form_obj.elements[i].type + " : " + form_obj.elements[i].name);
                hfieldStr += '\n<input type="hidden" name="h_' +
form_obj.elements[i].name + '" value="@' + form_obj.elements[i].name +
'#">';
                hdemoStr += '\n<input type="hidden" name="h_' +
form_obj.elements[i].name + '" value="enable">';
            }
            else ;  // no action
        }
        writeln('\n<!-- DemoStart -->' + hdemoStr + '\n<!-- DemoEnd -->');
        writeln('\n<!-- ServerStart\n' + hfieldStr + '\nServerEnd -->');
        writeln('</pre></body></html>');
        close();
    }
}

Of course if you see this file, it does not mean that they were able
to RUN this successfully, but you can be assured that they did write
to your router.

One of the first things you might notice is that your form input
fields are missing or strangely disabled in your router.

There are a great many versions of this exploit. Payload could be
delivered via email, web browsing or URL.

A firmware upgrade will fix the router (temporarily); be sure you DO
NOT save your router user and password after you get finished
rebuilding it all.

And incidently while rebuilding, you might also assume that they now
pwn your browser also. Don't bother to look - it's going to be
proxied via XSS tunnel to someplace like Google.com (you will never
see the cracker):
http://www.obnosis.com/motivatebytruth/hackers.jpg

Might check to see if you have a trillion 127.0.0.1 sessions also?

For great descriptions of router hacking check here:
http://www.gnucitizen.org/projects/router-hacking-challenge/

For description of how to identifiy and mitigate CSRF:

http://labs.securitycompass.com/index.php/2009/05/15/the-true-danger-of-xss-and-csrf/

These are the techniques that the NSA can deploy via trivial scripts
and entrapment; not even seasoned security experts are above this,
there WILL BE a time when you disable Javascript via socially
engineered trust?

(623)239-3392
(503)754-4452 www.obnosis.com
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss