Black Hat Ethical Hacking
F5 Big-IP Vulnerable to Security-Bypass Bug

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg F5 Big-IP Vulnerable to Security-Bypass BugPost Views: 98
Reading Time: 1 Minute
The KDC-spoofing flaw tracked as CVE-2021-23008 can be used to bypass Kerberos security and sign into the Big-IP Access Policy Manager or admin console.
F5 Networks’ Big-IP Application Delivery Services appliance contains a Key Distribution Center (KDC) spoofing vulnerability, researchers disclosed – which an attacker could use to get past the security measures that protect sensitive workloads.

Specifically, an attacker could exploit the flaw (tracked as CVE-2021-23008) to bypass Kerberos security and sign into the Big-IP Access Policy Manager, according to researchers at Silverfort. Kerberos is a network authentication protocol that’s designed to provide strong authentication for client/server applications by using secret-key cryptography. In some cases, the bug can be used to bypass authentication to the Big-IP admin console as well, they added.

In either case, a cybercriminal could gain unfettered access to Big-IP applications, without having legitimate credentials.

The potential impact could be significant: F5 provides enterprise networking to some of the largest tech companies in the world, including Facebook, Microsoft and Oracle, as well as to a trove of Fortune 500 companies, including some of the world’s biggest financial institutions and ISPs.
See Also: Google Chrome V8 Bug Allows Remote Code-Execution CVE-2021-23008 SpecificsThe vulnerability specifically exists in one of the core software components of the appliance: The Access Policy Manager (APM). It manages and enforces access policies, i.e., making sure all users are authenticated and authorized to use a given application. Silverfort researchers noted that APM is sometimes used to protect access to the Big-IP admin console too.

APM implements Kerberos as an authentication protocol for authentication required by an APM policy, they explained.

“When a user accesses an application through Big-IP, they may be presented with a captive portal and required to enter a username and password,” researchers said, in a blog posting issued on Thursday. “The username and password are verified against Active Directory with the Kerberos protocol to ensure the user is who they claim they are.”

During this process, the user essentially authenticates to the server, which in turn authenticates to the client. To work properly, KDC must also authenticate to the server. KDC is a network service that supplies session tickets and temporary session keys to users and computers within an Active Directory domain.

“Apparently, KDC authentication to the server is often overlooked,” researchers said. “Perhaps because requiring it complicates configuration requirements. However, if the KDC does not authenticate to the server, the security of the protocol is entirely compromised, allowing an attacker that hijacked network traffic to authenticate to Big-IP with any password, even an invalid one.”

F5’s instructions for configuring Active Directory authentication for an access policy do not include this last step.

“When a user attempts to authenticate to an app sitting behind the proxy, the user is challenged to enter a username and password. When the user enters their password, the product uses Kerberos to authenticate to the domain controller (DC). However, APM does not request a service ticket and grants access based on a successful AS_REP.”

Also, F5 allows users to configure an admin username and password, which if were used to authenticate to the DC, prevents the vulnerability. Alas,[...]

___________________________
@hacking_Attack
@Hacking_Video

in F5’s setup, that doesn’t happen.

“However, it is not used for these purposes, but only for the purpose of fetching primary or nested groups, prompting the user for a password change or performing a complexity check or a password reset,” according to Silverfort.

See Also: Offensive Security Tool: ADFSBrute Exploitation ScenariosMaking the attack work requires the attacker to already be within the target’s environment, according to F5’s advisory, issued on Thursday.

“BIG-IP APM AD (Active Directory) authentication can be bypassed using a spoofed AS-REP (Kerberos Authentication Service Response) response sent over a hijacked KDC (Kerberos Key Distribution Center) connection, or from an AD server compromised by an attacker,” the advisory read.

However, initial access may not be that difficult: In March, four critical remote command-execution (RCE) flaws in F5’s BIG-IP and BIG-IQ enterprise networking infrastructure came to light that could allow attackers to take full control over a vulnerable system. A week later, researchers reported mass scanning and exploitation of the bugs.

In any event, Silverfort laid out the steps an attacker can take to spoof a DC to bypass this kind of authentication, assuming the ability to hijack the network communication between Big-IP and the DC:

“We simulated an attack by redirecting the traffic between Big-IP and the KDC (in this case a domain controller) on port 88 (the Kerberos port) to our own Windows Server,” they explained. “We set up a fake domain on the windows server and made sure there is a user with the same [user ID] as the Big-IP administrator in the real domain. We configured that user’s password to be ‘1’ in the fake domain.”

Then, when logging in with the traffic diverted to the fake DC, logging in with the password “1” will work. See Also: Hacking Stories: Xbox UndergroundHow to Prevent F5 Big-IP AttacksF5 has issued an update, which should be applied.

In addition, admins should enable multifactor authentication, Silverfort recommended, and continuously monitor the Kerberos authentication.

“Look for resources that request only AS_REQ,” they said. “If there are no TGS_REQs, it’s a red flag.”

F5 pointed out that the potential for an exploit depends on configuration choices.

“For an APM access policy configured with AD authentication and SSO (single sign-on) agent, if a spoofed credential related to this vulnerability is used, depending how the back-end system validates the authentication token it receives, access will most likely fail,” according to the advisory. “An APM access policy can also be configured for BIG-IP system authentication. A spoofed credential related to this vulnerability for an administrative user through the APM access policy results in local administrative access.”

Admins should also validate that the implementation of Kerberos requires a password or keytab, according to Silverfort: “To validate the DC, you need to use some kind of shared secret. If your solution does not enable configuring a keytab file, or a service account password, the application is surely susceptible to KDC spoofing.”
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Google-Chrome-Browser-1-90x90.jpg Google Chrome V8 Bug Allows Remote Code-Execution1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/apple_logo_store-90x90.jpg Apple Patches Zero-Day MacOS Bug That Can Bypass Anti-Malware Defenses2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/nvidia-90x90.jpg Nvidia Warns: Severe Security Bugs in GPU Driver, vGPU Software3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Telegram_Messagees-90x90.jpg Telegram Platform Abused in ‘ToxicEye’ Malware Campaigns4 days ago
* https://www.blackhatethicalhacking.com/wp-content[...]

___________________________
@hacking_Attack
@Hacking_Video

/uploads/2021/04/Untitled-design-1-4-90x90.png Mount Locker Ransomware Aggressively Changes Up Tactics1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Untitled-design-11-90x90.png Pulse Secure Critical Zero-Day Security Bug Under Active Exploit1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/firefox_patch-90x90.jpg Mozilla Fixes Firefox Flaw That Allowed Spoofing of HTTPS Browser Padlock1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Discord-Nitro-e1618858537976-90x90.png NitroRansomware Asks for Discord Gift Codes, Steals Access Tokens1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Untitled-design-10-90x90.png WordPress could treat Google FloC as a security issue2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Crypto_Mining_Bitcoin-90x90.jpg Attackers Target ProxyLogon Exploit to Install Cryptojacker2 weeks ago
The post F5 Big-IP Vulnerable to Security-Bypass Bug first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

The Hacker News
Here's A New Forum for Cybersecurity Leaders Outside of the Fortune 2000

Perhaps due to the nature of the position, the InfoSec leadership roles tend to be solitary ones. CISOs, or their equivalent decision-makers in organizations without the role, have so many constant drains on their attention – keeping their knowledge fresh, building plans to secure their organizations further – that they often find themselves on an island.
It’s even more challenging for

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Tool List

Bug Bounty Tool List Which are useful for HuntingContinue reading on Medium »
Read more...

hacking: security in practice
The ransomware surge ruining lives. BBC speaks to 2 victim organisations hit with crippling ransomware attacks. New Ransomware Task Force launched to attempt to end the boom.

https://external-preview.redd.it/kbda38_SG_l_i5K9zaFjdXtMlLlwk2jZsJfEJBUGVkI.jpg?width=640&crop=smart&auto=webp&s=5a22794715d5c6d17bd451f1f7c13cdc500aa446 submitted by /u/tides977
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Are any Hak5 tools really worth it?

So, since I was a child I've been obsessed with computers. Learning to build them with my dad was always my favorite thing to do when I was younger. I finally took the step and wanted to take my knowledge even deeper, and took a 6 month Network Engineering program. I've always wanted to be a hacker, and during my program my interest shifted from wanting to build networks to wanting to keep them secure. More specifically, Red Teaming is what interests me as well as hug bounties. I've known about Hak5 for as long as I can remember, but I was never able to purchase any of their tools due to financial reasons.. Well I make a bit more money now than I use to lol, but I was just curious if any of these tools are actually worth it and practical? For example, isn't it possible to achieve the same things that a WiFi pineapple can with just a good wireless adapter and some tools in Linux? Another tool I was interested in was the USB Rubber Ducky, but upon further research I've found that the target machine needs to load drivers which can take up to 60 seconds. Not at all like the 8-15 seconds & pwned advertising. The only other one I'm quite interested in is the Bash Bunny, but it's out of stock.

submitted by /u/quave210
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
detection

When using a linux program, how do you remain anonymous while pentesting?

IS proxy chaining the only way, is there a books or way to study this to get more familiar with this practice or skill set?

submitted by /u/Man_Chi1d
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking bot

https://external-preview.redd.it/vYmq51PBoYcuoGFmzXzhijntWb5-AfdP0oFeBjc9rrY.jpg?width=320&crop=smart&auto=webp&s=d613f3355a64b53aa999aa61af9af134853b673e submitted by /u/FireandFlames2002
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
sat cheat

are there places that people can access the sat packets ahead of time

submitted by /u/Feisty-Ad9710
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Top 5 Extensions For Hackers

https://www.hackingcage.com/2021/04/TOP-5-EXTENSIONS-FOR-HACKER.htmlContinue reading on Medium »
Read more...

Hacking on Medium
Bug Bounty Tool List

https://cdn-images-1.medium.com/max/765/1*e8fGhrKvmK052vDLNqUfug.png
Bug Bounty Tool List Which are useful for Hunting

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 5 Extensions For Hackers

https://cdn-images-1.medium.com/max/1080/1*9KqEXnM0cZ3HNLD4ASVp3Q.jpeg
https://www.hackingcage.com/2021/04/TOP-5-EXTENSIONS-FOR-HACKER.html

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

2FA bypass with burp suit
Join @Hacking_Video

Introduction

Burp has various tools to help make our testing better and faster. In the following scenario we will be using a couple of tools in conjunction with one another to maximize our potential for finding bugs fast.

2FA broken logic



This time it appears we are testing on a blog. Here's what we know:

Your credentials: wiener:peter

Victim's username: carlos

You also have access to the email server to receive your 2FA verification code. (See the email client button)



Let's start by clicking around as we usually do and exploring the application. We should login and as we try this, we notice we need to enter our 2FA code. Let's investigate this flow further.

It seems the most interesting call of this process is a POST to /login2.php where we enter our mfa-code which seems to be our multi factor authentication code. Also notice there is a cookie 'verify' to determine who's MFA code is being checked.



Let's log out of the account and send the POST request to the intruder. Since we can declare who's 2FA code we are checking we might be able to change that username and brute force the 2FA code since it's only a 4 digit code. 

We need to make sure a code is being generated first. To trigger this process we need to send the GET request to /login2.php to the repeater and change that verify parameter to our victim's login.



We will login again and intercept the requests. the first call will go to /login.php, let that one go through to start the 2FA process. as a second call we will send a call to /login2.php, this is to activate the 2FA process.



We can then enter an incorrect 2FA code so we have the request that we need. Let's send this to the repeater.



We are now going to try and brute force the 2FA code. This is only possible because the server checks who's 2FA is being entered by the verify cookie.

We need to change the verify parameter to "carlos" like we did on the GET /login2.php call before and we need to enter a parameter on the 2FA code.



We can do this using the numbers parameter but we have to make sure we set several parameters correctly.



This will ensure that we are always entering 4 digits, at a step of 1 at a time with a min of 0000 and a max of 9999. Now we can start the attack, eventually a response different from the others will come back. 



We can open our request in the browser by right clicking it



Copy that URL, paste it in your browser and suddenly you will be logged in as carlos. This is happening because the login process only serves to trigger the MFA process but we can also trigger that process for anyone else by just changing the verify cookie. Ones we activated the MFA process, we can easily brute force it because there's no rate limit on the server.

In this case it's a 302 status code but it could also have been a different length only or it could even be that all requests give a 302, in that case we can also follow the redirect.



___________________________
@hacking_Attack
@Hacking_Video