As part of a penetration test I was recently looking for a covert way of
transmitting a binary out of a target network. This network did not
allow DNS resolution by internal clients, only the perimeter proxies; as
such DNS tunneling was not an option.
While 'pur sang' HTTP tunneling would have worked, the actual data being
trafficked is usually stored in the URI request string (either using a
GET or POST request). This was a bit of an issue as I knew these were
being logged. It would be preferred if the audit team investigating
afterwards would not be able to identify the exact data that was moved out.
While looking for alternatives, I decided to use the entity tag
functionality in HTTP/1.1. This tag is used bidirectionally between a
header called "ETag" on the server side, and "If-None-Match" (and some
related ones) on the client side. By encoding data (using Base64) into
this header it is possible to move data in a covert manner in and out of
the network. Most other headers are used only in a single direction or
have a very specific format (Basic-Authentication or Content-MD5, for
example).
By combining this with partial downloads using Byte-range and 206
headers, randomizing filenames in the request (using a dictionary) and
actual files containing semi-random content being returned, this can be
made to look very innocuous in the proxy's logs.
In the end this may be a good idea if you're looking for an original and
more obscure way of sending data out. While it is not a supported tool,
I wrote a couple of lines of Perl code that show how, in its most basic
form, this could work. It doesn't maintain protocol and has a lot of
drawbacks, so please don't consider it a production tool. It did get the
job done in my situation, and may give you some ideas.
More information at: http://www.daemon.be/maarten/etagtunnel.html
Cheers,
Maarten
--
Maarten Van Horenbeeck, CISSP GCIA GCIH
maarten@daemon.be - http://www.daemon.be/maarten
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com for details.
------------------------------------------------------------------------------
