Telecom Italia (TIM) - Azure subdomain takeover

Subdomain takeover is a known technique being popular in the latest years with the advent of the cloud providers. At the end of April i was able to takeover timcafe.tim.it subdomain which belongs to Telecom Italia network. 

What is subdomain takeover ? 

Basically, subdomain takeover is the process of hijacking someone else subdomain. Let’s make an example. When a company hosts a website in the cloud let's say contoso.com hosts a web application on a cloud provider, they create a cloud application which has an unique DNS name, for example myapp.cloudprovider.com.

Then, contoso.com wants to reach the web application from one of its subdomains, so they create a Canonical Name Record (CNAME) record on their DNS servers for myapp.contoso.com  that maps one domain name (an alias) to another (the canonical name). In this case myapp.contoso.com is mapped to myapp.cloudprovider.com.

Now if you resolv the domain name, this will be the output:

 myapp.contoso.com CNAME myapp.cloudprovider.com

myapp.cloudprovider.com    A 1.1.1.1

After some time, Contoso company decides to remove the web application from the cloud provider, so they delete the instance but they do not update their DNS servers records. Here comes the subdomain takeover process, because since the cloud app is deleted, anyone can create another cloud app with the same name and hijack Constoso subdomain. So, when someone visits myapp.contoso.com the web application will be always webapp.cloudprovider.com but now it's under someone else's control.

An in depth explaination can be found at the follwing links:

Long story short

Since Telecom Italia have a responsible disclosure program i decided to check if one of tim.it subdomains were vulnerable, so after an enumeration phase i used subjack, which identified that timcafe.tim.it could be vulnerable to hijacking.

Looking at the DNS record with dig highlighted that the subdomain returned a CNAME record pointing to an Azure web application timcafe.azurewebsite.net that wasn't registered anymore. 

Since Microsoft Azure allows anyone with a valid account to create a web application, i've created a new web application named timcafe and after that timcafe.tim.it DNS record will point to the application that i've just created.


Oh, that was easy. Hold on, because if you visit the website a nice "HTTP 404 website not found" message will appear. That happens because after resolving the DNS name, the client performs an HTTP GET request to 52.173.149.254 with a HTTP Host header set to timcafe.tim.it and the Azure webserver doesn't know with which web application is mapped, so it returns an error.

To fix this error, you need to go on "App Service > Settings > Custom domains" and add a custom domain as show in the screenshot below, that maps the incoming name with the web application.


After that, timcafe.tim.it shows the content that i've uploaded to my instace.

Now what ? 

Okay, cool, now i've complete control over a subdomain. What can i do next ? Here is a list of potential attacks that could be performed: 
  • Steal all cookies with *.tim.it scope from users browser set without Secure flag;
  • Check if timcafe.tim.it subdomain is still referenced from another domain. For example, if tim.it loads a JavaScript file from timcafe.tim.it, it is possible to upload a script and potentially execute arbitrary JavaScript code to tim.it visitors;
  • Perform cross domain request to API endpoints which use cookies to keep track of user session;
  • Upload a self-signed SSL certificate and if a user accepts browser warnings, steal also cookies set with the Secure flag.
  • Phishing and spread malware in behalf of telecom italia;
  • Bypass Content-Security-Policy (CSP).
After hijacking the subdomain i've contacted TIM through their responsible disclosure program to inform them about the misconfiguration and after two days the issue was fixed.

Useful links:

Comments

Post a Comment

Popular posts from this blog

Java Exploit Code Obfuscation and Antivirus Bypass/Evasion (CVE-2012-4681)

Image
Why not play a game where we try to make the latest (at time of writing) public java exploit ( CVE-2012-4681 ) undetected by all antivirus and see who will be the last to detect it ?. I think it will be a funny "challenge" because evading antivirus has always his charm. I will not use software obfuscators like proGuard, Allatori, Zelix KlassMaster etc... This because will not be funny. This is not intended to be an analysis or explanation because there are already great post here: http://immunityproducts.blogspot.com.ar/2012/08/java-0day-analysis-cve-2012-4681.html http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html http://www.h-online.com/security/features/The-new-Java-0day-examined-1677789.html Before we start we need to make two considerations: From The Current Web-Delivered Java 0Day :  So while you may see a few links to Virustotal with the inevitable complaining that a scanner is missing a specific chunk of altered code along with innacc
Read more

The Latest Java Exploit with Security Prompt/Warning Bypass (CVE-2013-2423)

Image
From Java SE 7 update 11 oracle has introduced a new security features called  security warning that prompts a window every time an applet request for execution. For example, if we want to execute latest Java SE 7 update 17 exploit we get this warning. Yesterday Immunity has published a blog post explaining a new vulnerability they have found into the java validating mechanism which allow to execute an untrusted applet without showing the warning. For in-dept details read their blog post here . Briefly, to bypass the above prompt you must call the applet with the parameter __applet_ssv_validated set to true. The only way to manipulate this parameter is to use a java Network Launch Protocol file. Regarding to oracle there are two ways to use JNLP in a page: With the applet tag  With javascript only Let's try first the example with the tag applet. The code we're going to run is the latest publicly available java exploit CVE-2013-2423 .  import java.applet.
Read more

Deobfuscating Java 7u11 Exploit from Cool Exploit Kit (CVE-2013-0431)

Image
At the beginning of the past week @EKWatcher  has spotted Cool Exploit Kit using Java 7 update 11 vulnerability (CVE-2013-0431). This vulnerability was already reported by Security Explorations on seclist few days after Oracle issued update 11. I decided take a look at it. I found a website infected by Cool EK that after a successfull exploitation dropped Reveton into " C:\Documents and Settings\<usarname>\Application Data " folder on Windows XP. The applet used by Cool EK was named would-blood.jar and once opened with JD-GUI the result was this. As you can see it's obfuscated, not heavily but obfuscated. The first thing to do when you want to start deobfuscating an applet is to find the init() function which is the "starting point" and cannot be changed. Remember that for serialized applets the starting point is a function called start() instead of init(). The init function is inside  hw class. It's immediately evident that al
Read more