Websense/ISA "Via:" Bypass Redux

discovered by mrhinkydink

PRODUCT: Websense Enterprise

EXPOSURE: Trivial Web Policy Bypass (III)


SYNOPSIS
========

On May 29, 2010 I demonstrated that by adding a "Via:" header to an HTTP request it is possible for a user to completely bypass filtering and monitoring in a Websense Enterprise 6.3.3/Microsoft ISA Server (2004 or 2006) proxy integration environment. This was addressed in Websense Knowledge Base article #5117.

However, anyone familiar with the Via bypass technique would have noticed this remediation was insufficient.


PROOF OF CONCEPT
================

The following works in a Websense Enterprise system using the ISA Server integration product in a Cache Array Routing Protocol (CARP, sometimes referred to as "CRAP") configuration, which requires at least two ISA servers.

Assuming there a two ISA servers configured as per Websense Knowledge Base article #5117, one at IP address 10.10.0.1 and another at 10.10.0.2, perform the following:

I. Install Firefox >= 3.5

II. Configure Firefox to use one of the proxy servers in the CARP array (10.10.0.1).

III. Obtain and install the Modify Headers plug-in by Gareth Hunt

IV. Configure the plug-in to add a valid "Via:" header pointing to the other server in the array.

    Example: "Via: 1.0 10.10.0.2"

V. Browse to a filtered Web site

VI. All content is allowed without monitoring or filtering


PoC RESTRICTIONS
================

All restrictions of the original Via Bypass article apply.

See http://mrhinkydink.blogspot.com/2010/05/websense-633-via-bypass.html

OTHER USES
==========

Limited only by your imagination! You do have an imagination, don't you?

See http://mrhinkydink.blogspot.com/2010/05/websense-633-via-bypass.html


WORK-AROUNDS
============

Install Hotfix 17 provided by Websense.

HISTORY
=======

06/25/2010 - vendor notified

08/13/2010 - vendor releases Hotfix 17

08/18/2010 - PoC published



c. MMX mrhinkydink

Happy Horseshit June 2010

Greetz Dadz & Gradz!

Last night we had a two hour cable TV & RoadRunner outage, oddly not combined with a power outage. I entertained myself watching my MythTV box on the local HD airwaves. There was absolutely nothing on, but I ended up watching Knight Rider and The A Team on the local "Retro TV" station. These are two shows I never watched back when they were on the air (what... 30 years ago?), so it was all fresh to me.

And I realized why I didn't watch a lot of TV back then. It was all crap. Well, that and my TV was usually hooked up to the old Commodore 64 (or the VIC 20) most of the time.

But I must admit those 80s chicks were HAWT as FUCK. Where are they now?

The Websense Hack turned out to be ISA specific, so if it didn't work for you, you're probably not behind an ISA server. Unlike the last time, this was not fixed by a Websense database update, which means your local Network Nazi actually has to do something to fix it. Chances are he won't. And it appears to me that the fix is "iffy" at best. We'll see. More on that soon enough.

The Murder/Suicide Blog has a new look. I'm quite pleased with the way it turned out. I have also mapped out every murder/suicide in 2009 and 2010 with Google Maps, which was one helluva piece of work. Unfortunately, Google limits you to 200 map markers per page, so 2009 takes no less than four pages to display the whole year. Luckily, Google Earth lets you see the whole shebang all at once.

I may redesign the UT99 Blog, but I'm still quite fond of its simplicity.

Back at the Salt Mine, rumors of a new re-org are flying. It turns out my boss, the CSO, is not a very popular guy up and down the food chain. Meh... it goes with the territory. Some suggest he's going to get booted in the coming weeks and the security team will be split up and cast asunder. Oh well, bosses come and go. I've never seen one last more than three years.

Right now I'm taking a few days off from all that madness anyway. Yesterday's Big Event consisted of getting a cyst cut off from my eyelid. It wasn't very large (I'd say 3mm tops), but it was about twice the size it was when I first noticed it. In & out the door in thirty minutes.

Tuesday, it's back to the Old Grind.

Websense 6.3.3 "Via:" Bypass

discovered by mrhinkydink

PRODUCT: Websense Enterprise v6.3.3

EXPOSURE: Trivial Web Policy Bypass


SYNOPSIS
========

By adding a "Via:" header to an HTTP request it is possible for a user to completely bypass filtering and monitoring in a Websense Enterprise 6.3.3/Microsoft ISA Server (2004 or 2006) proxy integration environment.


PROOF OF CONCEPT
================

The following works in a Websense 6.3.3 Enterprise system using the ISA Server integration product and transparent authentication. It is assumed it will work with other proxy integration products, but this has not been tested.

I. Install Firefox >= 3.5

II. Obtain and install the Modify Headers plug-in by Gareth Hunt

III. Configure the plug-in to add a valid "Via:" header to every request

    Example: "Via: 1.1 VIAPROXY"

IV. Browse to a filtered Web site

V. All content is allowed without monitoring

VIDEO PoC!
==========




PoC RESTRICTIONS
================

The Modify Header plug-in does not work with SSL. However, in practice a user could browse to a so-called (by Websense) "Proxy Avoidance" Web site and use the SSL capabilities of the remote proxy.


OTHER USES
==========

Properly configured, a downstream SQUID proxy can send requests to the upstream ISA server and all requests will pass through without blocking or monitoring. No evidence of activity will be logged by Websense. This was in fact how this vulnerability was originally discovered. Considering the simplicity of the attack, the author suspects this bypass technique is already well-known in certain circles.

Also, it is trivial to modify proxy-enabled Linux utilities to leverage this bypass. The author has recompiled (that is, HACKED) OpenVPN, connect-proxy, PuTTY, stunnel, and others to take advantage of this policy bypass.

Obviously, the risk of undetected (by Websense, at least) covert tunnels is high in a vulnerable installation of this product.

Linux platforms using this method in this specific environment will also enjoy bypassing Websense's transparent authentication.


WORK-AROUNDS
============

For this specific installation scenario (Websense 6.3.3 + ISA 2004/6 + transparent authentication), none are known. The following may work:

  * Use Windows Integrated Authentication on the ISA Server

  * Upgrade to Websense 7.x

  * Do not use a proxy integration product


HISTORY
=======

10/09/2009 - vendor notified

05/29/2010 - PoC published



c. MMX mrhinkydink

This Shit Is Killing Me

As you may have realized by now, the glowing reports about all being fine with the kernel upgrade on BOT House were premature.

BH is now choked. It's not taking new connections. Oddly enough the old connections are working fine. Odder still, anything that passes through BH (which, among other things, is the firewall here on DinkNet) is hunky-dory.

In fact I'm passing through BH right now to blog about this happy horseshit.

BH survived the initial upgrade for about 36 hours. When it died Monday morning (when I was absolutely unprepared to do anything about it), everything else on the network was humming along fine. I bounced it and things were, again, fine. Sometime during the day it choked again, but my connections from work to home stayed up. But I could do nothing on BH remotely.

This really pissed me off, but it made me all the more determined to figure out WHAT THE FUCKING FUCK IS WRONG WITH THIS FUCKING BOX.

Monday night when I bounced it again I started to simplify the firewall rules. And I installed conntrackd to do some statistics on the firewall.

Tuesday morning, all was well. I zipped off to work, nearly getting killed in the process (long story - almost got run off the road but I swerved clear and the car that almost hit me hit someone else and they both ended up crashing into the restraining wall), sat down at my desk and at about 10AM everything died again.

Plus, my connection from work went with it. I could not reconnect, but, again, everything going through BH was fine, even new connections. It was starting to look more and more like a firewall issue.

So Tuesday evening I took a closer look at everything. I shut down the proxy server on BH, which left ssh and nfs as the only services on the box (besides UT, that is).

I played a few EXCELLENT rounds of UT on BH (people started hitting it as soon as it was back up) and hit the sack at about 11:30PM.

I woke up the next morning (Wednesday) to find the box fucked again. It appeared everything choked right after midnight.

In fact it was becoming clear that every time it choked, it was at xx:02 AM or PM, which is meaningful since that is when the proxy project box does its all of its dirty work (this particular system continues to crank away while BH is down, BTW).

So I bounced the box, went off to work, and the thing dies once again on the hour of 10AM plus change.

This time around I had set up an alternate, pass-through ssh connection so I don't get locked out like Tuesday. It tunnels through BH directly to the box running EXP IV, which still shows no adverse reaction to the same kernel upgrade (apples to oranges? Same everything except it's a 64bit AMD dual core and BH is a 32bit Intel single core... hmmm...).

So that's where we were at Wednesday. Down.

When I got home Wednesday, I noted the time of the last conntrack log (once again "on the hour"), rebooted, and sat down to generate another 2.6.32 kernel image, which takes about two hours with the Debian make-kpkg tool.

This time around I took out SMP (Symmetrical Multi Processing) and Hyperthreading support (actually, hyperthreading simply disappeared as an option after SMP was removed). It is a single CPU box, after all, but it is a P4 and SMP support never seemed to matter in kernels past. While it was cranking away at the code I hit BH to see how that affected performance of UT, since building the kernel was chewing up most of the CPU cycles. No problems there.

Once the kernel & modules were built and installed, I had to rebuild iptables, ipset, conntrackd support and tools/libs, and reboot one more time.

Now, on Thursday (12/172009), BH has been running for a little less than twelve hours. Whether it will keep running is anyone's guess. I am optimistic that removing SMP was the way to go, since EXP IV, a true multicore system, has had zero problems with this kernel version.

And now I can get back to my other projects, like messing around with the TOO MANY MODS Windows UT99 server (I will be taking requests, so if you have some favorite maps or other UT99 extensions, let me know).

One slightly positive outcome of all this is that I leveraged a private (at the moment) Websense hack to get the pass-through connection back to EXP IV to work through the corporate proxy. It's an extremely small and elegant hack for completely bypassing monitoring and filtering that I've been working on for a few months now. I have contacted Websense but they seem to be ignoring me. It may be a unique flaw in our environment (I suspect it could be the Microsoft ISA servers), but my testing facilities are limited. We have a Websense upgrade scheduled for January and if the hack survives the upgrade I plan on shoving it up Websense's ass.

Or, I may just keep it in my private toolbox.