BALG: Bypassing Application Layer Gateways Using Multi-Staged Encrypted Shellcodes

Sebastian Roschke, Feng Cheng, Christoph Meinel: "BALG: Bypassing Application Layer Gateways Using Multi-Staged Encrypted Shellcodes" in Proceedings of the 12th IFIP/IEEE International Symposium on Integrated Network Management (IM 2011), IEEE Press, Dublin, Ireland, pp. 399-406, 5, 2011. ISBN: 978-1-4244-9219-0. BALG: Bypassing Application Layer Gateways Using Multi-Staged Encrypted Shellcodes Sebastian Roschke Feng Cheng Christoph Meinel Hasso Plattner Institute (HPI) Hasso Plattner Institute (HPI) Hasso Plattner Institute (HPI) University of Potsdam University of Potsdam University of Potsdam 14482, Potsdam, Germany 14482, Potsdam, Germany 14482, Potsdam, Germany Email: [email protected] Email: [email protected] Email: [email protected] Abstract—Modern attacks are using sophisticated and inno- easily penetrated by simple tunneling. IDS needs to handle vative techniques. The utilization of cryptography, self-modified efficient evasion techniques. ALGs provide more restrictions code, and integrated attack frameworks provide more possibili- for network access by combining filtering on the application ties to circumvent most existing perimeter security approaches, such as firewalls and IDS. Even Application Layer Gateways layer and IDS techniques, such as deep packet inspection. (ALG) which enforce the most restrictive network access can be Most of ALG implementations provide filtering due to ap- exploited by using advanced attack techniques. In this paper, plication layer protocol compliance and even allow to block we propose a new attack for circumventing ALGs. By using certain commands within a specific protocol. Although ALGs polymorphic and encrypted shellcode, multiple shellcode stages, enforce a very restrictive access policy, it is still possible to protocol compliant and encrypted shell tunneling, and reverse channel discovery techniques, we are able to effectively bypass circumvent such devices by using modern attack techniques. ALGs. The proposed attack consists of four phases with certain In this paper, we propose a sophisticated attack for circum- requirements and results. We implemented the initial shellcode venting the security measures introduced by ALGs by using as well as the different stages and conducted the practical attack new attacking techniques, such as polymorphic and encrypted using an existing ALG. The possibility to prevent this attack with shellcode, shellcode stages, protocol compliant and encrypted existing approaches is discussed and further research in the area of perimeter security and log management is motivated. shell tunneling, and reverse channel discovery techniques. The proposed attack consists of: Attack Preparation, Attack Execution, Shellcode Execution, and Post-attack Cleanup. As I. INTRODUCTION the major phase of the entire attack process, the Shellcode In the past several years, attacks are becoming more and Execution performs complex tasks: Stage Loading, Channel more sophisticated and intelligent. Many newly emerged Discovery, Connect Back through Discovered Channel, and attacks are implemented based on the rapidly developed Reverse Shell Tunneling. Requirements and results of each innovative IT techniques, such as advanced cryptography, phase are analyzed and described. We implemented the ini- self-modified code, and integrated attack frameworks, etc., tial shellcode as well as the different stages and conducted which provides more possibilities to circumvent most avail- the practical attack using an existing ALG. The possibility able perimeter security approaches. Cryptovirology [9] offers to prevent this attack with existing approaches is discussed a convenient way to encrypt malicious content or to put and some further research works, e.g., log management, are backdoors in cryptographic functions. Polymorphic shellcode proposed. provides a way for malicious code to modify itself. It is even The rest of the paper is organized as follows. A short possible to create shellcode that appears as English written overview about the Application Layer Gateway (ALG) is text [13]. Sophisticated but easy-to-use frameworks and tools given in Section II. In Section III, we describe the general are now available, which make it possible even for non- concept of attacking ALGs. Section IV describes the actual professionals to conduct complex attacks, e.g., ettercap for implementation of the attack using generated shellcodes and Man-In-The-Middle (MITM) attacks [1], etc. Furthermore, existing tools. In Section V, a practical attack scenario is many open source software platforms, e.g., metasploit [6], etc., described based on the conceptual idea. After the attack and its have been developed and widely used in the community to help implications is discussed in Section VI, the paper is concluded people easily write their own exploits, customize the existing in Section VII. exploits, as well as compose complex attacks. On the other side, several perimeter security approaches are II. OVERVIEW OF APPLICATION LAYER GATEWAY developed and deployed in practice to secure hosts and net- Application Layer Gateway (ALG), also simply called works, such as firewalls, Intrusion Detection Systems (IDS), application layer proxy, is similar to circuit level gateway and Application Layer Gateways (ALG). Unfortunately, these except that it is application aware. It can filter packets at the approaches are neither effective nor efficient for preventing application layer of TCP/IP, as shown in Figure 1. This means the above mentioned new attack techniques. Firewalls can be it is able to analyze the application data itself and can identify Sebastian Roschke, Feng Cheng, Christoph Meinel: "BALG: Bypassing Application Layer Gateways Using Multi-Staged Encrypted Shellcodes" in Proceedings of the 12th IFIP/IEEE International Symposium on Integrated Network Management (IM 2011), IEEE Press, Dublin, Ireland, pp. 399-406, 5, 2011. ISBN: 978-1-4244-9219-0. Figure 1. Principle: Application Layer Gateway malformed application layer data or suspect application com- we propose a new attack which targets at the basic principle mands. Furthermore, ALG can identify if a certain packet is of the ALG. It can be assumed that the ALG, which we will part of the application protocol that should be used through this discuss in the following, is perfectly designed, implemented proxy. ALGs prevent the connection-based tunneling of non and deployed. desired application protocols, because the proxy will identify that this is not the intended protocol that is allowed to pass III. A GENERIC ATTACK FOR BYPASSING ALGS through. In plain terms, an ALG that is configured to be a web A practical attack ofen has a set of preconditions, e.g., proxy will not allow any ftp, gopher, telnet or other traffic knowledge on the target environment, an existing vulnerability, through, unless it is disguised as such traffic. Because they and a way to store shellcode stages. Although we realized the examine packets at application layer, they can filter application attack mostly relies on specific vulnerabilities in an existing specific commands. This can not be accomplished with either environment, the attack can be generalized to a certain extend, packet filtering or circuit level firewalls, which both do not as it is possible to use different vulnerable programs for the know anything about the application layer information. Service initial exploit and various communication channels that may specific packets, incoming or outgoing, can not pass unless exist. Besides the general attack we describe in this paper, there is a related proxy. ALGs can also be used to log user there are multiple techniques to improve the attack by hiding activities, such as logins. They offer a high level of security, the established communication channels or deceiving security but have a significant impact on connectivity and performance. measurements, such as Intrusion Detection Systems (IDS). This is because of context switches that slow down network Figure 2 shows a basic standard scenario for such kinds of access dramatically. They are not transparent to end users and attack. The attacker is located in the external network, which require additional configuration of each client computer. Some is separated from the internal network by an Application known ALG implementation includes Microsoft Forefront Layer Gateway (ALG). The users in the internal and external United Access Gateway (UAG) [21], Siemens Lock-Keeper network are working with specific software and have access [16], or Balabit Zorp GPL [19], etc. to servers providing specific application, e.g., file transfer Since some malicious data can only be recognized when or mail transfer. The ALG supports only a limited set of they are in the form of application layer data, e.g., web application layer protocols and blocks all protocols it is not page script, file, E-Mail, etc., the Application Layer Gateway aware of. In this case, all communication between the internal technology, which is capable of understanding the protocol and external network needs to follow certain rules and to be used by the specific applications that it supports, significantly standard compliant, i.e., generic TCP/UDP communication is improves the security of the protected targets by preventing not supported. the attacks hiding in the application layer. Furthermore, Anti- Similarly, to successfully attack the ALG, there should be Virus Software, which usually works on the application layer, several preconditions fulfilled. The first precondition

Load more