h4ck/cujo

CUJO

• device
• digging
  • nmap
  • sniffing
• impersonating
  • phone home

TV

name	value
model	TODO
product	TODO
firmware	TODO
features	TODO
vulnerabilities	all phone-home calls are done over HTTP

digging

nmap

from nmap -PN -p 1-65535 -sV <device>, we get:

Nmap scan report for <device>
Host is up (0.0016s latency).
All 65535 scanned ports on <device> are closed

Nmap done: 1 IP address (1 host up) scanned in 321.80 seconds

so.. no open ports. let's try something different

sniffing

watching the network activity of the device (192.168.1.108), noticed it tried to resolve:

• agent.cujo.io
• jenkins.getcujo.com

but since the network isn't allowing external traffic, the DNS resolution fails.

the device continues to retry this, but takes no other action.

using dnsmasq, spoof these addresses to something under out control (192.168.1.106), and now we see:

Frame 125229: 74 bytes on wire (592 bits), 74 bytes captured (592 bits)
Ethernet II, Src: 192.168.1.108 (cc:d3:1e:d0:20:67), Dst: 192.168.1.106 (f4:0f:24:04:2e:8f)
Internet Protocol Version 4, Src: 192.168.1.108 (192.168.1.108), Dst: agent.cujo.io (192.168.1.106)
Transmission Control Protocol, Src Port: 53455 (53455), Dst Port: 9443 (9443), Seq: 0, Len: 0
    Source Port: 53455
    Destination Port: 9443
    [Stream index: 14]
    [TCP Segment Len: 0]
    Sequence number: 0    (relative sequence number)
    Acknowledgment number: 0
    Header Length: 40 bytes
    Flags: 0x002 (SYN)
    Window size value: 14600
    [Calculated window size: 14600]
    Checksum: 0xaf14 [validation disabled]
    Urgent pointer: 0
    Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
        Maximum segment size: 1460 bytes
            Kind: Maximum Segment Size (2)
            Length: 4
            MSS Value: 1460
        TCP SACK Permitted Option: True
        Timestamps: TSval 51225, TSecr 0
        No-Operation (NOP)
        Window scale: 5 (multiply by 32)

now we can see it is making some empty TCP request to 9443

impersonating

phone home

standing up a webserver on 9443, we start to see traffic:

\x16\x03\x01\x02\x00\x01\x00\x01\xfc\x03\x03\xa1\xe1\x9d\x08\x88]*\xce\xe7G

\x16\x03\x01\x02\x00\x01\x00\x01\xfc\x03\x03Gg\xed\xa3m\x02\x88\xbd\xf0\xd1\x1eS\xf0\xfbc\xfb\x80K\x8dD\xed\xfb\x9b\x8c\xa0\xb2\xc6C\xc8\x15\x86\xbb\x00\x00\xa0\xc00\xc0,\xc0(\xc0$\xc0\x14\xc0

requests starting with \x16\x03\x01 are almost certainly HTTPS requests coming over HTTP, so try to forge a usable cert:

$ openssl req -x509 -newkey rsa:2048 -keyout agents.cujo.io.pem -out agents.cujo.io.pem -days 365 -nodes
Generating a 2048 bit RSA private key
........................................................................................+++
..........................................................................................................+++
writing new private key to 'agents.cujo.io.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:California
Locality Name (eg, city) []:Los Angeles
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CUJO
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:agent.cujo.io
Email Address []:

$ openssl x509 -text -in agents.cujo.io.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e6:5b:e3:de:c4:4f:13:7e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=California, L=Los Angeles, O=CUJO, CN=agent.cujo.io
        Validity
            Not Before: Nov 29 01:38:50 2016 GMT
            Not After : Nov 29 01:38:50 2017 GMT
        Subject: C=US, ST=California, L=Los Angeles, O=CUJO, CN=agent.cujo.io
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                ...
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                B2:33:5E:3A:3D:6E:B8:DC:D8:19:89:A2:B5:67:1C:99:B1:B0:2F:2F
            X509v3 Authority Key Identifier:
                keyid:...
                DirName:/C=US/ST=California/L=Los Angeles/O=CUJO/CN=agent.cujo.io
                serial:...

            X509v3 Basic Constraints:
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
        ...
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----