Written & Presented by Darren Fuller SecQuest Information Security Ltd.

Transcription

1 SecQuest INFORMATION SECURITY 44Con 2012: Toppling Domino Testing security in a Lotus Notes environment Written & Presented by Darren Fuller SecQuest Information Security Ltd.

2 About this Presentation This presentation was originally given at 44Con 2012 in London and had a number of interactive demos which obviously cannot be included. If you or your company would like further information about Domino security or to arrange a re-run of this talk on your premises please contact us. Tel:

3 Who Am I? Darren Fuller Lotus PCLP * Security Consultant Ex IBM Notes developer Ex IBM EMEA X-Force Run a company called SecQuest Been using Notes since V3 on IBM OS/2 * Domino R5

4 What I m Talking About Today Although there have been a number of technical papers published by different researchers covering Lotus Notes/Domino security it is rarely covered by the wider pen testing community. In this presentation I ll aim to give a general overview of Domino security and demonstrate ways of breaking in. This will cover security issues from the point of view of the web server, native Domino server and demonstrate some tricks you can use from the client side of things.

5 Typical! Nothing about Notes/Domino for a while then William Dawson talked about it at BSides Vegas this year! Interesting talk about Domino hashes which we ll cover in a bit of detail later Link to talks:

6 Used By More than half of Fortune 100 companies & more

7 Lotus Notes/Domino: History Created by Ray Ozzie/Iris Associates V1 Shipped in 1989 Included public key cryptography 3 major editions available in the early days V8.5.4 is currently in beta

8 Crypto Background Information US Edition used 64 bit keys International keys restricted to 40 bits due to US export rules before 1997 Deal with US.gov to allow 64 bit international keys after 1997 providing they had the first 24 bits France didn t like this! A French edition was made with 40 bit encryption keys These days 128 and 256 bit AES can be used

9 Security Overview ID Files Database ACL (Access control list) Execution Control List (ECL) NAB Groups

10 Security Overview Encryption Layers Database Encryption Document Encryption Field Encryption Transport Layer Encryption

11 C mon! We re h4x0rs.. Can we whack it?

12 Yes we Can! Examples given in this presentation are based on real world tests. These techniques have been used a number of times to compromise various client sites. Obviously root is nice but the data is the thing to go for, the right Notes user will give you the keys to the kingdom!

13 Breaking In Externally What to look for names.nsf database with anonymous access domlog.nsf with anonymous access webadmin.nsf (you ll be lucky!)

14 Checking out the /hacker Domain Anonymous access to domlog.nsf can give you a session ID, these default to 30 minute expiry

15 NAB Access!

16 Because.. The admins have messed up and granted anonymous reader access

17 HTTPPassword in Document Source Vulnerability documented in 2005 Still overlooked by a lot of admins

18 HTTPPassword in Document Source <input name="fullname" type="hidden" value="milexa Crozzd/hacker; Milexa Crozzd"> <input name="shortname" type="hidden" value="milexa"> <input name="httppassword" type="hidden" value="(gbzjmlbtihzbxts0tcil)"> <input name="dsphttppassword" type="hidden" value="(gbzjmlbtihzbxts0tcil)"> Metasploit can automate hash gathering

19 Cracking Passwords Grab password hashes from the document source Domino has two types of password hashes for internet passwords; normal and more secure Use JTR with Jumbo Patch normal = lotus5 more secure = dominosec

20 Cracking Passwords: results

21 Targeting Interesting Users Once you have cracked some passwords you should be able to authenticate and access catalog.nsf If internet authentication is set to Fewer name variations with higher security you need to use the full canonical username: Joe King/hacker catalog.nsf contains a list of all databases on the server + access control information The By Name view will give you a list of databases your user can access

22 Targeting Interesting Users

23 Access Control List Info

24 Check group members in names.nsf JTR popped this one earlier!

25 Getting More Access Running Commands webadmin.nsf allows an administrator to run server commands.

26 Getting More Access You can run O/S commands using load but can t see the results when using quick console. For some reason writing output to a web accessible directory didn t work on Linux Solution: upload a Notes database shell!

27 Introducing shell.nsf aka D99Shell You may get a certificate error after uploading..

28 D99Shell in action!

29 Also works on Windows servers

30 Demo: Breaking In! Oh Noez! U R demoin dis live!?!

31 Breaking in from the Inside - Objectives Find ID files on the network Crack passwords Get in to the NAB on the server Find ID files with higher levels of access Pw0nage!

32 Are Employees the Biggest Threat? Many breaches of security are done by insiders - Katherine Spanbauer, Domino senior product manager

33 Gaining A Toehold Since R5 you need an ID file to access the client ID file needs to be valid and not in a deny access group in the NAB. Shared directories FTW!

34 Gaining A Toehold It used to be hard to crack native Notes passwords! There are a number of products available to crack ID file passwords Huge thanks to Nataly at Passware * for the software being used in the following demo.. *

35 Demo: Notes ID Password Cracking I can haz beerz after, right?

36 We re going after the payroll Our freshly cracked ID file gives catalog.nsf & names.nsf access

37 Check the NAB (names.nsf) for group members Oops!

38 The result..

39 Client-side Tricks Spoofing mail.. Removing restrictions of local access LotusScript can access the Windows API! Declare Function GetClipboardData Lib "User32" (Byval wformat As Long) As Long

40 Mail spoofing; getting a payrise! SMTP mail can be easily spoofed using telnet but document properties are a dead giveaway

41 The Spoof Memo Form This is all that is required:

42 The result Create a new mail using the evil form and copy/paste it in to the mail.box database on the spoofed user s server The only giveaway.. Looks Good..

43 Local Access Protection Lotus Notes has an ACL setting to Enforce consistent ACL Opening a protected database locally gives an error like this: Not this ->

44 I Can t Access It Locally Eh! There are companies out there selling various unlock solutions Prices for software range from $49 to $657!! I ve tested a few versions of these life saving products.. One of them changed 4 bytes, another changed 6!

45 I Can t Access It Locally Eh! I mentioned to IBM in 2004 that you could change 1 byte to remove protection These apps are doing 75% too much work! Sorry guys, the secret s out: Changing 0x000002C4 from 20 to 00 could save $700!

46 Tool release Local Access Protection Deprotector And No Cash Expected

47 Tool release: lapdance Local Access Protection Deprotector And No Cash Expected (lapdance.pl) Written in Perl (badly), gives some info about the database and can add and remove protection Available from

48 Tool release: lapdance Local Access Protection Deprotector And No Cash Expected (lapdance.pl) Support for ODS versions 16, 17, 20, 41, 43, 48 and 51 (ie. everything from V2 to V8.5) Will display database protection and encryption flags information Can add and remove local access protection

49 Demo: Removing Database Protection! Ohalp! Prayrz 2 Ceilin Cat dat dis workz!

50 To Finish.. In this presentation I ll aim to give a general overview of Domino security and demonstrate ways of breaking in. This will cover security issues from the point of view of the web server, native Domino server and demonstrate some tricks you can use from the client side of things.

51