Nicholas Starke nstarke

SOAP Calls for UPnP Services in WeMo Devices

Note: this write up doesn't contain any vulnerabilties or exploits!

I was recently taking a look at a few WeMo embedded devices. WeMo Devices are IoT contraptions like light switches, space heaters, and coffee machines that are network enabled. I examined the "Holmes Smart Heater". Both had port 41953 open, which is a common port for UPnP services. I decided to dig a little deeper and figure out a way to interact with the SOAP services which UPnP relies on in order to hunt for bugs. My goal was to retrieve sensitive information, such as the WiFi password, from the device.

Using Miranda's MSEARCH (which comes preinstalled on Kali Linux), I was able to discover the setup.xml file for the service I was examining. This file will always be XML, but the actual file name can change. Another way to discover this initial entry point is to examine the network traffic with WireShark. The MSEARCH HTTP requests are easy

Setting up an ARMEL Reverse Engineering / Debug Lab in QEMU

I recently came across a tutorial on ARM Reverse Engineering https://azeria-labs.com/writing-arm-assembly-part-1/.

However, this tutorial seems to recommend using a Raspberry Pi for following along with the tutorial. I decided I wanted to be able to work through the tutorial using a virtual machine, so I built a QEMU VM of the ARMEL architecture. This is the same architecture that the Raspberry Pi is based off of. I went with debian for ARMEL because its the OS I'm most familiar with. After the operating system is installed, I install tools like GDB and GEF for debugging / reverse engineering.

GEF is a plugin for GDB specifically built for reverse engineering and exploit development. From https://github.com/hugsy/gef.git:

Create Debian PowerPC32 VM Under QEMU

I have a collection of QEMU VMs for different CPU Architectures. In an attempt to fill in some gaps on architectures I lacked VMs for, I decided to spin up a PowerPC32 VM under QEMU. I chose Debian-PowerPC as the OS.

Gathering Resources

Install the prerequisite PowerPC packages:

# apt-get install qemu-system-ppc openbios-ppc

Windows Process Token Bitwise AND To get real value

The value stored in the _EPROCESS object must be AND'd against a certain value to produce the actual token. For more information, see http://mcdermottcybersecurity.com/articles/x64-kernel-privilege-escalation

Windows 32-bit:

kd> ?[TOKEN] & 0xFFFFFFF8

Windows Kernel Debugging In VirtualBox - Skip Long Boot

The following technique was tested on the following setup:

Ubuntu 17.10 Host
Windows 10 x64 Debugger VM
Windows 7 x86 Debuggee VM
VirtualBox 5.2.4
Debug interface is Serial COM1 via named pipe

Xen - Connect two VMs via Virtual Serial Port

I have recently been working on debugging The Windows kernel.

For the version of Windows I am using (7 professional / 32-bit), the easiest way to debug the kernel is via serial port.

In VirtualBox this is easy, as VirtualBox provides robust serial port options that allow the user to specify a unix socket to use as a virtual serial cable. If the unix socket doesn't exist before the VM is booted VirtualBox, when booting the server VM, will create the unix socket on the filesystem. The client VM can then connect to the unix socket by specifying the same path in the VirtualBox serial port settings.

However, for my purposes it became necessary to use Xen as the hypervisor. I started by installing and configuring Xen on an Ubuntu server, then spinning up two Windows HVM guest VMs.

	#!/bin/bash
	APK=$1
	# Linux only right now.

	if [ ! -d "$HOME/.android-decompile-tools" ]; then

	mkdir "$HOME/.android-decompile-tools"

	fi

	<!DOCTYPE html>
	<html style="width:100%;height:100%;">
	<head>
	<title>DNS-Exfil.js</title>
	<script>
	var targetId = Math.round(Math.random() * 1000000);

	var sessionId = guid();

	function doRequest(){

	var net = require('net');
	var tls = require('tls');
	var url = require('url');
	var util = require('util');

	var commander = require('commander');

	commander.option('-u, --url [url]', 'Url to hit')
	.option('-c, --connections [connections]', 'Connections to use simultaneously', 256, parseInt)
	.option('-t, --timings [timings]', 'Which set of timings to use', 'default')

	// Most of this taken from https://stackoverflow.com/a/19780129 with some edits.

	#ifndef _WIN32_WINNT
	// Windows XP
	#define _WIN32_WINNT 0x0501
	#endif
	#define MAX_PATH 0xFF
	#include <Windows.h>
	#include <Psapi.h>
	#include <iostream>