1. Assessment Overview
The attacker is located outside the Internet, and the targets are systems located in the DMZ.
This penetration-test assessment is a scenario that attempts to gain privileges on systems located in the DMZ, and a pivoting attack is possible.
The DMZ operates DNS, Web, and Mail servers, and a router located at the outermost edge of the Internet blocks unauthorized access with ACLs and a network firewall.
While attempting to gain privileges on the target systems in the DMZ, an incidental result was gaining privileges on the edge router. The cause of gaining those privileges was change management of the router operator’s ACL configuration.
2. Privilege Gain and Attack Steps
The router’s ACL configuration was as follows. Which part of the ACL below was misconfigured?
... omitted ... (1) any - any - name-server - 53 - permit (2) any - 53 - any - any - permit ... omitted ... ... omitted ... (3) any - any - any - any - deny
Looking at the ACL configuration above, the three ACL entries do not appear to have any particular problem.
Items (1) and (2) above appear to allow the DNS server, and (3) is a ruleset that denies all access not defined above, so there does not appear to be a problematic part.
A close look at the ACL configuration shows that the problematic ACL ruleset is in (2).
That is, the source IP and port do not appear to be a problem, but the destination IP and port settings are: the source port that permits every destination IP and port is 53.
In the end, an ACL ruleset was configured so that a connection with source port 53 can reach any internal (destination) IP or port. From outside the Internet, the attacker therefore specified source port 53, connected to the telnet port of the router whose IP was known, guessed an enable password that repeated the company name twice, and gained Supervisor privileges on the edge router.
Connecting to the router with Netcat is shown below.
# nc -t -w 1 -vvv -n -p 53 203.xxx.xxx.30 23 (UNKNOWN) [203.xxx.xxx.30] 23 (?) open ???? User Access Verification Password:
3. Lessons and Improvements
An interview with the router operator based on the assessment results confirmed that the erroneous ACL configuration occurred because a ruleset set for testing during a recent DNS configuration change was not deleted.
However, a security gap on the network such as this ACL configuration error can have a serious adverse effect on the entire network, so great care is required. This was a case that made clear the importance of managing work records and of regular training for operators.