Exploit Tunneling and Callback

A few years ago, when I worked for my previous employer, I put together a proof-of-concept that was to be part of a client demo. I thought it was kind of cool, so I recorded a screencast of it in action. I've had the video sitting on my laptop ever since, not really sure what to do with it. I finally decided to post it.

In the video, what you see is a custom exploit script that exploits a buffer overflow in the web interfaces of several D-Link webcams. The neat part is that it tunnels the exploit and callback through each successive webcam. It works basically like this:

1. Exploit webcam 1.
2. Webcam 1 phones home, then downloads and executes a two-stage payload.
3. The payload proxies all packets destined to a certain port between the exploit host and the next webcam in the chain. It does this in both directions.
4. Tunneling through webcam 1, exploit webcam 2.
5. Like before, webcam 2 phones home, tunneled through webcam 1, and downloads and executes a two-stage payload.
6. Again, the payload proxies packets, this time between webcam 1 and the thrid webcam.
7. Exploit webcam 3, tunneling through webcams 1 and 2.
8. Webcam 3 executes a traditional payload, resulting in a connect-back shell. The shell connects back through webcams 2 and 1 to the exploit host.
9. Root prompt on webcam 3.

I put this together pre-Bowcaster, so it's a little raw. But it was all groundwork for that framework, so Bowcaster has much of the same capability shown in the video.

As an aside, one of the nice things about exploiting these inexpensive consumer devices, besides the fact they are soft targets, usually unmonitored, and ubiquitous, is they generally don't have a writeable file system. This means you can reboot them, leaving behind no trace that you were ever there.

Anyway, here's the video. It has cool music.

Exploit and Callback Tunneling from Zach on Vimeo.

Tweet