Crippling HTTPs With Unholy PAC
summary
Demonstrates forcing browsers to load a malicious PAC via option 252 DHCP spoof or spoofed WPAD DNS, then leaking full HTTPS URLs (including SSO tokens and share links) by chopping them into DNS-label 62-byte chunks and exfiltrating via DNS resolve/isResolvable to an attacker-controlled domain; includes a working demo against Windows 10 + Chrome 51 and Ubuntu Firefox, an open-source PAC malware with a two-way DNS CNC that can download code via eval-based CNC payload, and registry tweaks to make IE report full URLs; denial-of-service proxy routing also shown.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:06Welcome
- 1:19Teaser
- 2:20Outline
- 3:07PAC Refresher
- 6:24PAC Configuration
- 9:42HTTP subversion with malicious pack
- 12:48Find proxy for URL
- 18:42Mentions
- 20:25Ingredients
- 22:35Demo
- 26:04Fine Print
- 30:11Conclusion
- 33:03Malware Watch
- 33:29PAC Capabilities
- 35:32Download Protocol
- 36:05Message Length
- 38:17Recap
- 38:42Matrix
- 40:25Remediation
- 41:20Secure PAC
- 42:10Conclusions
related talks
41mBreaking Kerberos' RC4 Cipher and Spoofing Windows PACs
45mMCPwned: Hacking MCP Servers with One Skeleton Key... (Jonathan Leitschuh)
46mBreaking Out HSTS (and HPKP) On Firefox, IE/Edge and (Possibly) Chrome
48mA Weakness In Chrome & A New Hacking Technique
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
31mNew Techniques for Split-Second DNS Rebinding
47mDNS On Fire
59mBrowsers Gone Wild