Here's how we got persistent shell access on a Boeing 747 – Pen Test Partners
- Reference: 1621597808
- News link: https://www.theregister.co.uk/2021/05/21/boeing_747_ife_windows_nt4_shell_access/
- Source link:
"Pwning it was more of a challenge than we expected, mostly because the IFE was 25 years old and was missing many features we take for granted on more recent systems, but we did succeed," said PTP in a post about the caper.
The system was so ancient its management server ran on Windows NT4 SP3, a distant ancestor of today's Windows Server builds. That age posed a problem for PTP's testers when they tried running modern pentesting tools against it: NT4 predated everyday attack surfaces such as the Remote Desktop Protocol.
[1]
[2]
[3]
Simply put, lots of modern tools and techniques didn't work. Metasploit all but failed, giving no obvious reason for doing so. Even Backtrack, the predecessor to Kali Linux, didn't work – triggering lots of scratching of heads at PTP HQ.
[4]Boeing 747s receive critical software updates over 3.5" floppy disks
[5]Decades-old UK government papers show that they tried to roll out a 'Cab-E-Net' system in the '90s. It was crap
[6]The power of Bill compels you: A server room possessed by a Microsoft-hating, Linux-loving Demon
[7]The power of Bill compels you: A server room possessed by a Microsoft-hating, Linux-loving Demon
[8]Y2K, Windows NT4 Server and Notes. It's a 1990s Who, Me? special
[9]Fridges... in... Spaaaaaaace: Engineers book ride on the Vomit Comet to test astro-refrigerator
"This is where we get into the intricacies of NT4," sighed PTP's blogger. "Usually, the payload would be executed using a Windows internal function called cscript. Cscript is used through almost all versions of Windows as a tool that runs scripts, so any Visual Basic, C# or other scripts can be created then run with cscript. However, NT4 doesn’t include cscript, the operating system pre-dates the tool, so running any scripts is seemingly impossible."
Alternative scripting tools weren't present on the IFE's NT4 deployment so an RCE the researchers used wasn't available to them. Moreover, the box was a standalone workstation and not on a domain, defying an attempt to sniff and capture hashes over the network.
The other problem was that testing the network live and in situ required powering up the host aircraft. Doing so with the 747's auxiliary power unit (APU) means fuelling a thirsty little jet turbine, buried in the airliner's tail end – and a typical 747 APU burns 300-400kg of Jet A1 fuel per hour, or about $250/hour.
The version of NT4 on the in-flight entertainment (IFE) network PTP examined was running Internet Information Services v4.0 (which had [10]"old" holes in it as far back as 2000 ).
[11]
Researchers obtained a directory traversal exploit on the IFE installation after some jiggery-pokery with character encoding. Modern operating systems tend to use UTF-8, which encodes characters in a single byte rather than UTF-16's two bytes, PTP said, meaning their commands needed to be re-encoded prior to deployment.
"With every directory traversal attack the target program is required to be on the same drive as the webserver. In our case we needed the system32 folder to be on the same drive as the IIS install." This was apparently easy enough in the lab but it was not spelled out in the blog post as to whether this was how the NT4 IFE system was configured aboard the 747.
The second exploit PTP used to gain persistent shell access was a 20-year-old remote code execution vuln, [12]CVE-1999-1011 . PTP described it as using "a package called Microsoft Data Access Components which allows direct access into the database objects through IIS."
[13]
Eventually the researchers got into the box using Metasploit's TFTP server module to obtain command line access, and from there obtained the admin password's hash and cracked it. Full details are [14]in the PTP blog post .
Although the target of the research was an IFE system, the necessary Ethernet port for gaining access to it is in the 747's galley: an area rarely left unattended for more than a few minutes during flight. Using the exploits PTP found to pwn an in-flight 747 would be impossible in practice.
Moreover, though PTP declined to reveal more details when we asked about the system and particular aircraft involved, we were told the IFE system is now no longer in use in any 747 still flying today. Sad news for archaic Windows enthusiasts – though they can console themselves that floppy disks are [15]still part of today's jumbo jet flights . ®
Get our [16]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YKfZNK31FVxo4C7U2tAN3wAAAIk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YKfZNK31FVxo4C7U2tAN3wAAAIk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YKfZNK31FVxo4C7U2tAN3wAAAIk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2020/08/10/boeing_747_floppy_drive_updates_walkthrough/
[5] https://www.theregister.com/2021/01/12/cab-e-net/
[6] https://www.theregister.com/2020/04/02/boeing_787_power_cycle_51_days_stale_data/
[7] https://www.theregister.com/2020/09/11/on_call/
[8] https://www.theregister.com/2019/08/05/who_me/
[9] https://www.theregister.com/2021/04/16/fridge_space/
[10] https://www.theregister.com/2000/07/05/microsoft_iis_security_hole_persists/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YKfZNK31FVxo4C7U2tAN3wAAAIk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.exploit-db.com/exploits/19424
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YKfZNK31FVxo4C7U2tAN3wAAAIk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://www.pentestpartners.com/security-blog/getting-a-persistent-shell-on-a-747-ife/
[15] https://www.theregister.com/2020/08/10/boeing_747_floppy_drive_updates_walkthrough/
[16] https://whitepapers.theregister.com/
Re: File under Mission Impossible script...
Tom Cruise skulking round the galley, chatting up the steward waiting for an unattended moment so he can access the ethernet
Plugs iPhone into ethernet port (good guys always use Apples).
"It's running on NT4... this might take some time!"
10 seconds later...
"I'm in!"
Proceeds to by-pass pilot controls, fires up the aircraft sim interface on his phone, and safely lands the plane at LAX.
No more fanciful than Independence Day.
Pretty sure the 747's APU is in the tail cone, not the nose cone.
Yep. Otherwise there would be a horrible smell of kerosene in the cabin.
All APU's are in the tailcone; the nosecone holds parts of the radar system (note, therefore, to silly scene from Superman Returns as the nosecone is fibreglass)
747's nosecone also holds jackets.
Pretty sure the nosecone also contains the 1st class passengers too.
Bingo...
Indeed. Even the RAT is in the tail.
Nose cone
Yup -- we've fixed that, ta. Don't forget to email corrections@ if you spot anything wrong so we can address it immediately.
C.
How long...
... before some mindless media peon writes the "Boeing Jumbo hacked' article with the requisite insinuations that "WE'RE ALL GOING TO DIE!"
Re: How long...
Well, we are all going to die…
"Established a persistent shell on an in-flight entertainment (IFE) system" made it sound as if the access was via the IFE itself. While it fact it was the Ethernet port in the galley. Not quite so exciting then.
but they got an article published with their company name on it didn't they. The whole point of the exercise is as usual, a PR stunt. Next year... it will be 'we hacked a boat'... no wait.. they did that last year already...
Upgrade to In-Flight Entertainment
Now running on MS-DOS3.0
I'd like to see them hack that!
Non-story
"...Using the exploits PTP found to pwn an in-flight 747 would be impossible in practice..."
"...Moreover, though PTP declined to reveal more details when we asked about the system and particular aircraft involved, we were told the IFE system is now no longer in use in any 747 still flying today..."
As much as...
... This is interesting to note, given that there are virtually no 747s in passenger service anymore, and those in freight service tend to not have IFE systems, this is a fluff piece that's well... pointless.
Nevermind the 'bait and switch' here... "How we got persistent shell access on a 747" - No, you got persistent shell access to the IFE, not the 747. At least on the 747, there were distinct physically separate networks. Boeing only switched to VLAN-based access on the 787 (or was it the 777?) so this is rubbish.
Oh, and for God's sake, please fact check not only your own work but also the work of the provider of the fluff piece, i.e. Pen Test Partners. Searching for "APU location 747" would show you instantly where it is, the tail end, not the nose end.
Call me grouchy, but when it comes to accuracy (and past rubbish fluff pieces about network security on planes), I'll be pretty pedantic. So, fix it please.
Run old systems for better security
The big takeaway for me was that the system was so difficult to hack because it was so old.
So, to maintain systems that can't be hacked, rather than upgrading internet facing servers, we should all be *down*grading them.
Re: Run old systems for better security
It is funny how they describe Windows components and features that I remember using as if they are relics of a bygone age. Perhaps their hack would have been easier if they'd hired a dev / ex-sys admin in their 40s to explain NT to them.
Re: Run old systems for better security
This. It can't be that hard to keep old exploit methods around, can it? I'm pretty sure the TLA professionals would. Far from being positive PR, this just tells me that PTP prefers shiny-shiny to useful-functional, and you shouldn't use them to test your infrastructure.
Surely
They would have used external Aux power pack rather than spool up the APU[s]? You know, that's sorta why airports are covered in the things
Well I appear to be alone in my thinking
I read this very much as a pointless but for-the-hell-of-it-exercise, and found it kind of interesting nonetheless.
Okay, so it was not via the IFE but a virtually impossible to access Ethernet port. So the planes are pretty much out of service, the IFE is also redundant and it also needs clarification if it was in a lab or in the plane itself. And yes it had some technical inaccuracies (re: the location of the APU). So what?
I still think this was someone just fucking about having been gifted access to one and thought 'That'd be a challenge' which it was. Crikey these comments are full of folk doing stuff with antiquated hardware just because they can. If they get a bit of exposure good for them, it isn't like some of the puff we see under the banner 'of research' with marketing droids pushing services.
Nope, perfect Friday afternoon reading for me.
PTP said
Modern operating systems tend to use UTF-8, which encodes characters in a single byte rather than UTF-16's two bytes, PTP said,
UTF-8 only encodes characters from U+0000 through U+007F as single bytes (viz preserving the seven-bit ASCII character range as is); other Unicode characters require between two and four bytes when UTF-8-encoded.
Bioterrorism Shock Headline
We were able to introduce a toxic biological agent into the aircraft vital coffee supply by being given access to the coffee pot and the toilet
Re: Bioterrorism Shock Headline
Or just pour some out of the whisky minature the hostess gave you...
Re: Bioterrorism Shock Headline
Somebody doesn't fly Spirit / Ryanair
Are there any passenger 747s still flying?
At this point it's almost like finding a vulnerability in, say, a Ford Sierra's ecu, vaguely interesting but of no security value at all.
Re: Are there any passenger 747s still flying?
That's what struck me - until I remembered Air Force One. Now that would make an interesting hack ...
Re: Are there any passenger 747s still flying?
Was that a burner account you used there?
File
Under, 'So What' and cross reference to 'Gratuitous Advertising'...