diff --git a/src/SUMMARY.md b/src/SUMMARY.md index 64254ae0eb1..65fea4a4975 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -16,6 +16,7 @@ - [Github Dorks & Leaks](generic-methodologies-and-resources/external-recon-methodology/github-leaked-secrets.md) - [Pentesting Network](generic-methodologies-and-resources/pentesting-network/README.md) - [DHCPv6](generic-methodologies-and-resources/pentesting-network/dhcpv6.md) + - [DDS/RTPS Security and Service Impersonation](generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md) - [EIGRP Attacks](generic-methodologies-and-resources/pentesting-network/eigrp-attacks.md) - [GLBP & HSRP Attacks](generic-methodologies-and-resources/pentesting-network/glbp-and-hsrp-attacks.md) - [IDS and IPS Evasion](generic-methodologies-and-resources/pentesting-network/ids-evasion.md) diff --git a/src/binary-exploitation/common-binary-protections-and-bypasses/pie/README.md b/src/binary-exploitation/common-binary-protections-and-bypasses/pie/README.md index 3819ad7eebb..73a393e2ceb 100644 --- a/src/binary-exploitation/common-binary-protections-and-bypasses/pie/README.md +++ b/src/binary-exploitation/common-binary-protections-and-bypasses/pie/README.md @@ -2,6 +2,10 @@ {{#include ../../../banners/hacktricks-training.md}} +{{#ref}} +../../../generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md +{{#endref}} + ## Basic Information A **position-independent executable (PIE)** can be loaded at a different base address on each execution when ASLR is enabled, invalidating absolute addresses assumed by an exploit. diff --git a/src/generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md b/src/generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md new file mode 100644 index 00000000000..f884415934d --- /dev/null +++ b/src/generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md @@ -0,0 +1,149 @@ +# DDS/RTPS Security and Service Impersonation + +{{#include ../../banners/hacktricks-training.md}} + +## DDS/RTPS attack surface + +The **Data Distribution Service (DDS)** is a data-centric publish/subscribe middleware frequently used by robotics, industrial, automotive, and real-time systems. Its DDSI-RTPS discovery plane announces domain participants and their reader/writer endpoints. Cyclone DDS exposes these records through the `DCPSParticipant`, `DCPSPublication`, and `DCPSSubscription` built-in topics, including endpoint topic names, type names, and QoS metadata.[[3]](#references)[[5]](#references) + +When DDS Security is not enabled, network reachability to a domain may be enough to:[[3]](#references)[[7]](#references) + +- enumerate participants, writers, readers, topic names, and type names; +- subscribe to telemetry or state streams; +- create a writer for a discovered topic and impersonate an internal publisher; +- invoke RPC-like services implemented as request/response topic pairs. + +DDS Security adds participant authentication, topic/domain access control, cryptographic protection, and security-event logging; normal DTLS, VPN, or application-session encryption outside DDS does not supply those DDS-level authorization decisions.[[3]](#references)[[7]](#references) + +### Discovery reconnaissance with Cyclone DDS + +In the Unitree G1 case study, Domain 0 discovery was visible over RTPS multicast at `239.255.0.1:7400`. Treat that endpoint as a useful default-deployment indicator rather than a universal constant: domain IDs, transports, multicast policy, interface selection, and static peers can differ.[[3]](#references) + +Install the Python binding, select the interface that reaches the target, and inspect the built-in topics. Explicit peers help where multicast is filtered, but they do not replace correct interface and locator selection.[[3]](#references)[[5]](#references) + +```bash +python3 -m venv dds-venv +dds-venv/bin/pip install cyclonedds +export CYCLONEDDS_URI=file://$PWD/cyclonedds.xml +dds-venv/bin/python dds_dump.py +``` + +
+Minimal Cyclone DDS endpoint enumerator + +```python +#!/usr/bin/env python3 +import time +from cyclonedds.domain import DomainParticipant +from cyclonedds.builtin import ( + BuiltinDataReader, + BuiltinTopicDcpsParticipant, + BuiltinTopicDcpsPublication, + BuiltinTopicDcpsSubscription, +) + +dp = DomainParticipant(0) +time.sleep(10) + +participants = BuiltinDataReader( + dp, BuiltinTopicDcpsParticipant +).take(256) +writers = BuiltinDataReader( + dp, BuiltinTopicDcpsPublication +).take(2048) +readers = BuiltinDataReader( + dp, BuiltinTopicDcpsSubscription +).take(2048) + +for p in participants: + print("PARTICIPANT", p.key) +for e in sorted(writers, key=lambda x: x.topic_name): + print("WRITER", e.topic_name, e.type_name, e.qos) +for e in sorted(readers, key=lambda x: x.topic_name): + print("READER", e.topic_name, e.type_name, e.qos) +``` + +
+ +Example interface/peer pinning for Cyclone DDS:[[3]](#references) + +```xml + + + + + + + true + + + + + + + + +``` + +If discovery works but a writer reports **zero matched subscriptions**, inspect the advertised unicast locators in RTPS traffic. Multi-homed hosts may announce the wrong source interface even though multicast discovery succeeds. Reproduce from a single-homed Linux host, pin the interface, and verify the target sees the writer before debugging payload serialization.[[3]](#references)[[4]](#references) + +## Reconstructing types and impersonating services + +Discovery usually reveals a **type name**, not the complete application schema. Recover the exact structure from shipped IDL, generated Python/C++ classes, firmware, mobile applications, debug symbols, or captured samples. Preserve member order, integer widths, bounded strings/sequences, keys, extensibility annotations, and XCDR version. Then compile the recovered IDL with `idlc`; Cyclone DDS generates the descriptors and serialization support needed for wire-compatible samples.[[3]](#references)[[6]](#references) + +```bash +idlc request.idl +cc exploit.c request.c -lddsc -o dds_client +``` + +Common application-level RPC conventions use separate topics such as `rt/api//request` and `rt/api//response`. A request header may carry a correlation ID, lease/policy fields, and an `api_id` or opcode selecting the handler, while another member contains JSON as a string. Once the type is correct, a malicious participant can publish directly to the request topic; service code may treat it identically to a message from a trusted internal process.[[3]](#references)[[4]](#references) + +A practical sequence is:[[3]](#references)[[4]](#references) + +1. Read publication/subscription built-in topics and map request writers to service readers. +2. Recover the precise request and response types. +3. Match the target reader's reliability, durability, partition, and data-representation QoS. +4. First send a harmless enumeration/status `api_id`. +5. Correlate the response using the request identity field. +6. Only in an authorized test, exercise state-changing operations and monitor physical safety effects. + +### WebRTC or API bridges into DDS + +Treat any WebRTC, WebSocket, HTTP, or BLE component that translates attacker-supplied data into native DDS samples as a **privileged middleware gateway**. If a client controls the destination topic or operation and the bridge lacks a strict allowlist, one valid signaling credential can expose every service reachable by the bridge. DTLS protects the WebRTC data channel in transit, but it does not authorize DDS topics or service functions.[[3]](#references)[[4]](#references) + +Audit bridge messages for fields such as `topic`, `type`, `api_id`, `service`, and stringified `parameter` objects. Test whether the bridge accepts ordinary telemetry topics, arbitrary `rt/api/` request topics, malformed type/topic combinations, and operations not used by the official client. Also compare the bridge path with **direct DDS publication**: an application-layer credential is irrelevant if the internal DDS domain accepts unauthenticated participants.[[3]](#references)[[4]](#references) + +## Compound pivots exposed by DDS service access + +The UniBLEed research illustrates why service impersonation should be tested as part of a complete trust chain rather than as an isolated message-injection issue.[[3]](#references)[[4]](#references) + +- **Shared device keys across transports:** reusing one long-lived symmetric key for BLE provisioning and WebRTC turns a leak in release logs, WebView arguments, diagnostic events, or a bootstrap handler into access to every protocol sharing the key. If a cloud endpoint unwraps a device credential, verify account-to-device ownership before decryption; otherwise it becomes a cross-tenant decryption oracle.[[3]](#references)[[4]](#references) +- **Runtime-unpacked Android clients:** when a packer replaces the shipped DEX with stubs and defines decrypted classes only at runtime, use a rooted test emulator, `frida-server`, and `frida-dexdump`, then decompile the recovered DEX files with JADX. Search the result for protocol opcodes, signing routines, raw keys, release logging, WebView bridges, and cloud ownership parameters.[[2]](#references)[[3]](#references) +- **Deterministic firmware “encryption”:** encryption is reversible when the package carries the KDF seed in plaintext and the distributed updater contains the KDF constants. Reproduce the KDF and cipher variant, decrypt nested packages recursively, and recompute any unkeyed checksum. Unitree UPK research, for example, recovers a TEA key from a four-byte seed stored at offset `0x1c` plus constants embedded in OTA binaries.[[1]](#references)[[3]](#references) +- **Traversal write into a privileged consumer:** if a DDS handler appends an extension to an attacker-controlled identifier but does not canonicalize and enforce base-directory containment, `../` components can place content in another service's watched or executable directory. A second root service that snapshots filenames with `os.listdir()` and later passes an allowed file to `sh` turns arbitrary file write into command execution even when the filename ends in `.md`.[[3]](#references)[[4]](#references) +- **File read as a PIE bypass:** a privileged path-read primitive can disclose `/proc//maps`. Parse the executable mapping base and add statically recovered offsets for PLT entries, `.bss` objects, flags, and callback structures to make a position-dependent memory-corruption exploit repeatable.[[3]](#references)[[4]](#references) +- **Unquoted-heredoc configuration injection:** values expanded into an unquoted shell heredoc can contain newlines that terminate the intended value and add attacker-selected configuration directives. Length-dependent “manual configuration” fallbacks deserve special attention because they may bypass a safer normal code path and can force a target onto attacker-controlled networking.[[3]](#references)[[4]](#references) +- **`.bss` overflow into event-loop cleanup state:** when a global fixed-size input buffer precedes termination flags and cleanup objects, an oversized write can set the exit flag and forge a callback/argument pair. After using the PIE leak to target `system@PLT`, event-loop shutdown invokes the command. If later cleanup frees forged static data and aborts, background the payload so it survives the daemon crash.[[3]](#references)[[4]](#references) + +## Hardening and detection + +Apply controls at both the DDS layer and every external bridge:[[5]](#references)[[7]](#references) + +- enable DDS Security mutual authentication and cryptographic protection; +- write governance/permissions rules per domain and topic, separating publish from subscribe rights; +- deny discovery and user-data traffic across untrusted interfaces and network segments; +- configure bridges with a fixed topic/type allowlist and operation-level authorization rather than accepting a client-selected topic; +- inventory expected participant GUIDs, topic/type pairs, and QoS, then alert on new participants, unexpected writers, or duplicate writers for safety-critical topics; +- use distinct, rotatable credentials per transport and bind cloud key operations to the authenticated device owner. + +## References + +- [1] [UniTEABag — Unitree UPK firmware decryptor and format research](https://github.com/Bin4ry/UniTEABag) +- [2] [frida-dexdump — runtime DEX dumping](https://github.com/hluwa/frida-dexdump) +- [3] [UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range](https://boschko.ca/g1-ble-rce) +- [4] [UniBLEed proof-of-concept and research tools](https://github.com/OlivierLaflamme/UniBLEed) +- [5] [Cyclone DDS Python built-in topic API](https://cyclonedds.io/docs/cyclonedds-python/latest/cyclonedds.builtin.html) +- [6] [Cyclone DDS IDL and `idlc` documentation](https://cyclonedds.io/docs/cyclonedds/latest/idl/about.html) +- [7] [OMG DDS Security Specification 1.2](https://www.omg.org/spec/DDS-SECURITY/1.2/About-DDS-SECURITY) + +{{#include ../../banners/hacktricks-training.md}} diff --git a/src/hardware-physical-access/firmware-analysis/README.md b/src/hardware-physical-access/firmware-analysis/README.md index 2a19034f436..ec5c2549daa 100644 --- a/src/hardware-physical-access/firmware-analysis/README.md +++ b/src/hardware-physical-access/firmware-analysis/README.md @@ -2,6 +2,10 @@ {{#include ../../banners/hacktricks-training.md}} +{{#ref}} +../../generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md +{{#endref}} + ## **Introduction** ### Related resources diff --git a/src/mobile-pentesting/android-app-pentesting/README.md b/src/mobile-pentesting/android-app-pentesting/README.md index 9cc0231c09e..d1c45d3eff8 100644 --- a/src/mobile-pentesting/android-app-pentesting/README.md +++ b/src/mobile-pentesting/android-app-pentesting/README.md @@ -2,6 +2,10 @@ {{#include ../../banners/hacktricks-training.md}} +{{#ref}} +../../generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md +{{#endref}} + ## Android Applications Basics It's highly recommended to start reading this page to know about the **most important parts related to Android security and the most dangerous components in an Android application**: diff --git a/src/pentesting-web/file-inclusion/README.md b/src/pentesting-web/file-inclusion/README.md index 328a0614d9e..d01845da851 100644 --- a/src/pentesting-web/file-inclusion/README.md +++ b/src/pentesting-web/file-inclusion/README.md @@ -2,6 +2,10 @@ {{#include ../../banners/hacktricks-training.md}} +{{#ref}} +../../generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md +{{#endref}} + ## File Inclusion **Remote File Inclusion (RFI):** The application loads a file from a remote server. If the included resource is interpreted as code, an attacker can host and execute a payload. In PHP, URL-aware inclusion is **disabled by default** through `allow_url_include`.\