AMF TESTING MADE EASY! - Hakim

PREPARED BYLuca Carettoni, Matasano Securityluca@matasano.comAMF TESTING MADE EASY!Friday, July 13, 2012info@matasano.com 39 West 14th St. 53 W. Jackson 756 California St(888) 677-0666 Suite 202 Suite 1850 Suite ANew York, NY Chicago, IL Mountain View, CA10011 60604 94041

AMF TESTING MADE EASY!Since its introduction in 2002, Action Message Format (AMF) has attracted the interest of developersand bug-hunters. Techniques and extensions for traditional web security tools have beendeveloped to support this binary protocol. In spite of that, bug hunting on AMF-based applicationsis still a manual and time-consuming activity. Moreover, several new features of the latestspecification, such as externalizable objects and variable length encoding schemes, limit theexisting tools.This research aimed at improving the current state of art, introducing a novel testing approachas well as a new tool named Blazer. Our automated gray-box testing technique allows securityresearchers to build custom AMF messages, generating dynamically objects from method signatures.The approach has been implemented in a Burp Suite plugin which currently supportsAdobe BlazeDS, a well-known Java remoting technology. Using Blazer, testing AMF-based applicationsis easier and more robust. The tool consents to improve the coverage and the effectivenessof fuzzing efforts targeting complex applications.This paper focuses on the newly introduced methodology and explain how to use the tool duringgray-box testing of AMF-based applications. It is assumed that readers of this documenthave a basic knowledge and understanding of Adobe Flash and the AMF format.The following summarizes the outline of this paper:• Technology overviewBrief overview of the technology context. Introduction to the AMF specification, Flex remotingand Adobe BlazeDS• State of artSummary of the state of art, including existing tools and limitations of current techniques• Testing AMF-based applicationsDescription of a generic methodology for gray-box testing• BlazerIntroduction to Blazer, detailing core techniques and features• How to use BlazerTwo practical examples on how to use Blazer to test authorization and input validation flaws• ConclusionFinal considerations and possible future improvements2

TECHNOLOGY OVERVIEWThe research outlined in this paper is focused on the latest AMF specification and AdobeBlazeDS/LiveCycle Data Services, a widely used server-side Java implementation. Some of thetechnical details discussed in this paper are specific to those implementations. However, ourapproach and our tool can be applied on other Java server-side frameworks (e.g. Granite) andcan be easily ported to other programming languages (RubyAMF, FluorineFX, amfPHP, etc.).AMF SpecificationAs described in the Action Message Format (AMF) specification document [1], AMF is a compactbinary format that is used to serialize ActionScript object graphs. ActionScript is an object-oriented programming language used within Adobe Flash applications. ActionScript objectgraphs are based on named properties in the form of key-value pairs.AMF represents an efficient mechanism to save and retrieve the state of an application acrosssessions or to allow two endpoints to communicate through the exchange of strongly typeddata. Nowadays, AMF is primarily used for accessing remote services and provide RPC (RemoteProcedure Call) capabilities. Since its introduction, a standard Flex application can interact withcomplex back-end services and legacy applications. As a binary protocol with optimized objectscompression, AMF allows faster data transfer comparing to traditional text-based protocols.Also, the native support of ActionScript objects serialization and deserialization improves theoverall performance.The first version of AMF, referred as AMF0, was officially released in 2002 with MacromediaFlash Player 6. Due to new data types and language features of ActionScript 3.0, Adobe releasedan updated version (AMF3) with Flash Player 9. Major improvements and changes includethe possibility to send objects traits, string and other data type by reference. Also, AMF3introduces variable length encoding schemes and support for externalizable objects.Adobe Flex RemotingThe combination of highly responsive client and server side components allow remote procedureinvocation through Flex Remoting. This mechanism allows client-side applications to makeasynchronous requests to remote services that process and return data. As long as the serversidetechnology has been implemented according to Flex remoting specification, any Flex clientor AIR application can communicate with remote services and inter-exchange data.3

Adobe BlazeDSIn the effort of improving remoting and messaging capabilities of the Flex framework, Adobereleased a open-source implementation named “BlazeDS” in addition to the commercial “Live-Cycle ES” version. BlazeDS core features include the RPC and the messaging services. In thiscontext, remoting allows a Flex application to invoke directly methods of Java objects deployedwithin a traditional J2EE application server (e.g. Apache Tomcat). The server-side componentsof BlazeDS run in a standard web application container, in the form of Java classes, JAR librariesand XML-based configuration files (typically within WEB-INF/lib, WEB-INF/flex,WEB-INF/web.xml). As detailed in the Adobe BlazeDS Developer Guide [2], to send messagesacross the network, clients use the concept of channels. A channel encapsulates message formats,network protocols, and network behaviors to decouple them from services, destinations,and application code. A channel formats and translates messages into a network-specific formand delivers them to an endpoint on the server. Channels communicate with Java-based endpointson the server. An endpoint unmarshals messages in a protocol-specific manner and thenpasses the data in generic Java form to the message broker. The message broker determineswhere to send messages and routes them to the appropriate service destination (Java class andmethod).Supported AMF request/response types include:• CommandMessage• RemotingMessage• AcknowledgeMessage• ErrorMessage• HTTPMessage / SOAPMessageEach AMF remoting message can be uniquely identified by the following attributes:• endpoint (e.g. http://127.0.0.1:8080/myApp/messagebroker/amf )• destination (e.g. echoService )• operation and parameters (e.g. String echo(String input) )Although software vulnerabilities in the BlazeDS framework have been uncovered in the past [3],this research is focused on software vulnerabilities at the application level only.4

STATE OF ARTIn recent years, Flex clients evolved from simple shiny user interfaces to large applications managingcomplex and sensitive data. As a result, we have observed an increase of interest for developersand breakers to evaluate the security posture of AMF-based applications. At OWASPAppSec 2007, Stefano di Paola presented one of the first research targeting the Flash framework[4]. During Blackhat USA 2008, a talk titled “Adobe Flex, Amf 3 And Blazeds An Assessment”[5] defined the technology stack as “an unexpectedly large attack surface” to emphasizethe extend surface available to attackers. In 2009, Deblaze [6] was released by Jon Rose. Thetool allows to enumerate remote methods through a combination of brute-forcing techniquesand decompiling the client-side code. In 2010, Marcin Wielgoszewski presented one of themost comprehensive research targeting Flex-based applications [7]. In particular, he pointedout the need of building custom clients that would allow to define custom Java objects, in additionto primitive types. Starting from version 1.2.124 [8], the popular Burp Suite added supportto visualize and tamper AMF requests and responses. Moreover, the Burp Scanner module wasupdated to place automatically attack payloads within string-based AMF values. Other toolshave been also updated in order to support this technology, including Charles Proxy,WebScarab and Fiddler2 (AMFParser plugin). Particularly interesting is the idea implementedby Pinta [9], a cross-platform Adobe AIR application that allows to debug AMF calls.A common methodology to perform security testing against AMF applications include:• Enumeration• Retrieving endpoints, destinations and operations from the traffic• Decompiling Flex application components• Brute-forcing endpoint, destination and operation names• Traffic inspection and tampering• Using network packet analyzers• Using HTTP/S proxiesAlthough this approach can be used during black-box assessment with limited knowledge of thetarget, it has several disadvantages. Testing a large application is a time consuming task as itrequires to invoke all application functionalities, observe the generated traffic and perform tampering.In case of operations using customized objects as arguments, reverse-engineering maybe also required in order to build valid AMF messages. As a result, manual parameter tamperingis usually limited to just few messages with primitive types and simple Java objects. Another5

drawback is related to “hidden” server-side functionalities that are impossible to uncover bydecompiling the Flex client or observing the network traffic.Although the current literature includes AMF testing techniques and tools, none of the previousresearch was focused on coverage and automation. In addition, most of the tools availablehave serious limitations while dealing with custom classes and externalizable objects, which is acommon practice in enterprise software. For instance, popular web security proxies do notproperly handle complex AMF3 messages and they are not even able to display those customobjects thus tampering cannot be easily performed.“Life is pain, highness. Anyone who tells you differently is selling something.” -W. Goldman6

TESTING AMF-BASED APPLICATIONAs outlined in the previous section, testing AMF-based applications is still a manual and timeconsumingactivity. If a security assessment is focused on coverage, the tester has to be able togenerate valid AMF messages for all destinations. During several real-life engagements workingwith complex AMF-based applications, we have encountered enterprise-grade software withmore than 500 remote invokable methods and more than 600 custom Java objects exchangedby the client and server.Introducing a generic methodology for gray-box testingPerforming vulnerability research on such extended attack surface requires a new approach thatwould allow to overcome the limitations of current techniques. In particular, this research is focusedon improving the coverage and the effectiveness of fuzzing efforts by designing and developinga tool, able to automatically generate valid AMF messages from operation signatures(e.g. Java methods in case of BlazeDS). Handling externalizable classes and other features ofthe AMF3 specification is crucial for auditing complex software and it was considered as requirementduring the development of the tool.The author assumes that the source code or the portable code (bytecode) for the applicationunder scrutiny is available. During vulnerability research analysis, this is a realistic assumption asthe tester has usually full control over the testing environment.The ability of generating valid AMF messages for all endpoints, destinations and operationsallows security researchers to cover the following test areas:• AuthenticationAuthentication and session management in BlazeDS applications is usually managed by theunderline application server (e.g. Apache Tomcat) or web framework (e.g. Spring) via traditionalsession tokens. By generating valid messages and verifying that all operations require avalid cookie, except those specifically intended to be public, a tester can verify that no operationsare exposed to unauthorized users.• Access control and authorizationBy generating valid messages for all operations available to multiple low-privileges users aswell as to administrators, a security researcher can detect horizontal and vertical escalationbugs. This allows the tester to uncover access control failures between users in the same tenancyand users between tenancies. In real-life situations, the tool should also be able to generatearbitrary operation parameters in order to test direct object references (DOR) bugs. Forexample, let’s imagine a remote method for users management. The tool should be able to7

uild a custom Java object (e.g. “User”) containing an attribute to identify the user id (e.g.“userID” as integer) and the user’s roles (e.g. “Roles”, another custom Java object).• Error handling and information disclosureBy sending properly formatted AMF messages with invalid content (e.g. an invalid “userID”),the tester can observe all possible server responses. This may lead to the discovery of Javastack traces or verbose error messages that may facilitate further attacks. It is important tonote that we are focused on the application, thus the tool should not trigger errors or exceptionsat the BlazeDS framework level.• Input validationFuzzing with common attack patterns for traditional web application vulnerabilities (e.g. SQLi,LDAP injection, etc.) allows to verify that all input validation failures result in input rejection orinput sanitization. Thus, the tool should be able to tamper or mutate properly built AMF messageswith malicious strings. Due to Java strong typing, injection would typically occur withinString arguments. However, all data type are relevant. For instance, integer overflow bugs inJava application affect the business logic and may have drastic consequences. Also, BlazeDSendpoints may expose native code through Java Native Interface (JNI) calls.• Output EncodingUnder some circumstances, it is important to verify that all untrusted data that are outputneed to be properly escaped for the specific application context. This task requires fuzzingand manual or semi-automatic evaluation of the resulting AMF responses. Although cross-sitescripting and cross-site flashing affecting Flex applications have become less relevant thanksto the hardening introduced by recent Flash framework versions, these classes of vulnerabilitiesmay still be relevant for particular use cases.8

BLAZERConsidering the previously mentioned requirements, Blazer was designed and implemented tomake AMF testing easy, and yet allows researchers to control fully the entire security testingprocess.Blazer has been developed in Java as a Burp Suite plugin [10] and released under the GNUGeneral Public License [11]. As it is highly integrated in a well-known testing suite, web securitypractitioners can start to use the tool with minimal setup in few seconds.Blazer Burp Plugin Look and FeelOn Windows, it is possible to launch Burp and Blazer with the following command:java -classpath burp.jar;Blazer.jar burp.StartBurpOn Linux and Mac OS X, use a colon character instead of the semi-colon as the classpath separator:java -classpath burp.jar:Blazer.jar burp.StartBurp9Burp plugins are supported by both versions (free and professional) of the Burp Suite. All majoroperating systems (Windows, Mac, Linux) with standard Oracle JRE installed are supported bythe current version of Blazer.

Upon launching Burp, it is possible to verify that Blazer was properly loaded by checking the“Alerts” notification tab. At this point, Blazer can be invoked by using a context menu availablefrom within Burp tools.Blazer Context Menu From Proxy HistoryPlease note that the tool detects and verifies the presence of valid Flex’s “RemotingMessage”objects within requests/responses captured by Burp.Blazer can be fully configured and used from the plugin GUI. Traditional standard output anderror streams provide further details during the automatic object generation, message creationand transmission.At the top of Blazer’s window, five tabs guide the user throughout the tool configuration:1. Application LibrariesThis allows to include all application artifacts, including application classes implementing theremote methods as well as application libraries. The current release of Blazer supports JAR filesonly. From the user’s perspective, this is typically what is available in the application server webroot,under “/WEB-INF/”.2. Remote Method SignaturesBlazer automatically retrieves public method signatures from the application libraries. This taballows to select all methods under scrutiny, filtering based on annotation or type.3. General Options and Data PoolsObject generation and fuzzing can be precisely customized from the user interface. For in-10

stance, users can select the number of threads, the total number of permutations for each iteration,common attack payloads and data pools containing “good” data.4. StatusThis tab allows to control the object generation or fuzzing progress. It provides an overview ofthe total number of requests, permutations, overall time, time to finish and speed measured inrequests/second. Also, this interface allows to pause, restore and stop current tasks.5. BeanShellFuzzing is just the first step. Discovering and exploiting vulnerabilities requires troubleshootingand trial-and-error testing. In several cases, security professionals need an easy way to customizea specific AMF message and send it over the wire multiple times. Blazer embeds a BeanShell[12] console, automatically importing all required application libraries. Advanced users can buildcustom messages in few instructions by using Blazer internal methods.11

Core techniques and architectural designIn a nutshell, Blazer is a custom message generator with fuzzing capabilities. Access to the targetapplication artifacts allows to generate automatically custom Java objects from method signaturesvia Java reflection and “best-fit” heuristics. Based on user-defined data pools, the toolautomatically invokes objects’ methods to populate each specific object instance with plausibledata. This is internally referenced as “object generation” and allows to build valid AMF messageswithout preliminary knowledge of the application. In addition to that, fuzzing of stringbasedattributes for all encapsulated objects allow to easily pinpoint input-validation vulnerabilities.User-defined attack vector lists are employed to dynamically tamper string attributes ofJava objects. Also, a specific setting allows to define the probability of using attack vectors versus“good” application data strings.Burp and Blazer SetupIn addition to that, users can also define the number of permutations during the object generationand fuzzing. This parameter is crucial for the entire analysis as it impacts directly the likelihoodof generating semantically valid objects for the application under scrutiny. Incrementingthe number of permutations increases the number of instances for a specific AMF method signature,populated with different data. Obviously, this parameter also increases the total numberof requests and the overall time for the analysis.12

A simplified heuristic used by Blazer is hereby presented:Blazer Simplified HeuristicFor all interested readers, intrigued by the technical details of the object generation and theprimitive type pools, it is suggested to read the source code of Blazer’s core classes: Object-Generator, MessageGenerator, TaskManager and MessageTask.At the architectural level, Blazer has three main components:• a packet generator, based on Adobe AMF OpenSource libraries [13]• an object generator that allows to build valid application objects using “best-fit” heuristics• a lightweight fuzzing infrastructure that allows to generate attack vectors, insert payloadswithin objects, manage multiple threads and monitor the progress13By default, Blazer uses Burp Proxy to record requests and responses. This is particularly usefulduring the analysis of complex applications as the tester can benefit from the built-in toolsavailable in Burp. Moreover, the “Filter by search term” functionality available in Burp Suite Pro-

fessional allows to easily filter and remove irrelevant responses. Nevertheless, Blazer allows tospecify an arbitrary proxy in order to use any third-party component to visualize and store theentire AMF communication.14

HOW TO USE BLAZERThe following chapter illustrates the use of Blazer for two standard activities, typically performedduring a security assessment. As usual, the best way to understand how the tool works is to experiment.Go and download Blazer from www.matasano.com !Test case #1 - Testing Remote Methods AuthorizationFrequently, it is important to evaluate the authorization mechanism and the level of privilegesrequired for accessing remote methods. Let’s imagine an application where session managementand user permissions are based on standard session tokens. In this situation, Blazer can beextremely useful to evaluate whether a specific session has access to remote methods.Testing with Blazer requires literally just few clicks. Upon instrumenting the browser to proxy allrequests through Burp, intercept a valid AMF request for the remote BlazeDS-based application.Users can now start Blazer by selecting “Blazer - AMF Testing Made Easy!” from the contextmenu (e.g. right click from a Burp repeater tab).Clicking “Add JARs”, users can import all application resources.Blazer - Step 1In this example, “samplesVuln.jar” contains all classes including the exposed remote methodsas well as all custom Java objects exchanged by the application.15

Switching to tab “2”, Blazer automatically unpacks and analyzes the libraries in order to displayall public methods. Filtering can be used to identify specific methods. For instance, wheneverannotation is used, users can quickly identify all exposed methods by displaying “@RemotingInclude”methods only.Blazer - Step 2For this test case we simply select all methods, even though some of those operations are notremotely invokable.In step “3”, users can configure multiple parameters used by Blazer. As we are testing accesscontrol mechanisms, we just want to generate valid AMF requests for all methods. Thus, wesimply increase the number of threads and the number of permutations. The latter should beproperly tuned, depending on the target application.16

Finally, users can launch the object generation by clicking on “Start”. As all requests and responsesare stored within Burp Proxy history, it is possible to identify easily accessible methodsby filtering the raw responses.Blazer - Step 317Blazer - Step 4

For example, it is possible to search for specific keywords (e.g. “No destination with id”) andremove all invalid destinations. In just few minutes, users can identify all exposed methods for aspecific user session. Changing the session token and repeating previous steps allows to testaccess control for different users and different set of privileges.Test case #2 - Testing SQL InjectionThe following demonstrates how to use Blazer in order to detect a common web applicationvulnerability: SQL Injection. Detecting input validation vulnerabilities within AMF messages requireto build properly formatted AMF requests containing common attack patterns.Tuning Blazer Configuration18Blazer can be easily configured with a custom attack vectors wordlist by loading it from a file orjust typing in common attack patterns. In addition, users can control the mechanism used byBlazer to build objects with string attributes. This tuning allows to unbalance “good” and “bad”

user-supplied input. In this example, Blazer will send “good data” for 70% of the times and just30% of the strings will contain actual attack vectors.Data Pools ConfigurationThe “Data Pools” tab allows to define input that is considered by the application as “good”input and can be used by Blazer to build syntactically and semantically valid objects. By default,pools include all Java primitive types with predefined values. In-depth fuzzing requires to buildvalid AMF messages with attack vectors for detecting input validation vulnerabilities in strategicattributes only. By carefully tuning Blazer’s configuration, users can achieve good results duringthe automatic object generation.19

Automatic and Manual Testing (BeanShell) with Blazer20As in the previous test case, users can finally review all AMF requests and responses from withinBurp. Sorting and filtering allows security testers to identify traditional error messages, typicallyassociated with SQL injection vulnerabilities. Advanced users can also select the “console” tab

in order to invoke BeanShell and programmatically use Blazer’s inner classes to customize theirexploit and create powerful proof-of-concepts.Detecting SQLi in AMF endpoints with Burp and Blazer21

CONCLUSIONOur newly introduced approach has been proven to increase the coverage and the effectivenessof AMF security testing. Blazer has been used to find real-life vulnerabilities including direct objectreference bugs, authentication flaws, business logic abuses, SQL injections and other criticalbugs during several complex engagements.Unlike previous research, our effort was focused on coverage and automation. We strongly believethat our approach reshapes the concept of AMF fuzzing. Security testers can now generatevalid AMF messages in just a few clicks. Also, Blazer fuzzing capabilities allow to perform tamperingand to detect vulnerabilities in a very time-efficient manner. Finally, taking advantage ofBlazer internal methods, a user can easily construct custom AMF messages from within the toolwith BeanShell. Also, Java, JRuby and other programming languages can import Blazer as a libraryin order to quickly build complex proof-of-concepts.Although the current tool has been designed specifically for BlazeDS-based application, Blazercan be used on other Java server-side frameworks and the approach can be easily ported toother programming languages and technologies.Upcoming tool improvements include the possibility to import recursively source code andclasses from specified directories. Sand-boxing via Java security manager configurations will bealso provided to avoid dangerous methods execution while generating custom objects.In future, the following features may be implemented:• In addition to BeanShell, it will be also useful to extend the “console” tab in order to supportjRuby or other scripting languages• Having an embedded utility for visualizing complex AMF messages will be also beneficialwhile monitoring the objects generation process• Auto-selection of remote method signatures from entries already present in Burp History mayfurther speed-up the testing activity• Auto-save of all Blazer’s configuration parameters would allow to easily tamper HTTP requests(e.g. changing the session token), without having to reconfigure Blazer22

REFERENCES1. AMF 3 Specification, Adobe Systems Inc.http://download.macromedia.com/pub/labs/amf/amf3_spec_121207.pdf2. Adobe BlazeDS Developer Guide, Adobe Systems Inc.http://livedocs.adobe.com/blazeds/1/blazeds_devguide/index.html3. AMF arbitrary code execution, Wouter Coekaertshttp://wouter.coekaerts.be/2011/amf-arbitrary-code-execution4. Testing Flash Applications, Stefano di Paolahttp://www.owasp.org/images/8/8c/OWASPAppSec2007Milan_TestingFlashApplications.ppt5. Adobe Flex, AMF 3 and BlazeDS: An Assessment, Jacob Karlson and Kevin Stadmeyerhttp://www.blackhat.com/presentations/bh-usa-08/Carlson_Stadmeyer/BlackHat-Flex-Carlson_Stadmeyer_vSubmit1.pdf6. Deblaze, Jon Rosehttp://deblaze-tool.appspot.com/7. Pentesting Adobe Flex Applications, Marcin Wielgoszewskihttp://blog.gdssecurity.com/storage/presentations/OWASP_NYNJMetro_Pentesting_Flex.pdf8. Burp Suite v1.2.14 Release Note, PortSwigger Ltd.http://releases.portswigger.net/2009/08/v1214.html9. AMF service test and debug utility, Pinta project membershttp://code.google.com/p/pinta/10. Burp Suite Extender, PortSwigger Ltd.http://portswigger.net/burp/extender/11. Licenses, Free Software Foundation, Inc.http://www.gnu.org/licenses/12.BeanShell, BeanShell developershttp://www.beanshell.org/13. BlazeDS Java AMF Client, Adobe Systems Inc.http://sourceforge.net/adobe/blazeds/wiki/Java%20AMF%20Client/23

Corporate Office:39 W. 14th StreetSuite 202New York, NY 10011Midwest:53 W. Jackson BlvdSuite 1850Chicago, IL 60604West Coast:756 California StSuite AMountain View, CA94041www.matasano.cominfo@matasano.com888-677-0666ABOUT THE AUTHORLuca Carettoni is a senior security consultant for Matasano Security with over 7 years experienceas a computer security researcher. His professional expertise includes black box securitytesting, web application security, vulnerability research and source code analysis.Prior to Matasano, Luca worked at The Royal Bank of Scotland as a penetration testing specialistwhere he performed security audits against several online banking systems worldwide. In thepast years, Luca has been an active participant in the security community and a member of theOpen Web Application Security Project (OWASP). Luca holds a Master's Degree in ComputerEngineering from the Politecnico di Milano university.ABOUT MATASANOMatasano is an independent security research and development firm. We work with vendorsand enterprises to pinpoint and eradicate security flaws, using penetration testing, reverse engineering,and source code review.Since 1994, Matasano researchers have had founding roles in the first security research labs,discovered new classes of vulnerabilities, secured operating systems, and shipped large softwareprojects. We’ve been behind some of the first breaks in SAN technology, virtualization, andfinancial protocols.Our work has been featured in Network World, eWeek, Forbes, Macworld, Wired, and theWashington Post, and at conferences ranging from Black Hat to Gartner. Our practice focus areasinclude storage, virtualization, financial, middleware, software protection, kernel security,AJAX/Web 2.0, enterprise technology, security product testing, 802.11 and authentication protocols,RF, VOIP and telephony, Windows Vista, Mac OS X, and embedded platforms.24