TLS downgrade lab

[tsluyter]

Hi Glenn & Co.

I was asked by a mutual colleague to take a look at making a Docker container and walkthrough for TLS downgrades. Here's my first revision. It works and the walkthrough is complete. I feel it might be missing a bit of "oompf!", so I'll give it another look-over soon.

[tsluyter]

I may actually have an idea on how to make this better / more fun :) Brb.

[tsluyter]

Oofff, I'm so close! I've managed to piece together an IPTables nfqueue interceptor which takes incoming TLS HELLOs and tries to fiddle with them. Getting it to work in the antique Alpine 3.3 env needed for SSLv3 took a lot of hassle. Finally I'm at a state that the TLS HELLOs are passed unaltered and accepted.

Now, flipping that one byte to make it go from 1.2 to 1.0 still leads to issues. The Flask / Werkzeug server rejects it as invalid... possibly, maybe... There's no debugging output :D

Work is occuring in the "intercepter" branch, so not yet visible here.

[tsluyter]

I just realized... Right now I'm hand-crafting part of the packet... But I could try triggering on a TLS HELLO and then just have Scapy craft the complete HELLO, instead of trying to fudge with bytes. 🤔 That'll take some more time though.

[tsluyter]

I have managed to get a working MitM performing the TLS downgrade. It's a shame though that now all of my clients are too intelligent and safe :D They notice something's off about the connection and stop working. I'll test a few cases.

EDIT: Yus! It works! /o/

The OpenSSL inside the Docker container is old enough to fall for the downgrade. So that's a nice demo. Plus the fact that all modern browsers will refuse to talk to the box, warning about TLS1.0.

Give me a little while to properly merge everything and clean things up.

[tsluyter]

All that remains is for me to improve upon the write-up! Then we can have you guys test it!

[tsluyter]

Finally, it's done!

@blabla1337 please feel free to take a look at my deliverable :) I have a working container, with active exploitation and a write-up.

[tsluyter]

Made a small bugfix to the dockerfile. Noticed the container wouldn't run 100% properly when built from Windows. Forgot to dos2unix the .sh files.

[tsluyter]

Refactored Dockerfile. Went from a final image of 290MB to 138MB. Nice!

The file Docker\Dockerfile will need testing once you've merged this pull, because it's the one supposed to work with "git clone" instead of building locally.

[tsluyter]

Right. Now I promise I'll stop updating @blabla1337 :D We went from 290MB -> 138 -> 85 -> 77 -> 76. Now I'll leave things for you to test.

[tsluyter]

Any chance of pulling in this particular merge request? Some of my others are more experimental, but this one's really ready for use.

[blabla1337]

Thank you Tess for your contribution! Will give it a try and come with feedback

[tsluyter]

Hi again! I saw that you changed the tls-downgrade lab to build off of Alpine 3.6 instead of 3.3. I initially went for 3.3 because that still had the old, broken OpenSSL. Are you saying the lab fully works on Alpine 3.6 as well? That's interesting!