bvstone

The Brute Force SSL Server Request-inator (tm) - Version 2.0

Posted:

The Brute Force SSL Server Request-inator (tm) - Version 2.0

If you read my previous article about having issues with Microsoft's email servers (both SMTP and API) you may know what this is about.  If not, feel free to read the article here:

My Frustrating 3 Day Journey With Microsoft, Their Cloud Servers and SSL Certificates

But, of course, ignore the code.  Why?  Because this is an update to that code which makes things a lot nicer, easier, and automatic.

We had one customer say that even after applying all of the Certificate Authorities every now and then they were still getting the RC(-23) error.  Well, if this is true, that this means WAR!  (well, not really).

Anyhow, the first thing is mostly the same.  The call to openSSL to retrieve the certificates from Microsoft's servers is as follows:

openssl.bat

for /f "skip=1" %%x in ('wmic os get localdatetime') do if not defined mydate set mydate=%%x

cd "c:\my programs\openssl\v1.0.2d\"
openssl s_client -connect smtp.office365.com:587 -starttls smtp > "\\goliath\IFS\tmp\cas\%mydate%certfile.txt" 

You'll see that the change is we are outputting the Certificate to a folder in the IFS of my Power8 i5 (named goliath... well, it's relative compared to my 515 machine... haha!)

Next, we create the batch file to run the openssl.bat batch file continuously every 5 minutes.  With some testing and updating we were able to get this to work cleaner as well:

runit.bat

@echo off
:start
start /min "openssl" "c:\temp\openssl.bat"
timeout 5
taskkill /fi "windowtitle eq openssl*"
goto start

Before when we were running this we had an annoying DOS window popping up every 5 minutes and making doing anything else impossible.  With some research (it's been YEARS since I've done anything in DOS) we were able to get this to function exactly how we wanted to... in the background!

Now, the biggest change comes with the RPG program we created.  Before it would only test against one certificate.  But now, we have it set up to test against two certificates (the two that we have found so far).  Adding a test for a third or fourth certificate will be super easy since we're using ILE and the program isn't so much of a "quick and dirty" program anymore.

COMPCA2

     H DFTACTGRP(*NO) BNDDIR('BVSTOOLS')
      ****************************************************************
      * Other Prototypes
      ****************************************************************
      /COPY QCOPYSRC,P.IFS
      /COPY QCOPYSRC,P.IFSSTD
      /COPY QCOPYSRC,P.SNDPM
      /COPY QCOPYSRC,P.MAILTOOL
      *
     D getData...
     D                 PR            10i 0
     D  in_file                    1024    Const
     D  out_data                  65535
      *
      *
     D #QCmdExc        PR                  ExtPgm('QCMDEXC')
     D  Cmd                       32000    Const
     D  CmdLen                       15  5 Const
      *
     D beginString     C                   CONST('-----BEGIN CERTIFICATE-----')
     D endString       C                   CONST('-----END CERTIFICATE-----')
     D dir@            S               *
     D data1           S          66535
     D data2           S          66535
     D data3           S          66535
     D data4           S          66535
     D testData        S          66535
     D rc              S             10i 0
     D match1          S             10i 0
     D match2          S             10i 0
     D match3          S             10i 0
     D match4          S             10i 0
     D dontMatch       S             10i 0
     D UD_NAME         S            256
     D TempFullName    S            256
     D fileType        S                   LIKE(st_objtype)
      *
     D QCmdCmd         S           1024    INZ
     D QCmdLength      S             15  5 INZ(%size(QCmdCmd))
      *
     D ErrMsg          S            256    INZ
     D delteFile       S               N   INZ
      *--------------------------------------------------------------*
      /free

       rc = getData('/tmp/ca1.txt':data1);

       if (data1 = ' ');
         #sndpm('No data1 to compare!':'D');
         EXSR $Return;
       endif;

       rc = getData('/tmp/ca2.txt':data2);

       if (data2 = ' ');
         #sndpm('No data2 to compare!':'D');
         EXSR $Return;
       endif;

       //rc = getData('/tmp/ca3.txt':data3);

       //if (data3 = ' ');
       //  #sndpm('No data3 to compare!':'D');
       //  EXSR $Return;
       //endif;

       //rc = getData('/tmp/ca4.txt':data4);

       //if (data4 = ' ');
        // #sndpm('No data4 to compare!':'D');
        // EXSR $Return;
       //endif;

       dir@ = opendir('/tmp/cas');

       if (dir@ = *NULL);
         #sndpm('Directory /tmp/css not found.':'D');
         EXSR $Return;
       endif;

       p_dirent = readdir(dir@);

       dow (p_dirent <> *NULL);
         // %subst(d_name:1:d_namelen) = filename
         UD_NAME = %subst(d_name:1:d_namelen);

         TempFullName = '/tmp/cas/' + UD_NAME;
         fileType = #stmf_getAtt(TempFullName:'type');

         if  (fileType = '*STMF');
           rc = getData(%trim(TempFullName):testData);

           if (testData <> ' ');

             select;
             when (data1 = testData);
               match1 += 1;
             when (data2 = testData);
               match2 += 1;
          // when (data3 = testData);
          //   match3 += 1;
          // when (data4 = testData);
          //   match4 += 1;
             other;
               dontMatch+=1;
               #SndPM('File ' +  %trimr(TempFullName) +
                      ' is DIFFERENT!':'D');
               QCmdCmd = 'CPY OBJ(''' +
                         %trim(TempFullName) +
                         ''') TODIR(''/tmp/cas/different'')';
               callp(e) #QCmdExc(QCmdCmd:%len(%trimr(QCmdCmd)));

               if (#mailtool_init() >= 0);
                 rc = #mailtool_setValue('configuration_file':
                        '/bvstools/bvstone_mailtool.json');
                 rc = #mailtool_loadDefaults();
                 rc = #mailtool_addTORecipient('bvstone@bvstools.com');
                 rc = #mailtool_setValue('subject':'Found Different CA!');
                 rc = #mailtool_setValue('message':'File ' +
                      %trim(TempFullName) +
                      ' is different and copied to ../different subfolder.');
                 rc = #mailtool_sendMail(errMsg);
               endif;

             endsl;

             QCmdCmd = 'RMVLNK OBJLNK(''' +
                       %trim(TempFullName) +
                         ''')';
             callp(e) #QCmdExc(QCmdCmd:%len(%trimr(QCmdCmd)));
           endif; // testdata <> ' '

         endif; // filetype = *STMF

         p_dirent = readdir(dir@);
       enddo;

       closedir(dir@);
       #SndPM('Match1:' + %char(match1) +
              ' - Match2:' + %char(match2) +
          //  ' - Match3:' + %char(match3) +
          //  ' - Match4:' + %char(match4) +
              ' - Not:' + %char(dontMatch):'C');

       exsr $Return;

       //****************************************************************
       // Return
       //*****************************************************************
       BegSr $Return;

         *INLR = *ON;
         return;

       EndSr;
      *//////////////////////////////////////////////////////////////*
      * getData - Get Data                                           *
      *//////////////////////////////////////////////////////////////*
     P getData         B                   EXPORT
      *--------------------------------------------------------------*
     D getData         PI            10i 0
     D  in_file                    1024    Const
     D  out_data                  65535
      *
     D fd1             S             10i 0
     D x               S             10i 0
     D y               S             10i 0
      *--------------------------------------------------------------*
      /free

       fd1 = #openStmf(%trim(in_file));

       if (fd1 >= 0);
         rc = #readStmf(fd1:%addr(out_data):%size(out_data));
       endif;

       if (rc < 0);
         out_data = ' ';
         return -1;
       endif;

       x = %scan(beginString:out_data);

       if (x <=  0);
         out_data = ' ';
         return -1;
       endif;

       y = %scan(endString:out_data);

       if (y <= x);
         out_data = ' ';
         return -1;
       endif;

       out_data = %subst(out_data:x:y-x);

       #closeStmf(fd1);

       return %len(%trimr(out_data));

      /end-free
      *--------------------------------------------------------------*
     P getData         E

So, what did we change?  

First, we added the getData() local subprocedure.  This is used to load a variable with the contents of a certificate file in the IFS (which is passed as a parameter into the subprocedure) and strip out everything between the BEGIN CERTIFICATE and END CERTIFICATE tags.

Right now we're only loading 2 variables. 

Next, spin through all the files in the /tmp/cas subdirectory and compare it with both the certificates we already have loaded in memory.

If we find a difference, we copy it to /tmp/cas/different and send an email to myself using MAILTOOL so that I don't have to sit and watch the program run.  When I get the email, I know I can just go and see what we have.

If we find a difference or not, we then remove the file from the IFS so it won't be processed again. 

Sort of like fishing, eh?

Finally, our last program is a simple CL that calls the COMPCA2 program every 10 minutes.

COMPCA2CL

             PGM
LOOP:
             CALL       PGM(COMPCA2)
             DLYJOB     DLY(600)
             GOTO       CMDLBL(LOOP)

             ENDPGM

With the DOS batch program running every 5 seconds to grab the CAs from the servers and COMPCA2 running every 10 minutes hopefully we will find out one way or another what's going on with Microsoft's SMTP server and their certificates.  Hopefully before Microsoft bans our IP address since this may look like a DoS attack.


Last edited 01/10/2017 at 18:28:15



Latest Posts:

MAILTOOL Updated to Allow Failed Message on Invalid Recipient MAILTOOL Updated to Allow Failed Message on Invalid Recipient
Posted by May 20, 2018
BVSTools >> BVSTools Announcements >> eMail Tool (MAILTOOL) Specific Announcements
Non HTTPS Callbacks Removed from GreenTools for G Suite (G4G) Non HTTPS Callbacks Removed from GreenTools for G Suite (G4G)
Posted by April 15, 2018
BVSTools >> BVSTools Announcements >> GreenTools for G Suite (Google Apps) (G4G) Specific Announcements
IBM i Related Survey Available IBM i Related Survey Available
Posted by April 7, 2018
IBM Power Systems >> (QGPL) IBM i
BVSTools Releases Braintree Webhook Open Source Application - Node.js BVSTools Releases Braintree Webhook Open Source Application - Node.js
Posted by April 5, 2018
Programming >> Open Source
BVSTools Now Offering Web Services (BETA) BVSTools Now Offering Web Services (BETA)
Posted by April 3, 2018
BVSTools >> BVSTools Announcements
Creating a Reverse SSL Proxy Using RPG on the IBM i - Part 2 Creating a Reverse SSL Proxy Using RPG on the IBM i - Part 2
Posted by March 29, 2018
Programming >> Web Programming
Still on V7R1 or Earlier?  Here's Why You Should Upgrade NOW! Still on V7R1 or Earlier? Here's Why You Should Upgrade NOW!
Posted by February 21, 2018
IBM Power Systems >> (QGPL) IBM i
Converting a MMDDYY date format to YYMMDD for Sorting Using SQL Converting a MMDDYY date format to YYMMDD for Sorting Using SQL
Posted by February 16, 2018
Programming >> RPG Programming
Moving All Files from a Google Drive Folder to the Trash Using GreenTools for Google Apps (G4G) Moving All Files from a Google Drive Folder to the Trash Using GreenTools for Google Apps (G4G)
Posted by February 3, 2018
BVSTools >> BVSTools Software Discussion >> GreenTools for G Suite (Google Apps) (G4G) Specific Discussion
Removing Unwanted Characters from a String with RPG Removing Unwanted Characters from a String with RPG
Posted by February 2, 2018
Programming >> RPG Programming
GETURI Version 8.10 Released GETURI Version 8.10 Released
Posted by January 23, 2018
BVSTools >> BVSTools Announcements >> Get URI (GETURI) Specific Announcements
BVSTools is Now a Sponsor of ALLAS400S.com BVSTools is Now a Sponsor of ALLAS400S.com
Posted by January 17, 2018
BVSTools >> BVSTools Announcements
Service Pack SP171219 Released for G4PP v3.10 Service Pack SP171219 Released for G4PP v3.10
Posted by December 20, 2017
BVSTools >> BVSTools Announcements >> GreenTools for PayPal (G4PP) Specific Announcements
GETURI Now Requires Minimum OS of V7R1 or Higher GETURI Now Requires Minimum OS of V7R1 or Higher
Posted by December 12, 2017
BVSTools >> BVSTools Software Discussion >> Get URI (GETURI) Specific Discussion
Need Help Updating Your Software Versions?  We Can Help. Need Help Updating Your Software Versions? We Can Help.
Posted by December 8, 2017
BVSTools >> BVSTools Announcements

Reply




Copyright 1983-2018 BVSTools
GreenBoard(v3) Powered by the eRPG SDK, MAILTOOL Plus!, GreenTools for Google Apps, jQuery, jQuery UI, BlockUI, CKEditor and running on the IBM i (AKA AS/400, iSeries, System i).