Proxying WBXML Services

Brad Dixon

2017-09-20

A very typical security assessment and penetration test for Carve involves a device, multiple RF communications interfaces (cellular, WiFi, Bluetooth, ZigBee, some mutant 802.15.4 based stack, etc.) and one or more back-end services. Getting access to all of these interfaces takes a bit of work at times but the payoff makes it worth it, in most cases. Developers seem to assume that esoteric interfaces are more secure but at least in my experience the more bizarre the interface the more likely it is to be vulnerable to attack.

Getting proper access to these interfaces can be challenging at times because the tools that you might otherwise use aren't directly compatible with whatever protocol is in use. A recent project introduced me to an annoying protocol I had not yet worked with before: WAP Binary XML (WBXML). This party-like-it's-1999 era standard provides a binary size-reduced encoding of arbitrary XML documents. Your cell phone likely has an implementation of WBXML supporting ActiveSync and perhaps over-the-air device management. When US carriers brick all of those hapless Galaxy Note 7 phones WBXML will likely deliver the fatal commands.

Sticking the Burp proxy into a WBXML conversation is possible but the binary XML representation limits the usefulness of tool. To help the matter I've created a mitmproxy script that will handle WBXML and XML translation as needed. I created the script for mitmproxy because Burp's Jython scripting can not be used with Python modules that require C libraries.

The proxy is deployed as two instances. One goes in front of Burp to translate WBXML to XML. The other goes after Burp to translate XML to WBXML before transmission to the server.

WBXML + mitmproxy + Burp

All of this proxying does slow transaction speed a bit, of course. Overall the result was favorable and implementation was quick. mitmproxy's auto-reload feature on script updates is a huge time saver that I wish Burp would copy.

#!/usr/bin/env python # Usage: mitmdump -s wbxml.py import sys import traceback from mitmproxy import ctx import wbxml class WBXMLTranslator: def is_translated(self, headers): return 'WBXMLTRANSLATE' in map(lambda x: x.upper(), headers.keys()) def is_wbxml(self, headers): return 'application/vnd.syncml.dm+wbxml' in headers.get('Content-Type', []) def has_headers(self, headers): return headers is not None def request(self, flow): try: if self.has_headers(flow.request.headers): if self.is_wbxml(flow.request.headers): if not self.is_translated(flow.request.headers): # Request from device ctx.log.info( 'Translating device request to server: WBXML to XML') flow.request.headers[ 'WBXMLTranslate'] = 'device request' flow.request.content = wbxml.wbxml_to_xml( flow.request.content) else: # Request going to server ctx.log.info( 'Translating proxy request to server: XML to WBXML') flow.request.headers.pop('WBXMLTranslate') flow.request.content = wbxml.xml_to_wbxml( flow.request.content) except Exception: ctx.log.error('Error translating request: {url}'.format( url=flow.request.pretty_url )) ctx.log.error(traceback.format_exc()) def response(self, flow): try: if self.has_headers(flow.response.headers): if self.is_wbxml(flow.request.headers): if not self.is_translated(flow.request.headers): # Response from server ctx.log.info( 'Translating server response arriving to proxy: WBXML to XML') flow.response.headers[ 'WBXMLTranslate'] = 'Server response' flow.response.content = wbxml.wbxml_to_xml( flow.response.content) else: # Response going to device ctx.log.info( 'Translating server response departing for device: XML to WBXML') flow.response.headers.pop('WBXMLTranslate') flow.response.content = wbxml.xml_to_wbxml( flow.response.content) except Exception: ctx.log.error('Error translating response to: {url}'.format( url=flow.request.pretty_url )) ctx.log.error(traceback.format_exc()) def start(): ctx.log.info('Staring WBXMLTranslator') return WBXMLTranslator() def done(): ctx.log.info("Shutting WBXMLTranslator script down.") if __name__ == "__main__": print('This script should be executed as a mitmproxy script') sys.exit(1)