Or… Yet Another GPO Bypass Technique.
On occasion I get given the task of testing a client’s website using the terminal provided by said client in order to in the client’s words “Prove what a malicious user can do with the tools we give them”.
So in order to not drive myself mental trying to pentest a web app manually in IE, without being able to change any settings. I work out a way to get burpsuite on the box.
The beautiful thing about burpsuite being that it’s JAVA and java.exe happens to be one chuffing huge hole with endpoint protection mechanisms and application whitelisting.
Okay so problem 1 solved.
Onto problem 2 now, they lock down their “connections” tab in internet settings but as we already know how to bypass whatever pre-existing proxy connection they have and replace it with our own burpsuite details using a little VBA and the techniques given in this post this is no longer a problem.
Problems always come in threes so what is problem 3 you ask?
This:
Me: O RLY?
Or more specifically, the distinct lack of a “continue” link to allow us to ignore the self signed cert warning and continue with our traffic being intercepted by our burpsuite proxy.
This situation is actually a product of the following GPO setting:
Anyone who’s been around any length of time with IE probably already knows that this error page is a resource loaded from a local dll. This is true for every “friendly http error” message you get in IE.
Question is, how does the DLL know not to show the “continue” message?
It does it by a variable within the URI, what variable? the “PreventIgnoreCertErrors” variable. This variable is usually not shown with the error message unless the GPO setting is set to enabled.
So you know what is coming next, yup. Copy Pasta my friends, So copy & paste and remember to change the damn variable to 0 before taking a screenshot 😉
and hit enter.
And finally, do what the message says, click continue…
Me: Ya… Wai.
Voila! Now you can test with your self-signed burp certificates or bypass yet another security control (that is actually a fairly wise one to have) on your network.
One reply on “NFAL – Episode Three: Testing websites while on locked down clients”
Incidentally the website featured in the screenshots is not a client of mine. It’s the first hit in google when you search for “testing self-signed ssl certificates” and given as an example link.