Re-added ECDSA support in Windows agent.
Ylian Saint-Hilaire committed
Dec 15, 2018 at 12:34 UTC
52053fbabd8cfe037f14ab59072a219f06b7566e
9 files changed
+21
-11
agents/MeshCmd-signed.exe
Binary files a/agents/MeshCmd-signed.exe and b/agents/MeshCmd-signed.exe differ
agents/MeshCmd64-signed.exe
Binary files a/agents/MeshCmd64-signed.exe and b/agents/MeshCmd64-signed.exe differ
agents/MeshService-signed.exe
Binary files a/agents/MeshService-signed.exe and b/agents/MeshService-signed.exe differ
agents/MeshService.exe
Binary files a/agents/MeshService.exe and b/agents/MeshService.exe differ
agents/MeshService64-signed.exe
Binary files a/agents/MeshService64-signed.exe and b/agents/MeshService64-signed.exe differ
agents/MeshService64.exe
Binary files a/agents/MeshService64.exe and b/agents/MeshService64.exe differ
meshagent.js
+19
-10
@@ -197,8 +197,13 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
197
if ((msg.length != 98) || ((obj.receivedCommands & 1) != 0)) return;
198
obj.receivedCommands += 1; // Agent can't send the same command twice on the same connection ever. Block DOS attack path.
199
200
- // Check that the server hash matches our own web certificate hash (SHA384)
201
- if ((getWebCertHash(obj.domain) != msg.substring(2, 50)) && (getWebCertFullHash(obj.domain) != msg.substring(2, 50))) { console.log('Agent bad web cert hash (Agent:' + (new Buffer(msg.substring(2, 50), 'binary').toString('hex').substring(0, 10)) + ' != Server:' + (new Buffer(getWebCertHash(obj.domain), 'binary').toString('hex').substring(0, 10)) + ' or ' + (new Buffer(getWebCertFullHash(obj.domain), 'binary').toString('hex').substring(0, 10)) + '), holding connection (' + obj.remoteaddrport + ').'); return; }
200
+ if (obj.args.ignoreagenthashcheck === true) {
201
+ // Send the agent web hash back to the agent
202
+ obj.send(obj.common.ShortToStr(1) + msg.substring(2, 50) + obj.nonce); // Command 1, hash + nonce. Use the web hash given by the agent.
203
+ } else {
204
+ // Check that the server hash matches our own web certificate hash (SHA384)
205
+ if ((getWebCertHash(obj.domain) != msg.substring(2, 50)) && (getWebCertFullHash(obj.domain) != msg.substring(2, 50))) { console.log('Agent bad web cert hash (Agent:' + (new Buffer(msg.substring(2, 50), 'binary').toString('hex').substring(0, 10)) + ' != Server:' + (new Buffer(getWebCertHash(obj.domain), 'binary').toString('hex').substring(0, 10)) + ' or ' + (new Buffer(getWebCertFullHash(obj.domain), 'binary').toString('hex').substring(0, 10)) + '), holding connection (' + obj.remoteaddrport + ').'); return; }
206
+ }
207
208
// Use our server private key to sign the ServerHash + AgentNonce + ServerNonce
209
obj.agentnonce = msg.substring(50, 98);
@@ -285,7 +290,9 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
290
// Start authenticate the mesh agent by sending a auth nonce & server TLS cert hash.
291
// Send 384 bits SHA384 hash of TLS cert public key + 384 bits nonce
292
obj.nonce = obj.parent.crypto.randomBytes(48).toString('binary');
288
- obj.send(obj.common.ShortToStr(1) + getWebCertHash(obj.domain) + obj.nonce); // Command 1, hash + nonce
293
+ if (obj.args.ignoreagenthashcheck !== true) {
294
+ obj.send(obj.common.ShortToStr(1) + getWebCertHash(obj.domain) + obj.nonce); // Command 1, hash + nonce
295
+ }
296
297
// Once we get all the information about an agent, run this to hook everything up to the server
298
function completeAgentConnection() {
@@ -427,13 +434,15 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
434
435
// Verify the agent signature
436
function processAgentSignature(msg) {
430
- // Verify the signature. This is the fast way, without using forge.
431
- const verify = obj.parent.crypto.createVerify('SHA384');
432
- verify.end(new Buffer(getWebCertHash(obj.domain) + obj.nonce + obj.agentnonce, 'binary')); // Test using the private key hash
433
- if (verify.verify(obj.unauth.nodeCertPem, new Buffer(msg, 'binary')) !== true) {
434
- const verify2 = obj.parent.crypto.createVerify('SHA384');
435
- verify2.end(new Buffer(getWebCertFullHash(obj.domain) + obj.nonce + obj.agentnonce, 'binary')); // Test using the full cert hash
436
- if (verify2.verify(obj.unauth.nodeCertPem, new Buffer(msg, 'binary')) !== true) { return false; }
437
+ if (obj.args.ignoreagenthashcheck !== true) {
438
+ // Verify the signature. This is the fast way, without using forge.
439
+ const verify = obj.parent.crypto.createVerify('SHA384');
440
+ verify.end(new Buffer(getWebCertHash(obj.domain) + obj.nonce + obj.agentnonce, 'binary')); // Test using the private key hash
441
+ if (verify.verify(obj.unauth.nodeCertPem, new Buffer(msg, 'binary')) !== true) {
442
+ const verify2 = obj.parent.crypto.createVerify('SHA384');
443
+ verify2.end(new Buffer(getWebCertFullHash(obj.domain) + obj.nonce + obj.agentnonce, 'binary')); // Test using the full cert hash
444
+ if (verify2.verify(obj.unauth.nodeCertPem, new Buffer(msg, 'binary')) !== true) { return false; }
445
+ }
446
}
447
448
// Connection is a success, clean up
meshcentral.js
+1
@@ -246,6 +246,7 @@ function CreateMeshCentralServer(config, args) {
246
if ((obj.args.user != null) && (typeof obj.args.user != 'string')) { delete obj.args.user; }
247
if ((obj.args.ciralocalfqdn != null) && ((obj.args.lanonly == true) || (obj.args.wanonly == true))) { console.log("WARNING: CIRA local FQDN's ignored when server in LAN-only or WAN-only mode."); }
248
if ((obj.args.ciralocalfqdn != null) && (obj.args.ciralocalfqdn.split(',').length > 4)) { console.log("WARNING: Can't have more than 4 CIRA local FQDN's. Ignoring value."); obj.args.ciralocalfqdn = null; }
249
+ if (obj.args.ignoreagenthashcheck === true) { console.log("WARNING: Agent hash checking is being skipped, this is unsafe."); }
250
if (obj.args.port == null || typeof obj.args.port != 'number') { if (obj.args.notls == null) { obj.args.port = 443; } else { obj.args.port = 80; } }
251
if (obj.args.aliasport != null && (typeof obj.args.aliasport != 'number')) obj.args.aliasport = null;
252
if (obj.args.mpsport == null || typeof obj.args.mpsport != 'number') obj.args.mpsport = 4433;
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.2.4-m",
3
+ "version": "0.2.4-n",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",