Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: curl and SSPI SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
curl and SSPI

There's an interesting comment on Xavier's diary entry "Keep an Eye on Command-Line Browsers" (paraphrasing): a proxy with authentication will prevent wget and curl to access the Internet because they don't do integrated authentication.

It just happens that since a couple of months, I use curl on Windows with SSPI to authenticate to a proxy. I use the following command:

curl --proxy proxyname:proxyport --proxy-ntlm -U : https://isc.sans.edu

First, you need a version of curl with SSPI support:

Windows 10's version of curl does support SSPI.

With this, I can connect to my proxy (--proxy) and authenticate (--proxy-ntlm) without having the provide credentials to authenticate to the proxy (-U :). curl will use an SSPI to perform integrated authentication to the proxy. This is explained on curl's man page:

If you use a Windows SSPI-enabled curl binary and do either Negotiate or NTLM authentication then you can tell curl to select the user name and password from your environment by specifying a single colon with this option: "-U :".

curl's SSPI feature can also be used to authenticate to an internal IIS server.

By default, curl will not authenticate to a proxy, but it can be directed to do so via options.

I didn't find a version of wget that supports SSPI. If you know one, or you made one, please post a comment.

 

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

DidierStevens

458 Posts
ISC Handler
Feb 17th 2020
Hi Didier, really frightening. Were common Scipt technics, like MSXML-Object, powershell-Objects or so able to auth against a proxy, or is this curl implementation a new unique "feature"?

Regards,
Ron
Ron

6 Posts
Indeed, ActiveX objects like MSXML2.XMLHTTP and .NET WebClient objects (used in PowerShell, for example) support transparent proxy authentication.

I just looked this up: curl's SSPI feature seems to be introduced in 2005.
DidierStevens

458 Posts
ISC Handler
Thanks, didn't realized this before. So I have to tune my alerting more than I thought in the first place...

Ron
Ron

6 Posts

Sign Up for Free or Log In to start participating in the conversation!