2

I am working on the security analysis of a system and some of it's security measurements are based on the Environment.TickCount property exposed by the .NET Framework. As stated by Microsoft:

Because the value of the TickCount property value is a 32-bit signed integer, if the system runs continuously, TickCount will increment from zero to Int32.MaxValue for approximately 24.9 days, then jump to Int32.MinValue, which is a negative number, then increment back to zero during the next 24.9 days. You can work around this issue by calling the Windows GetTickCount function, which resets to zero after approximately 49.7 days, or by calling the GetTickCount64 function.

So when knowning the estimated uptime of the server one could roughly estimate the value of Environment.TickCount too. This would weaken the security of the system significantly. A brute-force attack on the complete range of possible TickCount values would take an estimated 2 and a half days with my current implementation (which is not very long either), a ballpark value to pick a starting point in the value-space would make this search much more efficient.

The server is running fully patched Windows Server 2012 R2 and the only exposed service would be IIS serving some ASP.NET pages (maybe IIS leaks some of this information).

Improve this question

2 Answers 2

Reset to default
2

TCP Timestamps can potentially be used to estimate uptime for Windows 2012. Nmap still uses this technique to guess uptimes.

Disabling this feature can have performance impacts, so it is often left open.

Improve this answer
5
  • I will try that. I actually have administrative access to the server too so i could verify the results. Thanks for the input!
    – Jonas Köritz
    Commented Dec 5, 2016 at 22:15
  • 1
    nmap did the trick! Even an uptime measured in days with 3 decimal places was close enough to cut my Bruteforce time down to about 15 seconds.
    – Jonas Köritz
    Commented Dec 8, 2016 at 20:31
  • @JonasKöritz don't let this lie dormant! I smell a great research paper and presentation in what you've found! Mention Sec.SE :)
    – schroeder ♦
    Commented Dec 8, 2016 at 21:56
  • Nah, its just a vulnerability (broken AES-256 implementation/decimated keyspace) in some proprietary software. I am currently trying to contact the vendor to fix this issue. I will write a blog post on the complete attack and the mitigation as soon as the problem is fixed and totally will mention your answer ;)
    – Jonas Köritz
    Commented Dec 8, 2016 at 22:15
  • @JonasKöritz let me know when you publish - I'd be very interested to read it. My profile here has ways to contact me outside of SE.
    – schroeder ♦
    Commented Dec 9, 2016 at 7:06
-1

If the question is how to get a remote computer's uptime remotely when you have access to the computer, you can obtain this information from WMI in PowerShell directly. For example:

[Management.ManagementDateTimeConverter]::ToDateTime(
  (Get-WmiObject Win32_OperatingSystem -ComputerName computername).LastBootUpTime
)

If the question is, "how can I get the exact uptime of a remote Windows machine without authenticating on that remote machine," the answer is "you cannot." (That would be an unintended information disclosure.)

[Edit: Added the qualifier "exact" to the previous paragraph. It may be possible to estimate uptime using TCP timestamps if the administrator has not disabled this.]

Improve this answer
9
  • An unauthenticated option would be more welcome, the server will be accessed via internet.
    – Jonas Köritz
    Commented Dec 5, 2016 at 21:17
  • I don't think you can get this information without authenticating (wouldn't that be asking for a security hole as a feature?).
    – user132534
    Commented Dec 5, 2016 at 21:19
  • 3
    I'm going to downvote this. Given the attack scenario described in the question, I will retract my downvote if you show how to use this in an unauthenticated way over the sever's public ports. (clearly if the attacker had admin credentials, they wouldn't need to brute-force anything now would they)
    – Mike Ounsworth
    Commented Dec 5, 2016 at 21:19
  • I guess I don't understand the purpose, then? If the question is "how do you get uptime from a remote Windows machine without authenticating," then the answer is, "you can't."
    – user132534
    Commented Dec 5, 2016 at 21:21
  • @user132534 see my answer for a way to get uptimes from a remote machine
    – schroeder ♦
    Commented Dec 5, 2016 at 21:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .