# Abusing Application Layer Gateways (NAT Slipstreaming)

SIP ALG on consumer routers rewrites Contact headers, letting an internal host open an arbitrary firewall port to an external fake SIP server.

- Payout: Research
- Severity: high
- Program: SIP ALG routers
- Write-up by: Johann Rehberger
- Disclosed: 2020-11-24
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2020/nat-slipstreaming-simplified/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2020-nat-slipstreaming-simplified
- Tags: area:devices domain:network impact:internal-access kind:research platform:research sev:high tech:payment technique:source-review vuln:access-control vuln:misconfiguration

**Target:** Router Application Layer Gateway (SIP)
**Root cause:** SIP ALG blindly rewrites internal IPs in Contact headers and opens pinholes for the advertised port, trusting attacker-controlled SIP REGISTER content.
**Steps:**
1. Run fake SIP server (natty-slipstream) on external host port 5060
2. Send `REGISTER sip:example.org;transport=TCP SIP/2.0` with `Contact: <sip:wuzzi@192.168.0.141:1433;...>` from internal host
3. ALG rewrites internal IP to router public IP and forwards to server
4. Server replies `200 OK` with Contact pointing to its public IP:44444
5. Router rewrites back and opens port 1433 externally for ~2 minutes
6. Connect to router public IP:1433 from outside
**How found:** Built on Samy Kamkar's NAT Slipstreaming research; implemented a fake SIP server and clients to test whether ALG would rewrite Contact headers and open pinholes, noting the router tolerated malformed headers.
**Exploitation:** Attacker (or malicious webpage via browser) triggers a SIP REGISTER from inside the network; the ALG opens the requested internal port to the external server's IP, exposing internal services like MSSQL 1433 to the internet for ~2 minutes.
**Insight:** SIP ALG parses attacker-controlled Contact/Via headers and opens pinholes for the port in the Contact URI — target the port field of Contact to expose arbitrary internal services, and note routers often accept malformed SIP headers.