ekoparty 2010 - web application security payloads
DESCRIPTION
Last week, the most important security conference of latin america was held in Buenos Aires where security specialists from all over the world had the chance to get involved with state-of-art techniques, vulnerabilities and tools in a relaxed environment. The sixth edition of ekoparty brought together over 750 security specialists from around the world in the most deep-knowledge technical conference of the region.Among the lectures, Bonsai Information Security presented “Web Application Security Payloads”. This research led by Andres Riancho and Lucas Apa, exploits a new concept in a theorical and practical environment. Part of this research explores how to distinguish the system calls involved in a web application vulnerability and then leverage it’s power to get sensitive information in an automated way.The “Web Application Security Payloads” implementation was developed as a part of the w3af framework, an Open Source Web application attack and audit framework developed by contributors around the world since 2007 and directed by Andrés Riancho.Between some other long waited talks, Juliano Rizzo & Thai Duong presented “Padding Oracles Everywhere” where they easely exposed a 0day advanced technique to decrypt and tamper ASP.NET sensitive data.TRANSCRIPT
Web ApplicationSecurity Payloads
http://www.bonsai-sec.com/
Andrés Riancho – Lucas Apa
Ekoparty 2010
2
Web Application Security Payloads
[email protected]$ whoami Consultant @ Bonsai Information Security
Penetration Testing y Vulnerability Research
Web Application Security enthusiast
3
Web Application Security Payloads
[email protected]$ whoami Founder @ Bonsai Information Security
Director of Web Security @ Rapid7
Programmer (python!)
Open Source Evangelist
Deep knowledge in networking , design and IPS evasion.
Project leader: open source w3af
4
Web Application Security Payloads
w3af w3af is a Web Application Attack and Audit Framework
Open Source tool (GPLv2.0) to detect and exploit Web vulnerabilities.
Plugin based architecture, easely extensible.
Development started late 2006 on my spare time, and growing tillpresent, moment in which we have multiple contributors round theglobe and a full time developer on our office.
5
Web Application Security Payloads
6
Web Application Security Payloads
Actual Situation Exploitation frameworks like Metasploit provides mainly “payloads”
to use specially on the best case, in other words, when there iscontrol on the execution flow. (“exploit for buffer overflow”).
Web applications allows us, depending on the vulnerability, tointeract with the system in a particular way:
Local file read
File write
SQL Commands execution
OS Commands execution
Till now, Which steps of post-exploitation can we make in anautomatized way in an environment where we can´t execute OS system commands?
7
Web Application Security Payloads
Actual Situation Additionally, Web vulnerabilities are mutating every time faster
making their post exploitation leading to have no starting or final objective defined.
Many different automatized tools are focusing in the particular, in exploiting a vulnerability emphasizing on the how.
Not defined which information is going to be compromised. Thevulnerabilities expires or changes.
8
Web Application Security Payloads
Web Application Security Payloads
9
Web Application Security Payloads
Small pieces of code running in w3af after exploiting one or moreknown vulnerabilities.
Every payload is independent of the discovered vulnerabilities. By themeans the exploit exports “System Calls”, that are then used bypayloads:
Design
Exploit System calls exported System calls emulated
Local file read read()
Local file include read()
OS Commanding execute() read() , write() , unlink()
DAV Shell write() execute() , read(), unlink()
File Upload write() execute() , read(), unlink()
10
Web Application Security Payloads
Payloads are in general 100 lines of code that uses some system calls,like for example “running_vm”:
Design
~53 Payloads developed
12
Web Application Security Payloads
Demo #1:“users”
13
Web Application Security Payloads
Sinergy between payloadsre
ad() System call to
read files use
rs Payload thatreads/etc/passwdand identifieshome directories
use
rs_c
on
fig_
file
s Payload whichuses theknowledgegained of home directories and looks forconfigurationfiles there.
14
Web Application Security Payloads
Demo #2:Sinergy between
payloads: “users_config_files”
15
Web Application Security Payloads
Demo #3:Integration with w3af:
“get_source_code”
16
Web Application Security Payloads
Conclusions and pending work Conceptualize this idea as an standar in automatized post-
explotación over Web Applications.
Develop more payloads for Windows environments.
Research about syscall hooking and remote syscall delivery by Web Applications Payloads.
Syscall Hierachy Priority : when exists more than one syscall, whichone we use to communicate with the remote system? Faster? More privileged?
Contribute with the global community discovering new attacktechniques through minimalistic post-exploitation approaches, expanding the information they gather.
17
Web Application Security Payloads
¿Doubts?¿Questions?
18
Web Application Security Payloads
Thank you!