A guided tour to someone else's network
Email-Based Attacks
So what happens if you hit a dead end and can't find any vulnerable services to attack? What if the network is properly segmented and there is no path from the web server you have compromised to the internal network? Go with email. Because virtually all email clients now handle HTML, multimedia content, and so on, they rely on the underlying system libraries to parse this content.
The bad news is that virtually every HTML rendering engine (WebKit, Gecko, Microsoft HTML Rendering Engine, Microsoft Word, etc.) has exploitable flaws, and most image and multimedia files also have exploitable flaws. If you can sneak a malicious email past the scanners, you can probably cause code execution on the victim's machine.
To make things even easier, you also have the option of attaching a file that targets any number of local programs, currently the more popular ones are Adobe Reader (with many JBIG2-related vulnerabilities), Open Office, and of course, Microsoft Office.
But don't all sites have virus scanning of incoming email and blocking of executable attachments? Well, this is where the information harvested about the target really comes in handy. If you can find a list of the executives, or a company phone directory (which will sometimes even lists the department someone is in), you can craft email messages that look something like the message shown in Figure 6.
Creating Malicious PDF Files
The only reason I am picking on PDFs and not some other file format (such as TIFF, AVI, DOC, and ODT) is that, in the last few months, a lot of easy-to-use tools and exploits for Adobe Reader have been released, and Reader is one of the few applications that is almost guaranteed to be on a system. (If it isn't there, the system probably has an equally vulnerable program, such as Foxit). Oh, and you can embed JavaScript into PDF files (Figure 7) that is executed by default, although you can disable JavaScript support in Acrobat Reader [18].
Didier Stevens has released a tool called make-pdf-javascript.py that allows you to embed arbitrary JavaScript into a PDF file [19]. Fortunately, this tool doesn't do any obfuscation or other tricks to hide the JavaScript, although other tools do. However, I will leave finding them as an exercise for the reader).
One note: You might have to run the script through dos2unix to fix the line breaks, and depending on your version of Python, there is a finally: clause in line 63 that you might need to remove. Just be sure to remove one tab from the line that follows as well and it will run fine.
Bringing It All Together for the Win
Individually, most of these attacks won't get you very far. You might gain access to a web application, read someone's email, or view a file on the server. But by combining techniques, such as writing arbitrary contents to a file and then including that file so that the PHP code within it is executed (Figure 8), an attacker can launch local attacks, of which there are plenty. In the first half of 2009 alone, the Linux kernel has suffered because of several locally exploitable vulnerabilities (ptrace_attach, udev, netlink, and exit_notify) for which exploit code exists publicly (just search Milw0rm for "Linux Kernel").
Exploiting a system via the kernel is particularly effective because a) you know it's installed and b) upgrading a Linux kernel on many web hosts is either a complete pain or simply not possible. Once attackers have the ability to exploit code locally, it's only a matter of time before they can execute code as the root user.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
CarbonOS: A New Linux Distro with a Focus on User Experience
CarbonOS is a brand new, built-from-scratch Linux distribution that uses the Gnome desktop and has a special feature that makes it appealing to all types of users.
-
Kubuntu Focus Announces XE Gen 2 Linux Laptop
Another Kubuntu-based laptop has arrived to be your next ultra-portable powerhouse with a Linux heart.
-
MNT Seeks Financial Backing for New Seven-Inch Linux Laptop
MNT Pocket Reform is a tiny laptop that is modular, upgradable, recyclable, reusable, and ships with Debian Linux.
-
Ubuntu Flatpak Remix Adds Flatpak Support Preinstalled
If you're looking for a version of Ubuntu that includes Flatpak support out of the box, there's one clear option.
-
Gnome 44 Release Candidate Now Available
The Gnome 44 release candidate has officially arrived and adds a few changes into the mix.
-
Flathub Vying to Become the Standard Linux App Store
If the Flathub team has any say in the matter, their product will become the default tool for installing Linux apps in 2023.
-
Debian 12 to Ship with KDE Plasma 5.27
The Debian development team has shifted to the latest version of KDE for their testing branch.
-
Planet Computers Launches ARM-based Linux Desktop PCs
The firm that originally released a line of mobile keyboards has taken a different direction and has developed a new line of out-of-the-box mini Linux desktop computers.
-
Ubuntu No Longer Shipping with Flatpak
In a move that probably won’t come as a shock to many, Ubuntu and all of its official spins will no longer ship with Flatpak installed.
-
openSUSE Leap 15.5 Beta Now Available
The final version of the Leap 15 series of openSUSE is available for beta testing and offers only new software versions.