COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-40

Manipulating Writeable Terminal Devices

This attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded.

Abstraction

Standard

Typical severity

Very High

Likelihood of attack

High

Understand the attack

What is this attack pattern?

Execution flow

How does the attack proceed, step by step?

Explore

Identify attacker-writable terminals

Determine if users TTYs are writable by the attacker.

Techniques used

Determine the permissions for the TTYs found on the system. Any that allow user write to the TTY may be vulnerable.
Attempt to write to other user TTYs. This approach could leave a trail or alert a user.

Exploit

Execute malicious commands

Using one or more vulnerable TTY, execute commands to achieve various impacts.

Techniques used

Commands that allow reading or writing end user files can be executed.

Requirements

What does the attack require?

Prerequisites

User terminals must have a permissive access control such as world writeable that allows normal users to control data on other user's terminals.

Skills required

Low: Ability to discover permissions on terminal devices. Of course, brute force can also be used.

Resources required

Access to a terminal on the target network

Impact

What does a successful attack lead to?

Gain Privileges

Affected scopes: Confidentiality, Access Control, Authorization

Read Data

Affected scopes: Confidentiality

Execute Unauthorized Commands

Affected scopes: Confidentiality, Integrity, Availability

Defence

How is it prevented and mitigated?

Design: Ensure that terminals are only writeable by named owner user and/or administrator

Design: Enforce principle of least privilege

Real world

MITRE example instances

Example instance 1Detail

"Any system that allows other peers to write directly to its terminal process is vulnerable to this type of attack. If the terminals are available through being over-privileged (i.e. world-writable) or the attacker is an administrator, then a series of commands in this format can be used to echo commands out to victim terminals. "$echo -e "\033[30m\033\132" > /dev/ttyXX where XX is the tty number of the user under attack. This will paste the characters to another terminal (tty). Note this technique works only if the victim's tty is world writable (which it may not be). That is one reason why programs like write(1) and talk(1) in UNIX systems need to run setuid." [ REF-1 ] If the victim continues to hit "enter" and execute the commands, there are an endless supply of vectors available to the attacker, copying files, open up network connections, ftp out to servers, and so on.