COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-132

Symlink Attack

An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

Low

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.

Genişletilmiş açıklama

The endpoint file may be either output or input. If the file is output, the result is that the endpoint is modified, instead of a file at the intended location. Modifications to the endpoint file may include appending, overwriting, corrupting, changing permissions, or other modifications. In some variants of this attack the adversary may be able to control the change to a file while in other cases they cannot. The former is especially damaging since the adversary may be able to grant themselves increased privileges or insert false information, but the latter can also be damaging as it can expose sensitive information or corrupt or destroy vital system or application files. Alternatively, the endpoint file may serve as input to the targeted application. This can be used to feed malformed input into the target or to cause the target to process different information, possibly allowing the adversary to control the actions of the target or to cause the target to expose information to the adversary. Moreover, the actions taken on the endpoint file are undertaken with the permissions of the targeted user or application, which may exceed the permissions that the adversary would normally have.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Identify Target

Adversary identifies the target application by determining whether there is sufficient check before writing data to a file and creating symlinks to files in different directories.

Kullanılan teknikler

  • The adversary writes to files in different directories to check whether the application has sufficient checking before file operations.
  • The adversary creates symlinks to files in different directories.
2

Experiment

Try to create symlinks to different files

The adversary then uses a variety of techniques, such as monitoring or guessing to create symlinks to the files accessed by the target application in the directories which are identified in the explore phase.

Kullanılan teknikler

  • The adversary monitors the file operations performed by the target application using a tool like dtrace or FileMon. And the adversary can delay the operations by using "sleep(2)" and "usleep()" to prepare the appropriate conditions for the attack, or make the application perform expansive tasks (large files parsing, etc.) depending on the purpose of the application.
  • The adversary may need a little guesswork on the filenames on which the target application would operate.
  • The adversary tries to create symlinks to the various filenames.
3

Exploit

Target application operates on created symlinks to sensitive files

The adversary is able to create symlinks to sensitive files while the target application is operating on the file.

Kullanılan teknikler

  • Create the symlink to the sensitive file such as configuration files, etc.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The targeted application must perform the desired activities on a file without checking whether the file is a symbolic link or not. The adversary must be able to predict the name of the file the target application is modifying and be able to create a new symbolic link where that file would appear.

Gerekli beceri

  • Low: To create symlinks
  • High: To identify the files and create the symlinks during the file operation time window

Gerekli kaynak

  • None: No specialized resources are required to execute this type of attack. The only requirement is the ability to create the necessary symbolic link.

Etki

Başarılı saldırı neye yol açar?

Other

Etkilenen alanlar: Confidentiality

Modify Data

Etkilenen alanlar: Integrity

Read Data

Etkilenen alanlar: Confidentiality

Modify Data

Etkilenen alanlar: Integrity

Execute Unauthorized Commands

Etkilenen alanlar: Authorization

Gain Privileges

Etkilenen alanlar: Accountability, Authentication, Authorization, Non-Repudiation

Bypass Protection Mechanism

Etkilenen alanlar: Access Control, Authorization

Unreliable Execution

Etkilenen alanlar: Availability

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Design: Check for the existence of files to be created, if in existence verify they are neither symlinks nor hard links before opening them.
2
Implementation: Use randomly generated file names for temporary files. Give the files restrictive permissions.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
The adversary creates a symlink with the "same" name as the file which the application is intending to write to. The application will write to the file- "causing the data to be written where the symlink is pointing". An attack like this can be demonstrated as follows: root# vulprog myFile {...program does some processing...] adversary# ln –s /etc/nologin myFile [...program writes to 'myFile', which points to /etc/nologin...] In the above example, the root user ran a program with poorly written file handling routines, providing the filename "myFile" to vulnprog for the relevant data to be written to. However, the adversary happened to be looking over the shoulder of "root" at the time, and created a link from myFile to /etc/nologin. The attack would make no user be able to login.
CAPEC-132: Symlink Attack — DayBreach Saldırı Sözlüğü · DayBreach