COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-40

Manipulating Writeable Terminal Devices

This attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded.

Soyutlama

Standard

Tipik ciddiyet

Very High

Saldırı ihtimali

High

Saldırıyı anla

Bu saldırı kalıbı nedir?

This attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Identify attacker-writable terminals

Determine if users TTYs are writable by the attacker.

Kullanılan teknikler

  • Determine the permissions for the TTYs found on the system. Any that allow user write to the TTY may be vulnerable.
  • Attempt to write to other user TTYs. This approach could leave a trail or alert a user.
2

Exploit

Execute malicious commands

Using one or more vulnerable TTY, execute commands to achieve various impacts.

Kullanılan teknikler

  • Commands that allow reading or writing end user files can be executed.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • User terminals must have a permissive access control such as world writeable that allows normal users to control data on other user's terminals.

Gerekli beceri

  • Low: Ability to discover permissions on terminal devices. Of course, brute force can also be used.

Gerekli kaynak

  • Access to a terminal on the target network

Etki

Başarılı saldırı neye yol açar?

Gain Privileges

Etkilenen alanlar: Confidentiality, Access Control, Authorization

Read Data

Etkilenen alanlar: Confidentiality

Execute Unauthorized Commands

Etkilenen alanlar: Confidentiality, Integrity, Availability

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Design: Ensure that terminals are only writeable by named owner user and/or administrator
2
Design: Enforce principle of least privilege

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
"Any system that allows other peers to write directly to its terminal process is vulnerable to this type of attack. If the terminals are available through being over-privileged (i.e. world-writable) or the attacker is an administrator, then a series of commands in this format can be used to echo commands out to victim terminals. "$echo -e "\033[30m\033\132" > /dev/ttyXX where XX is the tty number of the user under attack. This will paste the characters to another terminal (tty). Note this technique works only if the victim's tty is world writable (which it may not be). That is one reason why programs like write(1) and talk(1) in UNIX systems need to run setuid." [ REF-1 ] If the victim continues to hit "enter" and execute the commands, there are an endless supply of vectors available to the attacker, copying files, open up network connections, ftp out to servers, and so on.
CAPEC-40: Manipulating Writeable Terminal Devices — DayBreach Saldırı Sözlüğü · DayBreach