COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-76

Manipulating Web Input to File System Calls

An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

Soyutlama

Detailed

Tipik ciddiyet

Very High

Saldırı ihtimali

High

Saldırıyı anla

Bu saldırı kalıbı nedir?

An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Fingerprinting of the operating system

In order to create a valid file injection, the attacker needs to know what the underlying OS is so that the proper file seperator is used.

Kullanılan teknikler

  • Port mapping. Identify ports that the system is listening on, and attempt to identify inputs and protocol types on those ports.
  • TCP/IP Fingerprinting. The attacker uses various software to make connections or partial connections and observe idiosyncratic responses from the operating system. Using those responses, they attempt to guess the actual operating system.
  • Induce errors to find informative error messages

Survey the Application to Identify User-controllable Inputs

The attacker surveys the target application to identify all user-controllable inputs, possibly as a valid and authenticated user

Kullanılan teknikler

  • Spider web sites for all available links, entry points to the web site.
  • Manually explore application and inventory all application inputs
2

Experiment

Vary inputs, looking for malicious results

Depending on whether the application being exploited is a remote or local one, the attacker crafts the appropriate malicious input containing the path of the targeted file or other file system control syntax to be passed to the application

Kullanılan teknikler

  • Inject context-appropriate malicious file path using network packet injection tools (netcat, nemesis, etc.)
  • Inject context-appropriate malicious file path using web test frameworks (proxies, TamperData, custom programs, etc.) or simple HTTP requests
  • Inject context-appropriate malicious file system control syntax
3

Exploit

Manipulate files accessible by the application

The attacker may steal information or directly manipulate files (delete, copy, flush, etc.)

Kullanılan teknikler

  • The attacker injects context-appropriate malicious file path to access the content of the targeted file.
  • The attacker injects context-appropriate malicious file system control syntax to access the content of the targeted file.
  • The attacker injects context-appropriate malicious file path to cause the application to create, delete a targeted file.
  • The attacker injects context-appropriate malicious file system control syntax to cause the application to create, delete a targeted file.
  • The attacker injects context-appropriate malicious file path in order to manipulate the meta-data of the targeted file.
  • The attacker injects context-appropriate malicious file system control syntax in order to manipulate the meta-data of the targeted file.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • Program must allow for user controlled variables to be applied directly to the filesystem

Gerekli beceri

  • Low: To identify file system entry point and execute against an over-privileged system interface

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Gain Privileges

Etkilenen alanlar: Confidentiality, Access Control, Authorization

Modify Data

Etkilenen alanlar: Integrity

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Design: Enforce principle of least privilege.
2
Design: Ensure all input is validated, and does not contain file system commands
3
Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.
4
Design: For interactive user applications, consider if direct file system interface is necessary, instead consider having the application proxy communication.
5
Implementation: Perform testing such as pen-testing and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
The attacker uses relative path traversal to access files in the application. This is an example of accessing user's password file. http://www.example.com/getProfile.jsp?filename=../../../../etc/passwd However, the target application employs regular expressions to make sure no relative path sequences are being passed through the application to the web page. The application would replace all matches from this regex with the empty string. Then an attacker creates special payloads to bypass this filter: http://www.example.com/getProfile.jsp?filename=%2e%2e/%2e%2e/%2e%2e/%2e%2e /etc/passwd When the application gets this input string, it will be the desired vector by the attacker.
CAPEC-76: Manipulating Web Input to File System Calls — DayBreach Saldırı Sözlüğü · DayBreach