Think differently about database hacking SELECT presenter FROM - - PowerPoint PPT Presentation

▶
think differently about database hacking
SMART_READER_LITE
LIVE PREVIEW

Think differently about database hacking SELECT presenter FROM - - PowerPoint PPT Presentation

Oct 20, 2023 264 likes •1.27k views

Think differently about database hacking SELECT presenter FROM DeepSecSpeakers WHERE name = Lszl Tth ' and ' Ferenc Spala ' or 1=1-- 29/11/2012 @ DeepSec 2012 Thursday, November 29, 12 Who are we? @Work: Deloitte . Hungary Pentests,

slide-1
SLIDE 1

Think differently about database hacking

SELECT presenter FROM DeepSecSpeakers WHERE name = László Tóth' and 'Ferenc Spala' or 1=1-- 29/11/2012 @ DeepSec 2012

Thursday, November 29, 12

slide-2
SLIDE 2

Who are we?

  • @Work: Deloitte. Hungary

Pentests, Security audits, Config reviews, Consulting ...

  • László
  • 12+ years itsec
  • 5+ years Oracle research
  • Ferenc
  • 5+ years itsec
  • 3+ years database security
  • Members of Hacktivity Team
  • Co-founders of Hekkcamp

Thursday, November 29, 12

slide-3
SLIDE 3

Where does the fun begin?

  • Hacking the Oracle client
  • Hijacking database connections
  • Metasploit feat. oradebug
  • Using oradebug to get Meterpreter session
  • Using Metasploit to run oradebug commands
  • Playing with MSSQL connections

Client world Network world Server world MS world

Thursday, November 29, 12

slide-4
SLIDE 4

Hacking the Oracle client

if you play with DLL injection you may find dirty things in the OCI driver

Part 1

Thursday, November 29, 12

slide-5
SLIDE 5

What’s the point?

  • DLL injection is pretty old
  • The OCI driver ships with symbol file
  • Hijacking the “connect” function is

boring

T h e l

  • g
  • i

s a r e g i s t e r e d t r a d e m a r k

  • f

K F C

Thursday, November 29, 12

slide-6
SLIDE 6

Fancy, huh?

  • Debug the OCI driver
  • Get the interesting functions
  • Do some memory kung-fu
  • Wrap-up your DLL
  • Get/Write an injector & apply your hooks
  • Enjoy the silence

Thursday, November 29, 12

slide-7
SLIDE 7

Fancy, huh?

  • Debug the OCI driver
  • Get the interesting functions
  • Do some memory kung-fu
  • Wrap-up your DLL
  • Get/Write an injector & apply your hooks
  • Enjoy the silence

Beware when x64 in scope!

Thursday, November 29, 12

slide-8
SLIDE 8

Fancy, huh?

  • Debug the OCI driver
  • Get the interesting functions
  • Do some memory kung-fu
  • Wrap-up your DLL
  • Get/Write an injector & apply your hooks
  • Enjoy the silence

Beware when x64 in scope! OCIAttrSet, OCIServerAttach

Thursday, November 29, 12

slide-9
SLIDE 9

Fancy, huh?

  • Debug the OCI driver
  • Get the interesting functions
  • Do some memory kung-fu
  • Wrap-up your DLL
  • Get/Write an injector & apply your hooks
  • Enjoy the silence

Beware when x64 in scope! OCIAttrSet, OCIServerAttach Follow the pointer that points a pointer....

Thursday, November 29, 12

slide-10
SLIDE 10

Fancy, huh?

  • Debug the OCI driver
  • Get the interesting functions
  • Do some memory kung-fu
  • Wrap-up your DLL
  • Get/Write an injector & apply your hooks
  • Enjoy the silence

Beware when x64 in scope! OCIAttrSet, OCIServerAttach Follow the pointer that points a pointer.... Different DLLs for different archs!

Thursday, November 29, 12

slide-11
SLIDE 11

Fancy, huh?

  • Debug the OCI driver
  • Get the interesting functions
  • Do some memory kung-fu
  • Wrap-up your DLL
  • Get/Write an injector & apply your hooks
  • Enjoy the silence

Beware when x64 in scope! OCIAttrSet, OCIServerAttach Follow the pointer that points a pointer.... Can be tricky in x64 envs! Different DLLs for different archs!

Thursday, November 29, 12

slide-12
SLIDE 12

Fancy, huh?

  • Debug the OCI driver
  • Get the interesting functions
  • Do some memory kung-fu
  • Wrap-up your DLL
  • Get/Write an injector & apply your hooks
  • Enjoy the silence

Beware when x64 in scope! OCIAttrSet, OCIServerAttach Follow the pointer that points a pointer.... Can be tricky in x64 envs! Most of the time you get nothing! Different DLLs for different archs!

Thursday, November 29, 12

slide-13
SLIDE 13

So, what’s the point??

Get the username and the password from a single

SQL statement execution

S

  • u

r c e : h t t p : / / 9 g a g . c

  • m

Thursday, November 29, 12

slide-14
SLIDE 14

So, what’s the point??

Get the username and the password from a single

SQL statement execution

S

  • u

r c e : h t t p : / / 9 g a g . c

  • m

OCIStmtExecute is your friend

Thursday, November 29, 12

slide-15
SLIDE 15

How?

Thursday, November 29, 12

slide-16
SLIDE 16

How?

Thursday, November 29, 12

slide-17
SLIDE 17

How?

Thursday, November 29, 12

slide-18
SLIDE 18

Where is my golden egg?

Thursday, November 29, 12

slide-19
SLIDE 19

Where is my golden egg?

Thursday, November 29, 12

slide-20
SLIDE 20

Where is my golden egg?

Points to the username

Thursday, November 29, 12

slide-21
SLIDE 21

Where is my golden egg?

Points to the username Length of the username

Thursday, November 29, 12

slide-22
SLIDE 22

Where is my golden egg?

Points to the username Length of the username Marker

Thursday, November 29, 12

slide-23
SLIDE 23

Where is my golden egg?

Points to the username Length of the username Marker Encryption key

Thursday, November 29, 12

slide-24
SLIDE 24

Where is my golden egg?

Points to the username Length of the username Marker Encryption key Encrypted password

Thursday, November 29, 12

slide-25
SLIDE 25

Who should I shoot at?

This security flaw lies in the OCI driver itself

DEMO

Thursday, November 29, 12

slide-26
SLIDE 26

Hijacking Oracle sessions

all roads lead to us

Part 2

Thursday, November 29, 12

slide-27
SLIDE 27

History

  • In 2009 pytnsproxy was released @ Hacktivity conference by László Tóth
  • Hijacking oracle sessions
  • Downgrading auth protocols
  • Log authentication data for offline brute-force
  • In 2012 tnspoison attack details were revealed by Joxean Koret
  • Great research paper
  • Working PoC

Thursday, November 29, 12

slide-28
SLIDE 28

History

  • In 2009 pytnsproxy was released @ Hacktivity conference by László Tóth
  • Hijacking oracle sessions
  • Downgrading auth protocols
  • Log authentication data for offline brute-force
  • In 2012 tnspoison attack details were revealed by Joxean Koret
  • Great research paper
  • Working PoC

You have to redirect the client, e.g.: arp-cache poisoning

Thursday, November 29, 12

slide-29
SLIDE 29

History

  • In 2009 pytnsproxy was released @ Hacktivity conference by László Tóth
  • Hijacking oracle sessions
  • Downgrading auth protocols
  • Log authentication data for offline brute-force
  • In 2012 tnspoison attack details were revealed by Joxean Koret
  • Great research paper
  • Working PoC

You have to redirect the client, e.g.: arp-cache poisoning It works with SIDs 6 characters long

Thursday, November 29, 12

slide-30
SLIDE 30

What? Listener tnspoison Victim

Thursday, November 29, 12

slide-31
SLIDE 31

What? Listener tnspoison Victim

Connect Resend Connect Accept

Thursday, November 29, 12

slide-32
SLIDE 32

What? Listener tnspoison Victim

Authentication Data

Thursday, November 29, 12

slide-33
SLIDE 33

What? Listener tnspoison Victim

Thursday, November 29, 12

slide-34
SLIDE 34

What? Listener tnspoison Victim

Register Register

Thursday, November 29, 12

slide-35
SLIDE 35

What? Listener tnspoison Victim

Connect Register Register

Thursday, November 29, 12

slide-36
SLIDE 36

What? Listener tnspoison Victim

Connect Redirect Register Register

Thursday, November 29, 12

slide-37
SLIDE 37

What? Listener tnspoison Victim

Connect Redirect Register Register

proxy

Thursday, November 29, 12

slide-38
SLIDE 38

What? Listener tnspoison Victim

Connect Redirect Register Register

proxy

There is no patch!!

Thursday, November 29, 12

slide-39
SLIDE 39
  • You can redirect a certain percentage of the Oracle clients
  • The traffic goes through you so you can do anything with it
  • Sniff it
  • Alter it
  • Send your own SQL commands

What?

Thursday, November 29, 12

slide-40
SLIDE 40
  • You can redirect a certain percentage of the Oracle clients
  • The traffic goes through you so you can do anything with it
  • Sniff it
  • Alter it
  • Send your own SQL commands

What?

This is where pytnsproxy can help you!

Thursday, November 29, 12

slide-41
SLIDE 41

Hijack Listener tnspoison Victim Attacker pytnsproxy

Thursday, November 29, 12

slide-42
SLIDE 42

Hijack Listener tnspoison Victim Attacker

Register

pytnsproxy

Thursday, November 29, 12

slide-43
SLIDE 43

Hijack Listener tnspoison Victim Attacker

Register Register

pytnsproxy

Thursday, November 29, 12

slide-44
SLIDE 44

Hijack Listener tnspoison Victim

Connect

Attacker

Register Register

pytnsproxy

Thursday, November 29, 12

slide-45
SLIDE 45

Hijack Listener tnspoison Victim

Connect Redirect

Attacker

Register Register

pytnsproxy

Thursday, November 29, 12

slide-46
SLIDE 46

Hijack Listener tnspoison Victim

Connect Redirect

Attacker

Register Register

pytnsproxy

Connect Connect

Thursday, November 29, 12

slide-47
SLIDE 47

Hijack Listener tnspoison Victim

Connect Redirect

Attacker

Register Register

pytnsproxy

Connect Connect Authentication Auth

Thursday, November 29, 12

slide-48
SLIDE 48

Hijack Listener tnspoison Victim

Connect Redirect

Attacker

Register Register

pytnsproxy

Connect Connect Authentication Auth Data Data

Thursday, November 29, 12

slide-49
SLIDE 49

Hijack Listener tnspoison Victim

Connect Redirect

Attacker

Register Register

pytnsproxy

Thursday, November 29, 12

slide-50
SLIDE 50

Hijack Listener tnspoison Victim

Connect Redirect

Attacker

Register Register

pytnsproxy

Quit

Thursday, November 29, 12

slide-51
SLIDE 51

Hijack Listener tnspoison Victim

Connect Redirect

Attacker

Register Register

pytnsproxy

Quit

thread

Thursday, November 29, 12

slide-52
SLIDE 52

Hijack Listener tnspoison Victim

Connect Redirect

Attacker

Register Register

pytnsproxy

Quit

thread

  • Conn. simulation

Thursday, November 29, 12

slide-53
SLIDE 53

Hijack Listener tnspoison Victim

Connect Redirect

Attacker

Register Register

pytnsproxy

  • Auth. simulation

Quit

thread

  • Conn. simulation

Thursday, November 29, 12

slide-54
SLIDE 54

Hijack Listener tnspoison Victim

Connect Redirect

Attacker

Register Register

pytnsproxy

  • Auth. simulation

Quit

thread

  • Conn. simulation

Data Data

Thursday, November 29, 12

slide-55
SLIDE 55

Hijack Listener tnspoison Victim

Connect Redirect

Attacker

Register Register

pytnsproxy

  • Auth. simulation

Quit

thread

  • Conn. simulation

Data Data We can use a normal Oracle client here!

Thursday, November 29, 12

slide-56
SLIDE 56

Hijack

You can execute SQL commands in the name of the Victim

DEMO

Thursday, November 29, 12

slide-57
SLIDE 57

Notes

  • You have to use the same client version that the client used
  • Use proxytest/proxytest as username/password for hijacking
  • r use AS SYSDBA :-) (It does not work with the sqldeveloper 3.2)
  • You have an easy to use metasploit module (tnspoison) for SID length 1-12

(all possible length)

  • Global Database ID usage needs further testing

Thursday, November 29, 12

slide-58
SLIDE 58

Oradebug programming language

C64 style backfires

Part 3

Thursday, November 29, 12

slide-59
SLIDE 59

History

  • BlackHat 2011 - David Litchfield showed how to run operating system level

commands

  • Hacktivity 2011 - László Tóth showed how to:
  • Run operating system command in a much simplier way
  • Switch off the auditing without restarting the database
  • Switch off the Oracle password validation on Windows

Thursday, November 29, 12

slide-60
SLIDE 60

What?

  • It is a command that can be called from sqlplus
  • It can be accessed by SYSDBA only
  • It is logged into a trace file that can be deleted by the SYSDBA
  • You can call any function that is accessible from the Oracle executable
  • You can write the Oracle process memory

Thursday, November 29, 12

slide-61
SLIDE 61

What?

  • It is a command that can be called from sqlplus
  • It can be accessed by SYSDBA only
  • It is logged into a trace file that can be deleted by the SYSDBA
  • You can call any function that is accessible from the Oracle executable
  • You can write the Oracle process memory

Yes, you have arbitrary memory write and execution!

Thursday, November 29, 12

slide-62
SLIDE 62

What?

  • SYSDBA audit switched off
  • radebug poke 0x0600340E0 1 0
  • Standard Audit switched off
  • radebug poke 0x060041BA8 2 0
  • Operating system command was run
  • radebug call system "/bin/ls -l>/tmp/ls.txt”

Thursday, November 29, 12

slide-63
SLIDE 63

What?

  • SYSDBA audit switched off
  • radebug poke 0x0600340E0 1 0
  • Standard Audit switched off
  • radebug poke 0x060041BA8 2 0
  • Operating system command was run
  • radebug call system "/bin/ls -l>/tmp/ls.txt”

Addresses depend on the given version!

Thursday, November 29, 12

slide-64
SLIDE 64

What?

  • SYSDBA audit switched off
  • radebug poke 0x0600340E0 1 0
  • Standard Audit switched off
  • radebug poke 0x060041BA8 2 0
  • Operating system command was run
  • radebug call system "/bin/ls -l>/tmp/ls.txt”

Addresses depend on the given version!

Thursday, November 29, 12

slide-65
SLIDE 65

What?

  • SYSDBA audit switched off
  • radebug poke 0x0600340E0 1 0
  • Standard Audit switched off
  • radebug poke 0x060041BA8 2 0
  • Operating system command was run
  • radebug call system "/bin/ls -l>/tmp/ls.txt”

Addresses depend on the given version!

C64 1982 vs Oracle 2012

Thursday, November 29, 12

slide-66
SLIDE 66

What?

Thursday, November 29, 12

slide-67
SLIDE 67

What?

Thursday, November 29, 12

slide-68
SLIDE 68

Easy to use

  • Metasploit module for command execution
  • Metasploit module for payload execution
  • Simulating Linux 32bit client for
  • Linux 11.2.0.3 64 bit
  • Windows 11.2.0.3 64 bit
  • You do not need the Oracle drivers

DEMO

Thursday, November 29, 12

slide-69
SLIDE 69

Hijack Victim Attacker pytnsproxy

thread

Data Data

Thursday, November 29, 12

slide-70
SLIDE 70

Hijack Victim Attacker pytnsproxy

thread

Data Data m e t e r p r e t e r

Thursday, November 29, 12

slide-71
SLIDE 71

Hijack Victim Attacker pytnsproxy

thread

Data Data m e t e r p r e t e r l

  • a

d

  • r

a l

  • g

h

  • k

Thursday, November 29, 12

slide-72
SLIDE 72

Hijack Victim Attacker pytnsproxy

thread

Data Data m e t e r p r e t e r l

  • a

d

  • r

a l

  • g

h

  • k

DB LINK

Thursday, November 29, 12

slide-73
SLIDE 73

Hijack Victim Attacker pytnsproxy

thread

Data Data m e t e r p r e t e r ztvo5pe ztvo5pd l

  • a

d

  • r

a l

  • g

h

  • k

DB LINK

Thursday, November 29, 12

slide-74
SLIDE 74

Hijack Victim Attacker pytnsproxy

thread

Data Data m e t e r p r e t e r ztvo5pe ztvo5pd l

  • a

d

  • r

a l

  • g

h

  • k

g e t l

  • g

fi l e DB LINK

Thursday, November 29, 12

slide-75
SLIDE 75

Hijack Victim Attacker pytnsproxy

thread

Data Data m e t e r p r e t e r ztvo5pe ztvo5pd l

  • a

d

  • r

a l

  • g

h

  • k

g e t l

  • g

fi l e DB LINK

Thursday, November 29, 12

slide-76
SLIDE 76

Notes

  • Combine all the things above get the SYS user password
  • Easy to use metasploit modules
  • Oracle is huge (the windows executable is 130MB), so be careful what you

are doing in the memory

Thursday, November 29, 12

slide-77
SLIDE 77

MSSQL hijack

We do not deal with Oracle only

Part 4

Thursday, November 29, 12

slide-78
SLIDE 78

History

  • Tools to log the authentication data or downgrade the authentication

(e.g.: hatkit_proxy/ms-sql-downgrade.bsh )

  • Metasploit module for harvesting credentials

(July 12th, 2012 by Patrik Karlsson)

  • But until now there was no tool for hijacking

Thursday, November 29, 12

slide-79
SLIDE 79

What? Victim Attacker tdsproxy

Thursday, November 29, 12

slide-80
SLIDE 80

What? Victim Attacker tdsproxy

D a t a A t h e n t i c a t i

  • n

Thursday, November 29, 12

slide-81
SLIDE 81

What? Victim Attacker tdsproxy

Thursday, November 29, 12

slide-82
SLIDE 82

What? Victim Attacker tdsproxy

ARP cache poisoning

Thursday, November 29, 12

slide-83
SLIDE 83

What? Victim Attacker tdsproxy

ARP cache poisoning Data Auth. Authentication Data

Thursday, November 29, 12

slide-84
SLIDE 84

What? Victim Attacker tdsproxy

Data ARP cache poisoning

Thursday, November 29, 12

slide-85
SLIDE 85

What? Victim Attacker tdsproxy

thread

Data ARP cache poisoning

Thursday, November 29, 12

slide-86
SLIDE 86

What? Victim Attacker tdsproxy

  • Auth. simulation

thread

Data ARP cache poisoning

Thursday, November 29, 12

slide-87
SLIDE 87

What? Victim Attacker tdsproxy

  • Auth. simulation

thread

Data Data ARP cache poisoning

Thursday, November 29, 12

slide-88
SLIDE 88

What? Victim Attacker tdsproxy

  • Auth. simulation

thread

Data Data We can use a normal mssql client here! ARP cache poisoning

Thursday, November 29, 12

slide-89
SLIDE 89

Easy to use

  • It is MS world so tdsproxy has a GUI!
  • You can use the Metasploit MSSQL modules.

DEMO

Thursday, November 29, 12

slide-90
SLIDE 90

Notes

  • We had to modify the mssql.rb core mixin to add some support for newer

protocols

  • You have to use the same client version that the client used
  • You can use Metasploit auxiliary MSSQL modules.

Thursday, November 29, 12

slide-91
SLIDE 91

Notes

Thursday, November 29, 12

slide-92
SLIDE 92

Notes

Thursday, November 29, 12

slide-93
SLIDE 93

Notes

Thursday, November 29, 12

slide-94
SLIDE 94

Summary

  • There was no SQL injection in this presentation
  • If you play with DLL injection you may find dirty things in the OCI driver
  • All roads lead to us
  • C64 style backfires
  • We do not deal with Oracle only

Thursday, November 29, 12

slide-95
SLIDE 95

Summary

  • There was no SQL injection in this presentation
  • If you play with DLL injection you may find dirty things in the OCI driver
  • All roads lead to us
  • C64 style backfires
  • We do not deal with Oracle only

Is it worth thinking differently?

Thursday, November 29, 12

slide-96
SLIDE 96
  • ne more thing...

Thursday, November 29, 12

slide-97
SLIDE 97

This slide does not exist!

Thursday, November 29, 12

slide-98
SLIDE 98

References

  • www.soonerorlater.hu
  • www.cqure.net
  • http://www.davidlitchfield.com
  • http://www.petefinnigan.com/
  • http://www.red-database-security.com/whitepaper/presentations.html
  • http://www.scriptjunkie.us/2011/08/writing-meterpreter-extensions/
  • http://www.joxeankoret.com/download/tnspoison.pdf

Thursday, November 29, 12

slide-99
SLIDE 99

Thank You!

László Tóth Ferenc Spala donctl spala.ferenc @donctl @FerencSpala n/a spala.ferenc László Tóth Ferenc Spala

INSERT INTO DeepSecMessages VALUES (“Thx for the Hekkcamp participants!”); INSERT INTO DeepSecMessages VALUES (“See U @ DeepSec 2013”); Get all the goodies from: http://soonerorlater.hu

Thursday, November 29, 12