Think differently about database hacking SELECT presenter FROM DeepSecSpeakers WHERE name = László Tóth ' and ' Ferenc Spala ' or 1=1-- 29/11/2012 @ DeepSec 2012 Thursday, November 29, 12
Who are we? • @Work: Deloitte . Hungary Pentests, Security audits, Config reviews, Consulting ... • László • 12+ years itsec • 5+ years Oracle research • Ferenc • 5+ years itsec • 3+ years database security • Members of Hacktivity Team • Co-founders of Hekkcamp Thursday, November 29, 12
Where does the fun begin? Client world • Hacking the Oracle client Network world • Hijacking database connections Server world • Metasploit feat. oradebug • Using oradebug to get Meterpreter session • Using Metasploit to run oradebug commands MS world • Playing with MSSQL connections Thursday, November 29, 12
Part 1 Hacking the Oracle client if you play with DLL injection you may find dirty things in the OCI driver Thursday, November 29, 12
What’s the point? • DLL injection is pretty old • The OCI driver ships with symbol file C F K f o k r a m e d a r t d e r e t s i g e r a s i o g o l e h T • Hijacking the “connect” function is boring Thursday, November 29, 12
Fancy, huh? • Debug the OCI driver • Get the interesting functions • Do some memory kung-fu • Wrap-up your DLL • Get/Write an injector & apply your hooks • Enjoy the silence Thursday, November 29, 12
Fancy, huh? Beware when x64 in scope! • Debug the OCI driver • Get the interesting functions • Do some memory kung-fu • Wrap-up your DLL • Get/Write an injector & apply your hooks • Enjoy the silence Thursday, November 29, 12
Fancy, huh? Beware when x64 in scope! • Debug the OCI driver OCIAttrSet, OCIServerAttach • Get the interesting functions • Do some memory kung-fu • Wrap-up your DLL • Get/Write an injector & apply your hooks • Enjoy the silence Thursday, November 29, 12
Fancy, huh? Beware when x64 in scope! • Debug the OCI driver OCIAttrSet, OCIServerAttach • Get the interesting functions Follow the pointer that points a pointer.... • Do some memory kung-fu • Wrap-up your DLL • Get/Write an injector & apply your hooks • Enjoy the silence Thursday, November 29, 12
Fancy, huh? Beware when x64 in scope! • Debug the OCI driver OCIAttrSet, OCIServerAttach • Get the interesting functions Follow the pointer that points a pointer.... • Do some memory kung-fu Different DLLs for different archs! • Wrap-up your DLL • Get/Write an injector & apply your hooks • Enjoy the silence Thursday, November 29, 12
Fancy, huh? Beware when x64 in scope! • Debug the OCI driver OCIAttrSet, OCIServerAttach • Get the interesting functions Follow the pointer that points a pointer.... • Do some memory kung-fu Different DLLs for different archs! • Wrap-up your DLL Can be tricky in x64 envs! • Get/Write an injector & apply your hooks • Enjoy the silence Thursday, November 29, 12
Fancy, huh? Beware when x64 in scope! • Debug the OCI driver OCIAttrSet, OCIServerAttach • Get the interesting functions Follow the pointer that points a pointer.... • Do some memory kung-fu Different DLLs for different archs! • Wrap-up your DLL Can be tricky in x64 envs! • Get/Write an injector & apply your hooks Most of the time you get nothing! • Enjoy the silence Thursday, November 29, 12
So, what’s the point?? Get the username and the password from a single SQL statement execution m o c . g a g 9 / / : p t t h : e c r u o S Thursday, November 29, 12
So, what’s the point?? Get the username and the password from a single SQL statement execution m o c . g a g 9 / / : p t t h : e c r u o S OCIStmtExecute is your friend Thursday, November 29, 12
How? Thursday, November 29, 12
How? Thursday, November 29, 12
How? Thursday, November 29, 12
Where is my golden egg? Thursday, November 29, 12
Where is my golden egg? Thursday, November 29, 12
Where is my golden egg? Points to the username Thursday, November 29, 12
Where is my golden egg? Length of the username Points to the username Thursday, November 29, 12
Where is my golden egg? Length of the username Points to the username Marker Thursday, November 29, 12
Where is my golden egg? Length of the username Points to the username Marker Encryption key Thursday, November 29, 12
Where is my golden egg? Length of the username Points to the username Marker Encryption key Encrypted password Thursday, November 29, 12
Who should I shoot at? This security flaw lies in the OCI driver itself DEMO Thursday, November 29, 12
Part 2 Hijacking Oracle sessions all roads lead to us Thursday, November 29, 12
History • In 2009 pytnsproxy was released @ Hacktivity conference by László Tóth • Hijacking oracle sessions • Downgrading auth protocols • Log authentication data for o ffl ine brute-force • In 2012 tnspoison attack details were revealed by Joxean Koret • Great research paper • Working PoC Thursday, November 29, 12
History • In 2009 pytnsproxy was released @ Hacktivity conference by László Tóth You have to redirect the client, e.g.: arp-cache poisoning • Hijacking oracle sessions • Downgrading auth protocols • Log authentication data for o ffl ine brute-force • In 2012 tnspoison attack details were revealed by Joxean Koret • Great research paper • Working PoC Thursday, November 29, 12
History • In 2009 pytnsproxy was released @ Hacktivity conference by László Tóth You have to redirect the client, e.g.: arp-cache poisoning • Hijacking oracle sessions • Downgrading auth protocols • Log authentication data for o ffl ine brute-force • In 2012 tnspoison attack details were revealed by Joxean Koret • Great research paper It works with SIDs 6 characters long • Working PoC Thursday, November 29, 12
What? Listener Victim tnspoison Thursday, November 29, 12
What? Listener Connect Resend Connect Accept Victim tnspoison Thursday, November 29, 12
What? Listener Authentication Victim Data tnspoison Thursday, November 29, 12
What? Listener Victim tnspoison Thursday, November 29, 12
What? Listener Register Register Victim tnspoison Thursday, November 29, 12
What? Listener Connect Register Register Victim tnspoison Thursday, November 29, 12
What? Listener Connect Redirect Register Register Victim tnspoison Thursday, November 29, 12
What? Listener Connect Redirect Register Register Victim tnspoison proxy Thursday, November 29, 12
What? Listener Connect There is no patch!! Redirect Register Register Victim tnspoison proxy Thursday, November 29, 12
What? • You can redirect a certain percentage of the Oracle clients • The tra ffi c goes through you so you can do anything with it • Sni ff it • Alter it • Send your own SQL commands Thursday, November 29, 12
What? • You can redirect a certain percentage of the Oracle clients • The tra ffi c goes through you so you can do anything with it • Sni ff it • Alter it This is where pytnsproxy can help you! • Send your own SQL commands Thursday, November 29, 12
Hijack Victim Listener tnspoison pytnsproxy Attacker Thursday, November 29, 12
Hijack Register Victim Listener tnspoison pytnsproxy Attacker Thursday, November 29, 12
Hijack Register Victim Listener tnspoison Register pytnsproxy Attacker Thursday, November 29, 12
Hijack Connect Register Victim Listener tnspoison Register pytnsproxy Attacker Thursday, November 29, 12
Hijack Connect Register Victim Listener tnspoison Redirect Register pytnsproxy Attacker Thursday, November 29, 12
Hijack Connect Register Victim Listener tnspoison Redirect Register Connect Connect pytnsproxy Attacker Thursday, November 29, 12
Hijack Connect Register Victim Listener tnspoison Redirect Register Connect Auth Connect Authentication pytnsproxy Attacker Thursday, November 29, 12
Hijack Connect Register Victim Listener tnspoison Redirect Register Connect Auth Data Connect Authentication pytnsproxy Data Attacker Thursday, November 29, 12
Hijack Connect Register Victim Listener tnspoison Redirect Register pytnsproxy Attacker Thursday, November 29, 12
Hijack Connect Register Victim Listener tnspoison Redirect Register Quit pytnsproxy Attacker Thursday, November 29, 12
Hijack Connect Register Victim Listener tnspoison Redirect Register Quit pytnsproxy thread Attacker Thursday, November 29, 12
Hijack Connect Register Victim Listener tnspoison Redirect Register Quit pytnsproxy thread Conn. simulation Attacker Thursday, November 29, 12
Hijack Connect Register Victim Listener tnspoison Redirect Register Quit pytnsproxy thread Conn. simulation Auth. simulation Attacker Thursday, November 29, 12
Hijack Connect Register Victim Listener tnspoison Redirect Register Quit Data pytnsproxy thread Conn. simulation Auth. simulation Data Attacker Thursday, November 29, 12
Recommend
More recommend
