{"id":37011,"date":"2019-10-31T22:15:16","date_gmt":"2019-10-31T19:15:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite\/"},"modified":"2019-10-31T22:15:16","modified_gmt":"2019-10-31T19:15:16","slug":"predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","title":{"rendered":"Byla p\u0159edstavena nov\u00e1 technika vyu\u017e\u00edv\u00e1n\u00ed zranitelnost\u00ed v SQLite","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci ze spole\u010dnosti Check Point odhalili<\/a><\/noindex> na konferenci DEF CON odhalili podrobnosti o nov\u00e9 technice \u00fatok\u016f na aplikace vyu\u017e\u00edvaj\u00edc\u00ed zraniteln\u00e9 verze SQLite. Metoda Check Point pova\u017euje soubory s datab\u00e1z\u00ed za p\u0159\u00edle\u017eitost k integraci skript\u016f pro vyu\u017eit\u00ed zranitelnost\u00ed v r\u016fzn\u00fdch intern\u00edch subsyst\u00e9mech SQLite, kter\u00e9 nejsou p\u0159\u00edstupn\u00e9 pro p\u0159\u00edm\u00e9 zneu\u017eit\u00ed. V\u00fdzkumn\u00edci tak\u00e9 vyvinuli techniku zneu\u017eit\u00ed zranitelnost\u00ed, p\u0159i kter\u00e9 je exploitat zak\u00f3dov\u00e1n ve form\u011b \u0159et\u011bzce SELECT dotaz\u016f do datab\u00e1ze SQLite, co\u017e umo\u017e\u0148uje obej\u00edt ASLR.<\/p>\n

Pro \u00fasp\u011b\u0161n\u00fd \u00fatok je nutn\u00e9 m\u00edt mo\u017enost modifikace soubor\u016f datab\u00e1ze c\u00edlov\u00fdch aplikac\u00ed, co\u017e omezuje metodu na \u00fatoky na aplikace, kter\u00e9 pou\u017e\u00edvaj\u00ed datab\u00e1zi SQLite jako form\u00e1t pro tranzitn\u00ed a vstupn\u00ed data. Metoda m\u016f\u017ee b\u00fdt tak\u00e9 pou\u017eita pro roz\u0161\u00ed\u0159en\u00ed ji\u017e z\u00edskan\u00e9ho lok\u00e1ln\u00edho p\u0159\u00edstupu, nap\u0159\u00edklad pro integraci skryt\u00fdch zadn\u00edch vr\u00e1tk\u016f do pou\u017e\u00edvan\u00fdch aplikac\u00ed, a tak\u00e9 pro obch\u00e1zen\u00ed ochrann\u00fdch mechanism\u016f p\u0159i anal\u00fdze malwaru. Vyu\u017eit\u00ed zme\u0161kan\u00e9ho souboru doch\u00e1z\u00ed v okam\u017eiku, kdy aplikace provede prvn\u00ed SELECT dotaz na tabulku v modifikovan\u00e9 datab\u00e1zi.<\/p>\n

Jako p\u0159\u00edklad je demonstrov\u00e1na mo\u017enost spu\u0161t\u011bn\u00ed k\u00f3du v iOS p\u0159i otev\u0159en\u00ed adres\u00e1\u0159e, soubor s datab\u00e1z\u00ed «AddressBook.sqlitedb» byl zm\u011bn\u011bn za pou\u017eit\u00ed navrhovan\u00e9 metody. \u00datok vyu\u017e\u00edval zranitelnost ve funkci fts3_tokenizer (CVE-2019-8602, mo\u017enost dereferencov\u00e1n\u00ed ukazatele), kter\u00e1 byla opravena v dubnov\u00e9 aktualizaci SQLite 2.28 spolu s dal\u0161\u00edmi. zranitelnostmi<\/a><\/noindex> v implementaci oknov\u00fdch funkc\u00ed. D\u00e1le bylo demonstrov\u00e1no pou\u017eit\u00ed metody pro vzd\u00e1len\u00e9 ovl\u00e1d\u00e1n\u00ed PHP backend serveru \u00fato\u010dn\u00edk\u016f, kter\u00fd shroma\u017e\u010foval hesla zachycen\u00e1 b\u011bhem \u010dinnosti malwaru (zachycen\u00e1 hesla byla p\u0159ed\u00e1v\u00e1na ve form\u011b datab\u00e1ze SQLite).<\/p>\n

Metoda \u00fatoku je zalo\u017eena na vyu\u017eit\u00ed dvou technik «Query Hijacking» a «Query Oriented Programming», kter\u00e9 umo\u017e\u0148uj\u00ed exploataci libovoln\u00fdch probl\u00e9m\u016f vedouc\u00edch k po\u0161kozen\u00ed pam\u011bti v engine SQLite. Podstata «Query Hijacking» spo\u010d\u00edv\u00e1 ve zm\u011bn\u011b obsahu pole «sql» ve syst\u00e9mov\u00e9 tabulce sqlite_master, kter\u00e1 ur\u010duje strukturu datab\u00e1ze. Uveden\u00e9 pole obsahuje blok DDL (Data Definition Language), pou\u017e\u00edvan\u00fd k popisu struktury objekt\u016f v datab\u00e1zi. Popis se zad\u00e1v\u00e1 pomoc\u00ed standardn\u00ed syntaxe SQL, tj. pou\u017e\u00edv\u00e1 se konstrukce «CREATE TABLE».
\nkter\u00e1 se prov\u00e1d\u00ed b\u011bhem inicializace datab\u00e1ze (b\u011bhem prvn\u00edho spu\u0161t\u011bn\u00ed
\nfunkce sqlite3LocateTable) pro vytvo\u0159en\u00ed vnit\u0159n\u00edch struktur souvisej\u00edc\u00edch s tabulkou v pam\u011bti.<\/p>\n

My\u0161lenkou je, \u017ee v d\u016fsledku nahrazen\u00ed «CREATE TABLE» za «CREATE VIEW» se objev\u00ed mo\u017enost prost\u0159ednictv\u00edm definice vlastn\u00edho pohledu kontrolovat jak\u00fdkoli p\u0159\u00edstup k datab\u00e1zi. Pomoc\u00ed «CREATE VIEW» se k tabulce p\u0159ipojuje operace «SELECT», kter\u00e1 bude vyvol\u00e1na m\u00edsto «CREATE TABLE» a umo\u017e\u0148uje p\u0159\u00edstup k r\u016fzn\u00fdm \u010d\u00e1stem interpretru SQLite. D\u00e1le by nejjednodu\u0161\u0161\u00edm zp\u016fsobem \u00fatoku bylo vol\u00e1n\u00ed funkce «load_extension», kter\u00e1 umo\u017e\u0148uje na\u010d\u00edst libovolnou knihovnu s roz\u0161\u00ed\u0159en\u00edm, ale tato funkce je ve v\u00fdchoz\u00edm nastaven\u00ed zak\u00e1z\u00e1na.<\/p>\n

Pro proveden\u00ed \u00fatoku za podm\u00ednek mo\u017enosti proveden\u00ed operace «SELECT» byla navr\u017eena technika «Query Oriented Programming», kter\u00e1 d\u00e1v\u00e1 mo\u017enost exploatovat probl\u00e9my v SQLite, vedouc\u00ed k po\u0161kozen\u00ed pam\u011bti. Technika p\u0159ipom\u00edn\u00e1 n\u00e1vratn\u011b orientovan\u00e9 programov\u00e1n\u00ed (ROP<\/a><\/noindex>, Return-Oriented Programming), ale pou\u017e\u00edv\u00e1 k sestaven\u00ed \u0159et\u011bzce vol\u00e1n\u00ed («gadgets») neexistuj\u00edc\u00ed \u00faryvky strojov\u00e9ho k\u00f3du, ale vlo\u017een\u00ed v sad\u011b poddotaz\u016f uvnit\u0159 SELECT.<\/p>\n

\"Byla<\/a><\/noindex><\/center>
\n
\"Byla<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 SQLite. \u041c\u0435\u0442\u043e\u0434 Check Point \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441 \u0411\u0414 \u043a\u0430\u043a \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 SQLite, \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u043b\u043e\u0431. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u0444\u043e\u0440\u043c\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27740,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37011","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u0159edstavena nov\u00e1 technika exploitace zranitelnost\u00ed v SQLite | ProHoster","description":"V\u00fdzkumn\u00edci z firmy Check Point odhalili na konferenci DEF CON detaily nov\u00e9 techniky \u00fatok\u016f.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 SQLite | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:16+00:00","article:modified_time":"2019-10-31T19:15:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:35:26","updated":"2026-01-22 05:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=37011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37011\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/27740"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=37011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=37011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=37011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}