{"id":37011,"date":"2019-10-31T22:15:16","date_gmt":"2019-10-31T19:15:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite\/"},"modified":"2019-10-31T22:15:16","modified_gmt":"2019-10-31T19:15:16","slug":"predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","title":{"rendered":"Esitletud on uus SQLite haavatavustega exploitation'i tehnika","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Check Pointi teadlased avaldasid<\/a><\/noindex> tutvustasid DEF CON konverentsil uusi r\u00fcnnaku meetodeid rakendustele, mis kasutavad haavatavaid SQLite versioone. Check Pointi meetod k\u00e4sitleb andmebaasifailide v\u00f5imalust haavatavuste ekspluiteerimise skriptide integreerimiseks erinevatesse SQLite sisealadesse, mis pole otsesele ekspluiteerimisele avatud. Teadlased on v\u00e4lja t\u00f6\u00f6tanud ka haavatavuste ekspluiteerimise tehnika, mis kodeerib ekspluudi SQLite andmebaasi SELECT p\u00e4ringute ahelana, v\u00f5imaldades ASLR-i \u00fcletamist.<\/p>\n

Edukaks r\u00fcnnakuks on vajalik, et oleks v\u00f5imalik manipuleerida r\u00fcnnatavate rakenduste andmebaasifailidega, mis piirab meetodi kasutamist rakendustele, mis kasutavad SQLite-d andmevormingina vahe- ja sisendandmete jaoks. Meetodit saab rakendada ka juba saadud kohalikku juurdep\u00e4\u00e4su laiendamiseks, n\u00e4iteks varjatud tagauksete integreerimiseks kasutatavatesse rakendustesse, samuti turvamehhanismide \u00fcletamiseks, mida kasutavad turvauuringud pahavara anal\u00fc\u00fcsimisel. Ekspluateerimine toimib p\u00e4rast faili asendamist rakenduse esimese SELECT p\u00e4ringu t\u00e4itmise ajal muudetud andmebaasis.<\/p>\n

N\u00e4iteks on demonstreeritud koodi k\u00e4ivitamise v\u00f5imalust iOS-is, kui avada aadressiraamat, mille DB-faili \"AddressBook.sqlitedb\" oli muudetud soovitatud meetodi abil. R\u00fcnnak p\u00f5hines haavatavusel fts3_tokenizer funktsioonis (CVE-2019-8602, n\u00e4itajate dereferentsimise v\u00f5imalus), mis parandati aprilli SQLite 2.28 v\u00e4rskenduses, koos teistega. haavatavusega<\/a><\/noindex> akenfunktsioonide teostuses. Lisaks demonstreeriti meetodi rakendamist kaugtaseme juhtimise haaramiseks PHP taustaserveri \u00fcle, mis kogus parooli, mis on saadud pahavara k\u00e4itamise k\u00e4igus (tabatud paroolid edastati SQLite andmebaasi vormis).<\/p>\n

R\u00fcnnaku meetod p\u00f5hineb kahe tehnika, \"Query Hijacking\" ja \"Query Oriented Programming\", kasutamisel, mis v\u00f5imaldavad \u00e4ra kasutada juhuslikke probleeme, mis p\u00f5hjustavad m\u00e4luh\u00e4ireid SQLite mootoris. \"Query Hijacking\" olemus seisneb sqlite_master s\u00fcsteemitabeli \"sql\" v\u00e4lja sisu vahetamises, mis m\u00e4\u00e4rab DB struktuuri. Antud v\u00e4li sisaldab DDL (Data Definition Language) plokki, mida kasutatakse objektide struktuuri kirjeldamiseks DB-s. Kirjeldus m\u00e4\u00e4ratakse \u00e4ra tavap\u00e4rase SQL s\u00fcntaksiga, st kasutatakse konstruktsiooni \"CREATE TABLE\",
\nmis t\u00e4idetakse andmebaasi initsialiseerimise k\u00e4igus (esmakordsel k\u00e4ivitamisel
\nfunktsiooni sqlite3LocateTable) jaoks, et luua m\u00e4lus seotud tabeli sisemised struktuurid.<\/p>\n

Idee on see, et asendades \"CREATE TABLE\" \"CREATE VIEW\"-ga, on v\u00f5imalik oma vaate m\u00e4\u00e4ramise kaudu kontrollida mis tahes p\u00e4ringut DB-le. \"CREATE VIEW\"-seal on seotud \"SELECT\"-operatsiooniga, mis kutsutakse v\u00e4lja asemel \"CREATE TABLE\", ja v\u00f5imaldab juurdep\u00e4\u00e4su erinevatele SQLite t\u00f5lgendi osadele. Edasi oleks k\u00f5ige lihtsam r\u00fcnnaku viis funktsiooni \"load_extension\" v\u00e4ljakutsumine, mis v\u00f5imaldab laadida juhuslikku laiendusteeket, kuid see funktsioon on vaikimisi keelatud.<\/p>\n

R\u00fcnnaku sooritamiseks \"SELECT\" operatsiooni t\u00e4itmise v\u00f5imaluse korral on soovitatud tehnika \"Query Oriented Programming\", mis v\u00f5imaldab \u00e4ra kasutada SQLite probleeme, mis p\u00f5hjustavad m\u00e4luh\u00e4ireid. See tehnika meenutab tagasip\u00f6\u00f6rduvat programmeerimist (ROP<\/a><\/noindex>, Return-Oriented Programming), kuid kasutab \"gadgetite\" v\u00e4ljakutsete ahela koostamiseks mitteeksisteerivaid masinakoode osi, vaid subp\u00e4ringute sisestusi SELECT-is.<\/p>\n

\"Esitletud<\/a><\/noindex><\/center>
\n
\"Esitletud<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 SQLite. \u041c\u0435\u0442\u043e\u0434 Check Point \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441 \u0411\u0414 \u043a\u0430\u043a \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 SQLite, \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u043b\u043e\u0431. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u0444\u043e\u0440\u043c\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27740,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37011","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Esitatud uus haavatavuste v\u00e4\u00e4rkasutamise tehnika SQLite'is | ProHoster","description":"Check Pointi ettev\u00f5tte teadlased avaldasid DEF CON konverentsil uue r\u00fcnnakutehnika \u00fcksikasjad.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 SQLite | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:16+00:00","article:modified_time":"2019-10-31T19:15:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:35:26","updated":"2026-01-22 05:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37011\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/27740"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}