{"id":37011,"date":"2019-10-31T22:15:16","date_gmt":"2019-10-31T19:15:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite\/"},"modified":"2019-10-31T22:15:16","modified_gmt":"2019-10-31T19:15:16","slug":"predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","title":{"rendered":"Esitatud on uus haavatavuste kasutamise tehnika SQLite's.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Check Pointi uurijad avalikustas<\/a><\/noindex> DEF CON konverentsil tutvustasid nad uusi r\u00fcnnakutehnikaid rakendustele, mis kasutavad haavatavaid SQLite versioone. Check Pointi meetod k\u00e4sitleb andmebaasifailide anal\u00fc\u00fcsi v\u00f5imalusena integreerida haavatavuste ekspluateerimise skripte erinevates sisemistes SQLite alams\u00fcsteemides, mis ei ole t\u00f5rkeotsinguks kergesti k\u00e4ttesaadavad. Uurijad on samuti arendanud v\u00e4lja haavatavuste ekspluateerimise tehnika, kodeerides eksploidid SQLite andmebaasi SELECT-p\u00e4ringute ahelana, mis v\u00f5imaldab ASLR-i \u00fcletamist.<\/p>\n

Edukaks r\u00fcnnakuks on vajalik r\u00fcnnatavate rakenduste andmebaasifailide modifitseerimise v\u00f5imalus, mis piirab meetodi kasutamist rakendustele, mis kasutavad SQLite andmebaasina transit andmete ja sisendite formaati. Meetodit saab kasutada ka juba saadud kohalikku ligip\u00e4\u00e4su laiendamiseks, n\u00e4iteks varjatud tagauksede integreerimiseks kasutatavatesse rakendustesse, samuti turvamehhanismide v\u00e4ltimiseks, mida uurijad kasutavad pahatahtliku tarkvara anal\u00fc\u00fcsimisel. Ekspluateerimine toimub p\u00e4rast faili asendamist, kui rakendus sooritab oma esimest SELECT-p\u00e4ringut muudetud andmebaasi tabelisse.<\/p>\n

N\u00e4iteks on n\u00e4idatud, kuidas koodi k\u00e4ivitada iOS-i avamisel kontaktide loendis, mille andmebaasifail 'AddressBook.sqlitedb' on muudetud soovitatud meetodil. R\u00fcnnak p\u00f5hines haavatavusel fts3_tokenizer funktsioonis (CVE-2019-8602, n\u00e4idatud pointeri dereferentseerimise v\u00f5imalus), mis fikseeriti aprilli SQLite 2.28 v\u00e4rskenduses, koos muude parandustega. haavatavus<\/a><\/noindex> aknafunktsioonide rakenduses. Samuti on demonstreeritud meetodi kasutamine pahatahtlike isikute poolt PHP taustaserveri kaugjuhtimiseks, kelle tegevus seisnes paroolide kogumises, mis saadi kahjuliku koodi toimimise k\u00e4igus (kokkuv\u00f5tlikud paroolid edastati SQLite andmebaasi kujul).<\/p>\n

R\u00fcnnaku meetod p\u00f5hineb kahe tehnika, 'Query Hijacking' ja 'Query Oriented Programming', kasutamisel, mis v\u00f5imaldavad \u00e4ra kasutada juhuslikke probleeme, mis viivad m\u00e4luh\u00e4irete tekkeni SQLite mootoris. 'Query Hijacking' olemus seisneb 'sql' v\u00e4lja sisu v\u00e4ljavahetamises sqlite_master s\u00fcsteemitabelis, mis m\u00e4\u00e4ratleb andmebaasi struktuuri. Antud v\u00e4li sisaldab DDL (Data Definition Language) plokki, mida kasutatakse andmebaasi objektide struktuuri kirjeldamiseks. Kirjeldus on m\u00e4\u00e4ratud tavalise SQL s\u00fcntaksiga, st kasutatakse konstruktsiooni 'CREATE TABLE'.
\nmis t\u00e4idetakse andmebaasi algatamise protsessi k\u00e4igus (esimese k\u00e4ivitamise ajal
\nfunktsiooni sqlite3LocateTable) jaoks, et luua tabeliga seotud sisemised struktuurid m\u00e4lus.<\/p>\n

Idee seisneb selles, et asendades «CREATE TABLE» «CREATE VIEW»ga, tekib v\u00f5imalus hallata andmebaasi k\u00f5iki p\u00e4ringuid l\u00e4bi oma vaate m\u00e4\u00e4ratlemise. «CREATE VIEW» kaudu seostatakse tabeliga «SELECT» tegevus, mida kutsutakse esile asemel «CREATE TABLE» ning mis v\u00f5imaldab p\u00e4\u00e4seda ligi erinevatele SQLite t\u00f5lgendaja osadele. K\u00f5ige lihtsam r\u00fcnnakumeetod oleks funktsiooni «load_extension» kutsumine, mis v\u00f5imaldab laadida mis tahes laienduse teeki, kuid see funktsioon on vaikimisi keelatud.<\/p>\n

R\u00fcnnaku tegemiseks, kui tegevus «SELECT» on v\u00f5imalik, pakutakse tehnika nimega «Query Oriented Programming», mis v\u00f5imaldab \u00e4ra kasutada SQLite probleeme, mis viivad m\u00e4lukahjustuseni. Tehnika sarnaneb tagasip\u00f6\u00f6ratud programmeerimisele (ROP<\/a><\/noindex>, Return-Oriented Programming), kuid kasutab kutse ahelate («gadgetide») koostamiseks mitte eksisteerivaid masinkoodi fragmente, vaid sisestusi alamp\u00e4ringutes SELECTi sees.<\/p>\n

\"Esitatud<\/a><\/noindex><\/center>
\n
\"Esitatud<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 SQLite. \u041c\u0435\u0442\u043e\u0434 Check Point \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441 \u0411\u0414 \u043a\u0430\u043a \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 SQLite, \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u043b\u043e\u0431. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u0444\u043e\u0440\u043c\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27740,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37011","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uus haavatavuste ekspluateerimise tehnika SQLite'is | ProHoster","description":"Check Pointi uurijad avalikustasid DEF CON konverentsil \u00fcksikasju uue r\u00fcndetehnika kohta, mis suunatud rakendustele, mis kasutavad haavatavaid SQLite versioone. Check Pointi meetod k\u00e4sitleb andmebaasifaile v\u00f5imalusena integreerida haavatavuste ekspluateerimise skripte eri SQLite sisemistes s\u00fcsteemides, mida ei saa otse r\u00fcnnata. Uurijad on valmistanud ette ka haavatavuste ekspluateerimise tehnika, mille puhul eksloite kodeeritakse kujul","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 SQLite | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 SQLite. \u041c\u0435\u0442\u043e\u0434 Check Point \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441 \u0411\u0414 \u043a\u0430\u043a \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 SQLite, \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u043b\u043e\u0431. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u0444\u043e\u0440\u043c\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:16+00:00","article:modified_time":"2019-10-31T19:15:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:35:26","updated":"2026-01-22 05:43:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37011\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/27740"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}