{"id":37011,"date":"2019-10-31T22:15:16","date_gmt":"2019-10-31T19:15:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite\/"},"modified":"2019-10-31T22:15:16","modified_gmt":"2019-10-31T19:15:16","slug":"predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","title":{"rendered":"Predstavljena nova tehnika iskori\u0161tavanja ranjivosti u SQLite-u","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Istra\u017eiva\u010di iz kompanije Check Point otkrili su<\/a><\/noindex> na konferenciji DEF CON predstavili su detalje nove tehnike napada na aplikacije koje koriste ranjive verzije SQLite. Metod Check Point razmatra datoteke s bazama podataka kao mogu\u0107nost za integraciju skripti za eksploataciju ranjivosti u razli\u010ditim unutra\u0161njim podsistemima SQLite, koje je te\u0161ko iskoristiti direktno. Istra\u017eiva\u010di su tako\u0111e pripremili tehniku eksploatacije ranjivosti kodiranjem eksploita u obliku lanca SELECT upita u SQLite bazi podataka, \u0161to omogu\u0107ava zaobila\u017eenje ASLR-a.<\/p>\n

Za uspe\u0161an napad neophodno je imati mogu\u0107nost modifikacije datoteka baze podataka napadnutih aplikacija, \u0161to ograni\u010dava metodu napadima na aplikacije koje koriste SQLite kao format za tranzitne i ulazne podatke. Metod se tako\u0111e mo\u017ee primeniti za pro\u0161irenje ve\u0107 dobijenog lokalnog pristupa, na primer, za integraciju skrivenih bekdora u kori\u0161\u0107ene aplikacije, kao i za zaobila\u017eenje mehanizama za\u0161tite prilikom analize malicioznog softvera od strane istra\u017eiva\u010da. Eksploatacija nakon zamene datoteke odvija se u trenutku kada aplikacija prvi put izvr\u0161i SELECT upit prema tabeli u modifikovanoj bazi podataka.<\/p>\n

Kao primjer, demonstrirana je mogu\u0107nost pokretanja koda na iOS-u pri otvaranju adresara, \u010dija je datoteka s bazom podataka 'AddressBook.sqlitedb' izmijenjena kori\u0161tenjem predlo\u017eene metode. Napad je iskori\u0161tavao ranjivost u funkciji fts3_tokenizer (CVE-2019-8602, mogu\u0107nost dereferenciranja pokaziva\u010da), koja je ispravljena u travanjskom a\u017euriranju SQLite 2.28, zajedno s drugima. ranjivo\u0161\u0107u<\/a><\/noindex> u implementaciji prozor funkcija. Pored toga, demonstrirana je primena metode za daljinsko preuzimanje kontrole nad PHP backend serverom malicioznih aktera, koji prikupljaju lozinke, uhva\u0107ene tokom rada malicioznog koda (uhva\u0107ene lozinke su se prenosile u obliku SQLite baze podataka).<\/p>\n

Metoda napada temelji se na kori\u0161tenju dviju tehnika 'Query Hijacking' i 'Query Oriented Programming', koje omogu\u0107uju iskori\u0161tavanje proizvoljnih problema koji dovode do o\u0161te\u0107enja memorije u SQLite motoru. Bit 'Query Hijacking' je zamjena sadr\u017eaja polja 'sql' u sustavnoj tablici sqlite_master, koja odre\u0111uje strukturu baze podataka. Spomenuto polje sadr\u017ei blok DDL (Data Definition Language), kori\u0161ten za opis strukture objekata u bazi podataka. Opis se postavlja kori\u0161tenjem standardne SQL sintakse, tj. koristi se konstrukcija 'CREATE TABLE',
\nkoja se izvr\u0161ava tijekom inicijalizacije baze podataka (prilikom prvog pokretanja
\nfunkcije sqlite3LocateTable) za stvaranje povezanih unutarnjih struktura u memoriji.<\/p>\n

Ideja je da se, zamjenom 'CREATE TABLE' s 'CREATE VIEW', dobije mogu\u0107nost kroz definiranje vlastitog prikaza kontrolirati bilo koji pristup bazi podataka. Kori\u0161tenjem 'CREATE VIEW', operacija 'SELECT' vezuje se uz tablicu, koja \u0107e biti pozvana umjesto 'CREATE TABLE' i omogu\u0107ava pristup razli\u010ditim dijelovima SQLite interpreteru. Nadalje, najjednostavniji na\u010din napada bio bi poziv funkcije 'load_extension', koja omogu\u0107ava u\u010ditavanje proizvoljne biblioteke s ekstenzijom, no ova funkcija je prema zadanim postavkama isklju\u010dena.<\/p>\n

Za izvr\u0161enje napada u uvjetima mogu\u0107nosti provo\u0111enja operacije 'SELECT', predlo\u017eena je tehnika 'Query Oriented Programming', koja omogu\u0107ava iskori\u0161tavanje problema u SQLite-u, \u0161to dovodi do o\u0161te\u0107enja memorije. Tehnika podsje\u0107a na povratno usmjeravanje programiranja (ROP<\/a><\/noindex>, Return-Oriented Programming), ali koristi za izgradnju lanca poziva ('gadgets') nepostoje\u0107e odlomke strojno kodiranog koda, ve\u0107 umetke u skupu podupita unutar SELECT.<\/p>\n

\"Predstavljena<\/a><\/noindex><\/center>
\n
\"Predstavljena<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 SQLite. \u041c\u0435\u0442\u043e\u0434 Check Point \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441 \u0411\u0414 \u043a\u0430\u043a \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 SQLite, \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u043b\u043e\u0431. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u0444\u043e\u0440\u043c\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27740,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37011","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Predstavljena nova tehnika eksploatacije ranjivosti u SQLite | ProHoster","description":"Istra\u017eiva\u010di iz kompanije Check Point otkrili su na konferenciji DEF CON detalje nove tehnike napada.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 SQLite | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:16+00:00","article:modified_time":"2019-10-31T19:15:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:35:26","updated":"2026-01-22 05:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/37011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=37011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/37011\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/27740"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=37011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=37011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=37011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}