{"id":37011,"date":"2019-10-31T22:15:16","date_gmt":"2019-10-31T19:15:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite\/"},"modified":"2019-10-31T22:15:16","modified_gmt":"2019-10-31T19:15:16","slug":"predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","title":{"rendered":"Zosta\u0142a zaprezentowana nowa technika wykorzystywania luk bezpiecze\u0144stwa w SQLite","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Badacze z firmy Check Point <noindex><a rel=\"nofollow\" href=\"https:\/\/research.checkpoint.com\/select-code_execution-from-using-sqlite\/\">ujawnili<\/a><\/noindex> na konferencji DEF CON przedstawili szczeg\u00f3\u0142y nowej techniki atak\u00f3w na aplikacje, kt\u00f3re wykorzystuj\u0105 podatne wersje SQLite. Metoda Check Point traktuje pliki z baz\u0105 danych jako mo\u017cliwo\u015b\u0107 integracji skrypt\u00f3w eksploitacyjnych w r\u00f3\u017cnych wewn\u0119trznych systemach SQLite, niedost\u0119pnych do wykorzystania wprost. Badacze przygotowali r\u00f3wnie\u017c technik\u0119 eksploatacji luk z kodowaniem eksploit\u00f3w w formie \u0142a\u0144cucha zapyta\u0144 SELECT w bazie danych SQLite, co pozwala na omini\u0119cie ASLR.<\/p>\n<p>Do skutecznego ataku konieczne jest posiadanie mo\u017cliwo\u015bci modyfikacji plik\u00f3w bazy danych atakowanych aplikacji, co ogranicza metod\u0119 do atak\u00f3w na aplikacje u\u017cywaj\u0105ce SQLite jako formatu dla danych tranzytowych i wej\u015bciowych. Metoda ta mo\u017ce by\u0107 r\u00f3wnie\u017c stosowana do rozszerzenia ju\u017c uzyskanego lokalnego dost\u0119pu, na przyk\u0142ad do integracji ukrytych backdoor\u00f3w w u\u017cywanych aplikacjach oraz do omini\u0119cia przez badaczy bezpiecze\u0144stwa mechanizm\u00f3w ochrony podczas analizy z\u0142o\u015bliwego oprogramowania. Eksploatacja po wymianie pliku odbywa si\u0119 w momencie wykonywania przez aplikacj\u0119 pierwszego zapytania SELECT do tabeli w zmodyfikowanej bazie danych.<\/p>\n<p>Jako przyk\u0142ad przedstawiono mo\u017cliwo\u015b\u0107 uruchomienia kodu w iOS po otwarciu ksi\u0105\u017cki adresowej, plik z baz\u0105 danych \u201eAddressBook.sqlitedb\u201d, kt\u00f3ra zosta\u0142a zmieniona przy u\u017cyciu zaproponowanej metody. W ataku wykorzystano luk\u0119 w funkcji fts3_tokenizer (CVE-2019-8602, mo\u017cliwo\u015b\u0107 dereferencjonowania wska\u017anika), kt\u00f3ra zosta\u0142a naprawiona w kwietniowej aktualizacji SQLite 2.28, obok innej. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50658\">luki<\/a><\/noindex> w implementacji funkcji okiennych. Ponadto pokazano zastosowanie metody do zdalnego przej\u0119cia kontroli nad backendem serwera napisanego w PHP przez przest\u0119pc\u00f3w, zbieraj\u0105cych has\u0142a przechwycone podczas dzia\u0142ania z\u0142o\u015bliwego kodu (przechwycone has\u0142a by\u0142y przesy\u0142ane w formie bazy danych SQLite).<\/p>\n<p>Metoda ataku opiera si\u0119 na wykorzystaniu dw\u00f3ch technik \u201eQuery Hijacking\u201d i \u201eQuery Oriented Programming\u201d, kt\u00f3re pozwalaj\u0105 na eksploatacj\u0119 dowolnych problem\u00f3w prowadz\u0105cych do uszkodzenia pami\u0119ci w silniku SQLite. Istot\u0105 \u201eQuery Hijacking\u201d jest podmiana zawarto\u015bci pola \u201esql\u201d w tabeli systemowej sqlite_master, kt\u00f3ra definiuje struktur\u0119 bazy danych. Wskazane pole zawiera blok DDL (Data Definition Language), u\u017cywany do opisu struktury obiekt\u00f3w w bazie danych. Opis jest okre\u015blany przy u\u017cyciu standardowej sk\u0142adni SQL, czyli wykorzystuje konstrukcj\u0119 \u201eCREATE TABLE\u201d,<br \/>\nkt\u00f3ra wykonywana jest podczas inicjalizacji bazy danych (w trakcie pierwszego uruchomienia<br \/>\nfunkcji sqlite3LocateTable) w celu stworzenia wewn\u0119trznych struktur powi\u0105zanych z tabel\u0105 w pami\u0119ci.<\/p>\n<p>Ide\u0105 jest to, \u017ce po zast\u0105pieniu \u201eCREATE TABLE\u201d przez \u201eCREATE VIEW\u201d otrzymuje si\u0119 mo\u017cliwo\u015b\u0107 kontroli dowolnego dost\u0119pu do bazy danych poprzez definicj\u0119 w\u0142asnego widoku. Przy pomocy \u201eCREATE VIEW\u201d do tabeli przypisywana jest operacja \u201eSELECT\u201d, kt\u00f3ra zostanie wywo\u0142ana zamiast \u201eCREATE TABLE\u201d i pozwala na dost\u0119p do r\u00f3\u017cnych cz\u0119\u015bci interpretera SQLite. Nast\u0119pnie najprostszym sposobem ataku by\u0142oby wywo\u0142anie funkcji \u201eload_extension\u201d, kt\u00f3ra pozwala na za\u0142adowanie dowolnej biblioteki z rozszerzeniem, ale ta funkcja jest domy\u015blnie wy\u0142\u0105czona.<\/p>\n<p>Aby przeprowadzi\u0107 atak w warunkach mo\u017cliwo\u015bci wykonania operacji \u201eSELECT\u201d, zaproponowano technik\u0119 \u201eQuery Oriented Programming\u201d, kt\u00f3ra umo\u017cliwia eksploatacj\u0119 problem\u00f3w w SQLite, prowadz\u0105cych do uszkodzenia pami\u0119ci. Technika przypomina programowanie oparte na zwrotach (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=48730#rop\">ROP<\/a><\/noindex>, Return-Oriented Programming), ale wykorzystuje do budowy \u0142a\u0144cucha wywo\u0142a\u0144 (\u201egad\u017cet\u00f3w\u201d) nie istniej\u0105ce fragmenty kodu maszynowego, a wstawki w zestawie podzapyta\u0144 wewn\u0105trz SELECT.<\/p>\n<p><center><noindex><a rel=\"nofollow\" href=\"https:\/\/research.checkpoint.com\/wp-content\/uploads\/2019\/08\/qop_fake_obj.png\"><img decoding=\"async\" alt=\"Zosta\u0142a zaprezentowana nowa technika wykorzystywania luk bezpiecze\u0144stwa w SQLite\" src=\"\/wp-content\/uploads\/2019\/08\/0f9e597805684258ef8a1ca4a47e7a21.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/research.checkpoint.com\/wp-content\/uploads\/2019\/08\/pwndbg_fake_obj.png\"><img decoding=\"async\" alt=\"Zosta\u0142a zaprezentowana nowa technika wykorzystywania luk bezpiecze\u0144stwa w SQLite\" src=\"\/wp-content\/uploads\/2019\/08\/1397889ee625b6e1f9779f5f22102d41.png\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>\u0179r\u00f3d\u0142o: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51259\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 SQLite. \u041c\u0435\u0442\u043e\u0434 Check Point \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441 \u0411\u0414 \u043a\u0430\u043a \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 SQLite, \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u043b\u043e\u0431. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u0444\u043e\u0440\u043c\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27740,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37011","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 SQLite | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:16+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:16+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Przedstawiono now\u0105 technik\u0119 eksploatacji podatno\u015bci w SQLite | ProHoster","description":"Badacze z firmy Check Point ujawnili na konferencji DEF CON szczeg\u00f3\u0142y nowej techniki atak\u00f3w.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 SQLite | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:16+00:00","article:modified_time":"2019-10-31T19:15:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:35:26","updated":"2026-01-22 05:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/37011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=37011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/37011\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/27740"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=37011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=37011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=37011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}