A guided tour to someone else's network
So what happens if you hit a dead end and can't find any vulnerable services to attack? What if the network is properly segmented and there is no path from the web server you have compromised to the internal network? Go with email. Because virtually all email clients now handle HTML, multimedia content, and so on, they rely on the underlying system libraries to parse this content.
The bad news is that virtually every HTML rendering engine (WebKit, Gecko, Microsoft HTML Rendering Engine, Microsoft Word, etc.) has exploitable flaws, and most image and multimedia files also have exploitable flaws. If you can sneak a malicious email past the scanners, you can probably cause code execution on the victim's machine.
To make things even easier, you also have the option of attaching a file that targets any number of local programs, currently the more popular ones are Adobe Reader (with many JBIG2-related vulnerabilities), Open Office, and of course, Microsoft Office.
But don't all sites have virus scanning of incoming email and blocking of executable attachments? Well, this is where the information harvested about the target really comes in handy. If you can find a list of the executives, or a company phone directory (which will sometimes even lists the department someone is in), you can craft email messages that look something like the message shown in Figure 6.
Creating Malicious PDF Files
One note: You might have to run the script through dos2unix to fix the line breaks, and depending on your version of Python, there is a finally: clause in line 63 that you might need to remove. Just be sure to remove one tab from the line that follows as well and it will run fine.
Bringing It All Together for the Win
Individually, most of these attacks won't get you very far. You might gain access to a web application, read someone's email, or view a file on the server. But by combining techniques, such as writing arbitrary contents to a file and then including that file so that the PHP code within it is executed (Figure 8), an attacker can launch local attacks, of which there are plenty. In the first half of 2009 alone, the Linux kernel has suffered because of several locally exploitable vulnerabilities (ptrace_attach, udev, netlink, and exit_notify) for which exploit code exists publicly (just search Milw0rm for "Linux Kernel").
Exploiting a system via the kernel is particularly effective because a) you know it's installed and b) upgrading a Linux kernel on many web hosts is either a complete pain or simply not possible. Once attackers have the ability to exploit code locally, it's only a matter of time before they can execute code as the root user.
Buy this article as PDF
3ROS attack tool lowers the technical bar so anyone can be an intruder.
Mozilla's latest browser offers powerful new privacy feature
If attackers are on your system, saving your passwords in a password vault is no protection.
Faulty hash algorithm persists, despite efforts by experts to raise awareness.
Powerful man-in-the-middle attack is now targeting online shopping.
Another high-profile coder says the kernel team needs a kinder, gentler culture.
Bug database has a bug of its own that could allow an intruder to create an unauthorized account.
Report focuses federal resources on achieving universal Internet access.
Leading browser makers say “no” to porous encryption algorithm