A guided tour to someone else's network
So what happens if you hit a dead end and can't find any vulnerable services to attack? What if the network is properly segmented and there is no path from the web server you have compromised to the internal network? Go with email. Because virtually all email clients now handle HTML, multimedia content, and so on, they rely on the underlying system libraries to parse this content.
The bad news is that virtually every HTML rendering engine (WebKit, Gecko, Microsoft HTML Rendering Engine, Microsoft Word, etc.) has exploitable flaws, and most image and multimedia files also have exploitable flaws. If you can sneak a malicious email past the scanners, you can probably cause code execution on the victim's machine.
To make things even easier, you also have the option of attaching a file that targets any number of local programs, currently the more popular ones are Adobe Reader (with many JBIG2-related vulnerabilities), Open Office, and of course, Microsoft Office.
But don't all sites have virus scanning of incoming email and blocking of executable attachments? Well, this is where the information harvested about the target really comes in handy. If you can find a list of the executives, or a company phone directory (which will sometimes even lists the department someone is in), you can craft email messages that look something like the message shown in Figure 6.
Creating Malicious PDF Files
One note: You might have to run the script through dos2unix to fix the line breaks, and depending on your version of Python, there is a finally: clause in line 63 that you might need to remove. Just be sure to remove one tab from the line that follows as well and it will run fine.
Bringing It All Together for the Win
Individually, most of these attacks won't get you very far. You might gain access to a web application, read someone's email, or view a file on the server. But by combining techniques, such as writing arbitrary contents to a file and then including that file so that the PHP code within it is executed (Figure 8), an attacker can launch local attacks, of which there are plenty. In the first half of 2009 alone, the Linux kernel has suffered because of several locally exploitable vulnerabilities (ptrace_attach, udev, netlink, and exit_notify) for which exploit code exists publicly (just search Milw0rm for "Linux Kernel").
Exploiting a system via the kernel is particularly effective because a) you know it's installed and b) upgrading a Linux kernel on many web hosts is either a complete pain or simply not possible. Once attackers have the ability to exploit code locally, it's only a matter of time before they can execute code as the root user.
Buy this article as PDF
The bug was introduced back in 2009 and has been lurking around all this time.
The new release deprecates the sshd_config UsePrivilegeSeparation option.
Lives on as a community project
Five new systems join Dell XPS 13 Developer Edition that come with Ubuntu pre-installed.
The Skype Linux client now has almost the same capabilities that it enjoys on other platforms.
At CeBIT 2017, OpenStack Day will offer a wide range of lectures and discussions.
A major setback for the Linux desktop.
Improved support for GPU in virtualization.
News site for the openSUSE community falls victim to a Wordpress exploit.
The source code is available online.