CAPEC-40
Manipulating Writeable Terminal Devices
2014-06-23
00h00 +00:00
00h00 +00:00
特定のCAPECのアラート
特定のCAPECの変更情報をいち早くお届けします。
CAPEC の説明
This attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded.
CAPEC の情報
実行フロー
1) Explore
[Identify attacker-writable terminals] Determine if users TTYs are writable by the attacker.
技法
- Determine the permissions for the TTYs found on the system. Any that allow user write to the TTY may be vulnerable.
- Attempt to write to other user TTYs. This approach could leave a trail or alert a user.
2) Exploit
[Execute malicious commands] Using one or more vulnerable TTY, execute commands to achieve various impacts.
技法
- Commands that allow reading or writing end user files can be executed.
前提条件
User terminals must have a permissive access control such as world writeable that allows normal users to control data on other user's terminals.必要なスキル
Ability to discover permissions on terminal devices. Of course, brute force can also be used.必要なリソース
Access to a terminal on the target network緩和策
Design: Ensure that terminals are only writeable by named owner user and/or administratorDesign: Enforce principle of least privilege
関連する弱点
| 弱点名 | |
|---|---|
CWE-77 |
Improper Neutralization of Special Elements used in a Command The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
参考文献
REF-1
Exploiting Software: How to Break CodeG. Hoglund, G. McGraw.
登録情報
| 名前 | 組織 | 日付 | リリース日 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Attack_Phases, Description, Description Summary, Related_Vulnerabilities | |
| CAPEC Content Team | The MITRE Corporation | Updated Attacker_Skills_or_Knowledge_Required, Related_Attack_Patterns, Type (Attack_Pattern -> Relationship) | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances |
