This document summarizes Tim Brown's presentation on auditing big UNIX systems. Some key challenges with auditing these systems include limited access to systems, varying operating system capabilities between versions, and differences in audit methodologies. Better techniques for auditing include developing better scripting tools, performing gap analyses between audit methodologies, and leveraging common configuration enumerations. Going further requires understanding why auditing is needed, analyzing the full attack surface of systems, and considering real world complexities like operating system flaws and accumulating application features.

1. # Big Game Hunting_
Simple techniques for bug hunting on big iron UNIX
adversary@your.domain.tld:~$ ln ­s /important /tmp/backup.log
adversary@your.domain.tld:~$ sudo ./backup.sh
adversary@your.domain.tld:~$ ls ­la /important
­rw­rw­rw­ 1 root root 1798 Aug 2 10:39 /important

2. # whoami_
# Tim Brown
# @timb_machine
# Head Of Research at Portcullis
Computer Security Ltd
# http://www.nth­dimension.org.uk/
44con, London, 2012 Tim Brown 2
Portcullis Computer Security Ltd

3. # last_
# >15 years of UNIX experience
# Background in telcos and finance
# 9 years at Portcullis
# More at
http://44con.com/speaker/tim­brown/
44con, London, 2012 Tim Brown 3
Portcullis Computer Security Ltd

4. # cat .plan_
# Auditing
# Problems
# Solutions
# Going further
# Why?
# The attack surface
# In the real world
# In the lab
44con, London, 2012 Tim Brown 4
Portcullis Computer Security Ltd

5. # Auditing_
# Problems
# Solutions
44con, London, 2012 Tim Brown 5
Portcullis Computer Security Ltd

6. # Problems_
# Limited access
# Varying OS capabilities
# Multiple solutions
# Differences in requirements
44con, London, 2012 Tim Brown 6
Portcullis Computer Security Ltd

7. # Limited access_
# Client doesn't own the system
# Client doesn't want to give (root)
access
# System is physically unavailable
# System is a black box
44con, London, 2012 Tim Brown 7
Portcullis Computer Security Ltd

8. # Varying OS capabilites
# Standards leave elements undefined
# OS tool chain not sufficient
# * GNU/Linux moves much faster than
commercial OS
# Solaris 10 (much) > Solaris 8
44con, London, 2012 Tim Brown 8
Portcullis Computer Security Ltd

9. # Multiple solutions_
# How do you lock an account?
# passwd ­l?
# Change the shell?
# Etc...
# If you don't run sendmail, should
the configuration still be
hardened?
44con, London, 2012 Tim Brown 9
Portcullis Computer Security Ltd

10. # Differences in
requirements_
# Which audit methodology do you use?
# Vendors?
# US DoD?
# CIS?
# Etc...
# What if they differ significantly?
# Would you know?
44con, London, 2012 Tim Brown 10
Portcullis Computer Security Ltd

11. # Solutions_
# Better scripts
# Gap analysis
# C(ommon) C(onfiguration)
E(numeration)
# Smarter humans
44con, London, 2012 Tim Brown 11
Portcullis Computer Security Ltd

12. # Gap analysis_
# We probably need to know what
different methodologies check for
# I wish someone else had done it
44con, London, 2012 Tim Brown 12
Portcullis Computer Security Ltd

13. # C(ommon) C(onfiguration)
E(numeration)_
# They have (kinda):
# http://cce.mitre.org/
# Incomplete
# Missing various OS
# Not sure I agree with their
methodology
# No mention of gap analysis (AIX guy
may not know Solaris and vice
versa)
# They consider outcome, not technique
44con, London, 2012 Tim Brown 13
Portcullis Computer Security Ltd

14. # Smarter humans_
# I don't scale well!
# We all need training when it comes
to stuff we don't see every day
# Maybe talks like this will help
DevOps get their shit together?
44con, London, 2012 Tim Brown 14
Portcullis Computer Security Ltd

15. # Going further_
# Why?
# The attack surface
# In the real world
44con, London, 2012 Tim Brown 15
Portcullis Computer Security Ltd

16. # Why?_
# Bug hunting
# More importantly, auditing fails to
answer the hard question – did you
want segregation of roles with
that?
44con, London, 2012 Tim Brown 16
Portcullis Computer Security Ltd

17. # The attack surface_
OS Kernel Services
Enterprise apps Services Batch jobs User roles
DevOps Batch jobs User roles
Users Misfortune Malice
# If “everything is a file”, we need
to get better at analysing the
files...
44con, London, 2012 Tim Brown 17
Portcullis Computer Security Ltd

18. # In the real world_
# The OS should protect us from
ourselves
# Enterprise applications continue
accumulate features
# DevOps will replace us all with
shell scripts
44con, London, 2012 Tim Brown 18
Portcullis Computer Security Ltd

19. # OS flaws_
# Bad standards
# Forks
# Poor defaults
# Incorrectly implemented separation
of privileges
# Poorly implemented administrative
functionality
# Incomplete anti­exploitation
mitigations
44con, London, 2012 Tim Brown 19
Portcullis Computer Security Ltd

20. # Examples_
# Shared code such as CDE
# Binaries owned by “bin” user
# Binaries such as telnet and ftp
being SetUID
# WPAR isolation
# Patching may be the problem, not
the solution
44con, London, 2012 Tim Brown 20
Portcullis Computer Security Ltd

21. # Anti­exploit mitigations_
Mitigation * GNU/Linux AIX
Mandatory access control Y N (Y in Trusted AIX)
Non-executable stack Y N (select mode by default)
ASLR Y N
Hardened malloc() Y N (Y with Watson malloc())
Stack cookies and other Y (glibc) N
compile time mitigations
mmap() NULL N N
44con, London, 2012 Tim Brown 21
Portcullis Computer Security Ltd

22. # Non­executable stack?_
# sedmgr
Stack Execution Disable (SED) mode: select
SED configured in kernel: select
# find / ­perm ­u+s ­exec sedmgr ­d {} ; | grep ­v system
/opt/IBMinvscout/sbin/invscout_lsvpd : Not a recognized executable format.
#
44con, London, 2012 Tim Brown 22
Portcullis Computer Security Ltd

23. # ASLR?_
# ./aslr
REMOVE
system() = f1ab5d70
bos.rte.libc 6.1.3.11 ROOT REJECT SUCCESS
bos.rte.libc 6.1.3.11 USR REJECT SUCCESS
ADD
system() = f1c05490
bos.rte.libc 6.1.3.11 USR APPLY SUCCESS
bos.rte.libc 6.1.3.11 ROOT APPLY SUCCESS
REMOVE
system() = f1d4bd70
bos.rte.libc 6.1.3.11 ROOT REJECT SUCCESS
bos.rte.libc 6.1.3.11 USR REJECT SUCCESS
ADD
system() = f1e9b490
bos.rte.libc 6.1.3.11 USR APPLY SUCCESS
bos.rte.libc 6.1.3.11 ROOT APPLY SUCCESS
44con, London, 2012 Tim Brown 23
Portcullis Computer Security Ltd

24. # Hardened malloc()_
# Check out David Litchfield's paper
“Heap overflows on AIX 5”
# Also, “Enhancements in AIX 5L
Version 5.3 for application
development” mentions a number of
enhancements / possible areas of
concern
44con, London, 2012 Tim Brown 24
Portcullis Computer Security Ltd

25. # Hardened malloc() ++_
$ ls ­la malloc
­rwsr­xr­x 1 root system 53648 Sep 04 22:41 malloc
$ MALLOCTYPE=watson
$ export MALLOCTYPE
$ ./malloc
blah
$ MALLOCDEBUG=catch_overflow ./malloc
Segmentation fault
44con, London, 2012 Tim Brown 25
Portcullis Computer Security Ltd

26. # Enterprise “features”_
# Data
# The real value of your system
# “Interesting” code
# More code is always bad, but OS
code at least benefits more from
the “many eyes” principal –
assuming the “many eyes” are
actually looking – your
enterprise app may not
44con, London, 2012 Tim Brown 26
Portcullis Computer Security Ltd

27. # “Interesting” code_
# Backdoors
# Proprietary protocols
# Embedded library copies
# Changes to user environment
# Insecure API usage
# Missing anti­exploitation
techniques
# Key material and entropy
# Java :­)
44con, London, 2012 Tim Brown 27
Portcullis Computer Security Ltd

28. # Practising unsafe DevOps_
# Build infrastructure
# Cron, cron, cron
# .rhosts
# Sudo :­)
# Init and inetd
# User provisioning and access
management
# Key material
# NFS
44con, London, 2012 Tim Brown 28
Portcullis Computer Security Ltd

29. # Cron, cron, cron_
# Your shell script just ran over my
shadow
# grep victim /var/spool/cron/crontabs/*
/var/spool/cron/crontabs/root:0 01 * * * /opt/victim/start.sh
# cat /opt/victim/start.sh
...
umask 000
OUTDIR=/tmp
...
service=/opt/victim/service
...
OUTFILE="${OUTDIR}/${DATE}_${TIME}.log"
...
$service ­o ${OUTFILE}
44con, London, 2012 Tim Brown 29
Portcullis Computer Security Ltd

30. # In the lab_
# Systems
# Books
# Code
# Tools
# Techniques
44con, London, 2012 Tim Brown 30
Portcullis Computer Security Ltd

31. # Systems_
# Buy or emulate the systems you see
in the wild
# Better still, buy or emulate those
you don't – they're still there!
44con, London, 2012 Tim Brown 31
Portcullis Computer Security Ltd

32. # Books_
# If you understand how one OS works,
the next OS you look at might just
work in a similar way (with similar
bugs / different edge cases):
# Vendor web sites
# Man pages
# Solaris Systems Programming and
Solaris Internals are great books
44con, London, 2012 Tim Brown 32
Portcullis Computer Security Ltd

33. # Code_
# Next time code leaks, take a look,
your adversaries will
# Identify lists like oss­security,
fewer size contests mean more
signal and less noise
# .jar files are human readable
44con, London, 2012 Tim Brown 33
Portcullis Computer Security Ltd

34. # Tools_
# strings and grep
# truss and strace
# DTrace and SystemTap
# objdump, GDB and IDA
# jad, JD­GUI and friends
# Compilers
# checksec.sh (for * GNU/Linux)
# unix­privesc­check
44con, London, 2012 Tim Brown 34
Portcullis Computer Security Ltd

35. # Techniques_
# Sometimes the same crash on another
OS yields greater joy – the Solaris
stack for a certain RPC service
isn't munged
# SetUID binaries can often be
exploited via obscure enviroment
variables – ++ local roots for IBM
products :)
# Old techniques can be reapplied –
glob() style bugs still afflict AIX
44con, London, 2012 Tim Brown 35
Portcullis Computer Security Ltd

36. # Techniques ++_
# Auditing (the other type) will
catch stuff you might miss
# Decompile .jar files
# Check what libraries $enterpriseapp
ships with (don't forget to check
for embedded JVMs)
44con, London, 2012 Tim Brown 36
Portcullis Computer Security Ltd

37. # Techniques ++_
# Check against Microsoft's banned
API list
# Check for anti­exploitation
mitigations
# DT_RPATH AKA Import File Strings
44con, London, 2012 Tim Brown 37
Portcullis Computer Security Ltd

38. # DT_RPATH AKA Import File
Strings_
# dump ­Hv kbbacf1
kbbacf1:
***Loader Section***
Loader Header Information
VERSION# #SYMtableENT #RELOCent LENidSTR
0x00000001 0x0000000f 0x0000001c 0x000000b5
#IMPfilID OFFidSTR LENstrTBL OFFstrTBL
0x00000007 0x000002d8 0x00000063 0x0000038d
***Import File Strings***
INDEX PATH BASE MEMBER
0 /usr/lib:/lib::/opt/IBM/ITM/tmaitm6/links/aix51/lib:.:./lib:../lib::
44con, London, 2012 Tim Brown 38
Portcullis Computer Security Ltd

39. # unix­privesc­check_
# Originally conceived by
@pentestmonkey
# I'm working on 2.x
# Code will be made real soon now!
44con, London, 2012 Tim Brown 39
Portcullis Computer Security Ltd

40. # Conclusions_
# Ask yourself “who analysed the
OS?”; “do I care about segregation
of roles?”; “do I know what my
applications are doing?”; “do I
care what my DevOps teams are
bringing to the party?”
# If these questions matter, don't
audit, whitebox
44con, London, 2012 Tim Brown 40
Portcullis Computer Security Ltd

41. # Questions_
< /dev/audience
44con, London, 2012 Tim Brown 41
Portcullis Computer Security Ltd