Executing Code From Non-executable Files
We're all told about the hazards of running untrusted executables. If a
friend sends you the latest greatest program, can you be sure that it
was him as opposed to someone forging the email address? Or perhaps it's
a virus/worm. Or perhaps your friend is just malicious and wants you to
run a program that has 'rm -rf /' in it.
What some may not realize is that some non-executable file formats have
the potential to run malicious code. A few weeks ago I challenged folks
to create a file that, when viewed with a standard tool, would be able
to perform system actions. In this case, the payload should take the
file 'modifyme' and delete the first four bytes. In real life, you'd
expect something more interesting, such as binding a network-accessible
shell, or creating a suid binary.
The first one we'll look at is a man page. Man pages are usually stored
in directories such as /usr/man/ or /usr/share/man in a macro language
that is readable by troff. For example, on my system, the source to the
p0f man page looks like this:
.TH P0F 1
.\" NAME should be all caps, SECTION should be 1-8, maybe w/
subsection
.\" other parms are allowed: see man(7), man(1)
.SH NAME
p0f \- identify remote systems passively
.SH SYNOPSIS
.B p0f
.I "[ -f file ] [ -i device ] [ -o file ] [ -s file ] [ -vKUtq ] [
'filter rule' ]"
.br
.SH "DESCRIPTION"
This manual page briefly documents the
.BR p0f
command.
...
It is stored in /usr/share/man/man1/p0f.1 so when you type 'man p0f', it
runs this file through various parsing programs and, in the end, shows
you a readable version like this:
P0F(1) P0F(1)
NAME
p0f - identify remote systems passively
SYNOPSIS
p0f [ -f file ] [ -i device ] [ -o file ] [ -s file ] [
-vKUtq ] [ 'filter rule' ]
DESCRIPTION
This manual page briefly documents the p0f command.
...
One of the parsers invoked by man is troff. All those lines beginning
with '.' are troff macros, which are used to specify indentation,
boldness, and such. It's an ancient language, created eons before HTML.
In addition to the formatting options, there are a couple macro requests
that allow you
Win an Amazon Kindle!
This month's giveaway gadget - Amazon's Kindle - will keep you entertained on the long trip home to visit family and friends over the holidays. Enter the drawing now!
Applied Security Visualization
By Raffael Marty
Published by Addison-Wesley Professional
Learn more!
IT Manager's Handbook
By Bill Holtsnider and Brian D. Jaffe
Published by Morgan Kaufmann
Learn more!
Windows Vista Resource Kit
By Mitch Tulloch, Tony Northrup, and Jerry Honeycutt
Published by Microsoft Press
Learn more!
