Denim Group, Ltd.

Command Injection In Java on Windows: 100% Proven that it is 100% Possible (in Certain Cases)

By Dan Cornell

So Alex Smolen's blog post about command injection in Java and .NET has had me writing some little test cases over the past couple of days (Java command injection, .NET command injection).  When I ran some tests in Java on OS X it looked like simple approaches to command injection weren't effective.  Fantastic!

But wait a minute.  WebGoat has a command injection lesson.  And it is written in Java.  What gives?

So I went and dug through the WebGoat 5.2 code and found that they're playing a little bit of dirty pool - they look through the attack payloads passed in and run some checks and do some other stuff.  Oh, and they make calls to cmd.exe which can chain further calls.  So you actually can inject commands in Java on Windows if you're calling the right original executable.  Not good!

So I updated the previous test code to check for the operating system and run different commands on UNIX versus Windows.  And after some tweaking of the intended.bat and exploit.bat batch files I got new results that did allow me to run multiple commands via a single call to System.getRuntime().exec().  Yikes!  Batch files and commands using cmd.exe can be command injected.

I've uploaded updated test code here:

http://www.dancornell.com/files/JavaCommandInjection_v1_1.zip

So:

• Command injection in Java on OS X: seemingly hard and merits further testing, but be careful if you are making calls to shells like /bin/sh
• Command injection in Java on Windows: not hard if you are running a command that can load other commands - like cmd.exe or batch files (which run via cmd.exe)

The reason I got into Java in the first place was "write once, run anywhere"  That might never have worked as well as Sun had promised, but it was a great goal and Java does it much better than C/C++.  Seeing the results of this testing makes for a great lesson: "Do the right thing - even if you think you don't have to."  Also known as: "Defense in depth."

As is often the case, "Doing the right thing" in this case means:

• Positively validate inputs - type, length, composition, business rules
• Properly encode outputs when they get sent to interpreters

Successful testing finds bugs, but cannot prove a lack of bugs.  In this case the test code demonstrates that you can cause command injection by including "&" and perhaps "&&" characters in your commands if the original executable supports chaining other calls.

The test system is running Windows XP SP2 and the Java environment is Java SE Runtime Environment (build 1.6.0_11-b03) Java HotSpot(TM) VM (build 11.0-b-16, mixed mode, sharing)

Next up: more testing.

--Dan
dan _at_ denimgroup.com

Command Injection in .NET: 82% Proven that is 98% Impossible

By Dan Cornell

So I decided to also slap together a .NET version of the Java command injection testing thing I posted yesterday in response to Alex Smolen's blog post on .NET and Java command injection.  It is up online here:

http://www.dancornell.com/files/DotNetCommandInjection.zip

.NET looks to be similarly resistant to command injection.

Also, "Jordan" posted a comment to the previous post:

One quick way to verify Java isn't vulnerable is to see which native functions it's using. On Linux, use strace -f java [...]/Main on your test app and look for exec or system. Yup, we see execve -- safe calls.

I suppose you could do it that way.  If you wanted the easy way to find out what was actually going on.  But then you wouldn't get to write any crudimentary Java code - and what fun would that be?  That's actually a great idea.

Does that mean that you don't need to validate input that is being sent to command interpreters on Java and .NET?  No.  Failing to do this can still give attackers control over command line arguments and filenames.  Plus there may be other ways to break out of this that my 60 lines of Java or C# test code and 15 test cases didn't find.  (What a surprise that would be!)  Sleep a little better at night.  But not too well.

--Dan
dan _at_ denimgroup.com

Command Injection In Java: 80% Proven that it is 100% Impossible (Sometimes)

By Dan Cornell

IF YOU ARE USING JAVA ON WINDOWS PLEASE SEE THIS FOLLOW UP POST ON COMMAND INJECTION IN JAVA ON WINDOWS.  HECK, SEE THE FOLLOW UP POST REGARDLESS.

I was reading Alex Smolen's blog the other day and ran across the post "Command Injection Impossible in Java and .NET?"  Interesting stuff!  In an effort to avoid doing work I should actually be doing, I decided to look into it a bit more.

So I put together a tiny little program to try a bunch of different permutations to try and test this out.  This is by no means an exhaustive fuzzing but I did run a number of command lines through Java that should have resulted in multiple commands being executed (cut and paste them from the Java System.out output).  I zipped up the code and binaries and uploaded it here:

http://www.dancornell.com/files/JavaCommandInjection_v1_1.zip

If you go into the bin/ directory and run "java denimgroup.fuzzer.commandline.Main" it will try to run a bunch of commands.  I have two scripts in the directory: intended and exploit.  "intended" appends its command line arguments to intended_shell_results.txt and "exploit" appends its command line arguments to exploit_shell_results.txt.  On Mac OS X 10.5.6 with Eclipse 3.4.0 using JDK 1.5.0 it runs the following commands through "Runtime.getRuntime().exec(command);"

./intended ; ./exploit
./intended : ./exploit
./intended | ./exploit
./intended && ./exploit
./intended & ./exploit
./intended ! ./exploit
./intended >> ./exploit
./intended << ./exploit
./intended > ./exploit
./intended < ./exploit
./intended :: ./exploit
./intended ;; ./exploit
./intended ;: ./exploit
./intended :; ./exploit
./intended || ./exploit

Assuming that "exploit" was executed, you would expect to see something in the "exploit_shell_results.txt"  For example, if you manually run "./intended ; ./exploit" from the shell (as Java tried and failed to do via exec()) it will put some info in the file.  But - wait - there's nothing there when Java tries to run it!  Perhaps Alex and the OWASP site are right (!).

Clearly this merits further study.  My list of payloads is, by no means, exhaustive.  But this is certainly interesting.  To the degree that the standard Java libraries seem to prevent at least the most boneheaded attempts at command injection - bravo!  There is a long way to go before declaring victory, but this is at least encouraging.  I'd want to spend a lot of compute cycles trying to fiddle with combinations of Unicode characters on different OSes and different JDKs, but these days I am kind of busy.  The code is available under an Apache 2.0 license so anyone can feel free to make this happen.

And hey - maybe I'll fire up VS.NET 2008 and make a C# version.  Otherwise I might accidentally do some real work.

--Dan
dan _at_ denimgroup.com

QASL 1.0 Released!

By Dan Cornell

QASL (Quality Assurance Scripting Language) 1.0 has been officially released.  QASL is a lightweight scripting language that Denim Group uses to do automated functional testing of web applications.  It has a basic syntax that allows a programmer or QA person to control a web browser and run tests on a web application.  These tests can then be bundled together to provide a comprehensive set of functional tests for an application, as well as a robust reporting framework that indicates test failures and provides additional debugging information such as screenshots of unsuccessful test cases.

QASL has been released under an Apache License.  Here are the relevant links:

• Sourceforge site
• Download page

Many thanks to all the Denim Group folks who have been putting in long hours over the past six months to refactor QASL, test it, document it and make it release-ready.  You all have done a hell of a job.

--Dan
dan _at_ denimgroup.com

Building the PFF PHP Fuzzer on Mac OS X

By Dan Cornell

Recently I have been looking at some PHP security testing issues and I needed a fuzzer.  I found a PHP fuzzer called PFF available via the Digital Dwarf Society.  The original author's webpage doesn't seem to be up anymore, but the Digital Dwarf folks had a cached version of the actual code available.

The build instructions that come with the tool are:

cc pff.c -o pff -lssl

The problem with that was that on my OS X laptop (version 10.5.6) I got the following build messages and errors:

Undefined symbols:
  "_BIO_f_base64", referenced from:
      _encode_base64 in cc2Np5yM.o
  "_BIO_ctrl", referenced from:
      _encode_base64 in cc2Np5yM.o
      _encode_base64 in cc2Np5yM.o
  "_BIO_new", referenced from:
      _encode_base64 in cc2Np5yM.o
      _encode_base64 in cc2Np5yM.o
  "_BIO_s_mem", referenced from:
      _encode_base64 in cc2Np5yM.o
  "_BIO_write", referenced from:
      _encode_base64 in cc2Np5yM.o
  "_BIO_push", referenced from:
      _encode_base64 in cc2Np5yM.o
  "_BIO_free_all", referenced from:
      _encode_base64 in cc2Np5yM.o
ld: symbol(s) not found
collect2: ld returned 1 exit status

Part of these issues seemed to stem from OpenSSL include/library issues, so I Googled around a bit and updated my build command to:

cc pff.c -o pff -lssl -lcrypto

That helped ... a bit.  At that point my error messages had dwindled to:

pff.c: In function ‘genfilename’:
pff.c:346: warning: assignment makes pointer from integer without a cast
Undefined symbols:
  "_strndup", referenced from:
      _genfilename in ccQlatXg.o
ld: symbol(s) not found
collect2: ld returned 1 exit status

Progress!  After a bit of searching, I found out that, apparently, Mac OS X doesn't support the "strndup" function as it is a GNU-specific extension to the standard library (reference is here).  Who would have thought?

So, in the spirit of getting this to work, I updated the source code to replace the "strndup" function call with a call to "strdup."  Then I re-ran:

cc pff.c -o pff -lssl -lcrypto

Now the build runs properly.  Success!  Also, the pff binary runs as it should so I can start fuzzing away on PHP functions.

The diff for the pff.c file is:

346c346
<      if((name = strdup(filename)) == NULL) {
---
>     if((name = strndup(filename,strlen(filename))) == NULL) {

I am about to mail this along to the Digital Dwarf (info@digitaldwarf.de) and SETEC/calcite (calcite@setec.org) folks but I also wanted to post the info publicly as well.  Happy PHP fuzzing!

More info on strdup, strndup and associated functions can be found here.

--Dan
dan _at_ denimgroup.com

PS - Photo is of my dog, Cody.  He's a good boy.  (c) Dan Cornell 2008.

Quality Assurance Scripting Language (QASL) Beta Release

By Dan Cornell

Over the past couple of years Denim Group built and used an internal tool called QASL (Quality Assurance Scripting Language) for automated functional testing.  It uses the capabilities of WATiN to drive an IE browser and run web applications through functional tests and then provides a tracking and reporting framework that can be integrated with build tools like Cruise Control.  This has been a HUGE help for our development efforts because it allows us to quickly create test cases and then run them consistently and frequently so bugs introduced into our web applications are identified quickly.

Late last year we decided that we wanted to release this tool to the community, so a bunch of folks have been working to get the code cleaned up and put together some documentation.  We should finally be at the point where QASL can be used by the world at large - not just by folks at Denim Group.

Currently QASL is hosted at SourceForge.  The current release is a 1.0Beta1 and we should be at the actual 1.0 release in about two weeks.

Many thanks to the Denim Group folks who helped make this release possible: Michael, Dina, Derek, Jonathan, Kushala, Michael, Stephen, Brent, Jennifer and Daryl.  You all really went above and beyond to make this happen.

Keep an eye on this space as we will be posting tutorials and more information about the internals of QASL as well as approaches we have found to be successful for integrating automated acceptance testing into software development projects.

--Dan
dan _at_ denimgroup.com

Houston TechFest Slide Deck Online

By Dan Cornell

The slide deck from my talk at Houston TechFest is now online: Static Analysis Techniques for Testing Application Security.  Also see my previous post about the trip there.

--Dan
dan _at_ denimgroup.com

The Road to Houston TechFest

By Dan Cornell

I was up in Houston last weekend for the rescheduled Houston TechFest.  The hurricane delayed this from the original date, but the event was still packed.

I flew into Houston for the day to give my talk on Static Analysis Techniques for Testing Application Security.  Unfortunately, when I was headed to my early-morning flight, I noticed that the airport had been overrun by birds:

Yikes!  I didn't know who my pilot was, but I wasn't convinced he would be able to successfully land a 737 in the San Antonio River.  After all, the Hudson is a little wider than the Riverwalk...

Fortunately I made it to Houston all right and checked in with the TechFest folks.  The event was at the University of Houston so I went to the bottom of the student center where the event was being held to try and get some work done before my talk.  I soon found myself trapped between a bunch of martial arts students:

And some folks playing "Magic - The Gathering" :

No offense to the "Magic - The Gathering" crowd, but I had to cast my lot with the martial arts folks.  Cards representing elven chain mail and whatnot are no match for a crowd of folks ready to break actual bricks with their hands.

Fortunately everyone got to remain friends and I made it to my talk unscathed.

There was a great group there and we had some great questions such as:

• Does the fact that most .NET static analysis tools rely on decompiling MISL make .NET, as a language, less secure than Java? (Both Java bytecodes and .NET MSIL are pretty easy to decompile, so there aren't a ton of differences there.  .NET static analysis tools usually use MSIL binaries because .NET code exists in a variety of languages and it is easier to write one parser/decompiler for MSIL that will work for all .NET languages wheras Java bytecode is almost always compiled from Java source code, thus making Java source or Java bytecode reasonably equally attractive choices for tool builders.)
• Are there any subsets of PMD rules that are best for running security checks? (There are security-specific PMD checks, but they are mainly related to API misuse.  I don't know of any collection that includes the explicit security rules along with rules from other categories that often have security implications.)

One thing I talked about Saturday that was relatively new was the OWASP Open Review Project (ORPRO) which provides advanced static analysis capabilities for open source projects.

Overall it was a great session and I will be posting the slide deck shortly.

--Dan
dan _at_ denimgroup.com

SearchSoftwareQuality.com Answer Up Online

By Dan Cornell

The SearchSoftwareQuality folks have posted a response I put together on a question about security code review tools.  Check it out here.

--Dan
dan _at_ denimgroup.com

OWASP EU Summit in Portugal: Friday

By Dan Cornell

The EU Summit finished up with a recap of the results to come out of the various working groups and an open OWASP Board meeting.  The full results of the Board meeting will be laid out on the Wiki shortly, but for me the most exciting development was the creation of several Global Committees for OWASP that will essentially act as middle managemnt for the organization.  Up until now there have been contributors, project/chapter leaders and board members.  That has served OWASP well for a number of years, but with the scale of the organization, it has become evident that we need more coordination to avoid rework and prevent conflicts.  To address this, several Global Committees are being set up to centralize conversations and thinking in several important areas.

I will be serving with Michael Coates on the Global Membership Committee working to increase the value of OWASP membership to the individuals and organizations who become members as well as working to increase the number of individuals and organizations who are OWASP members.  If you have any thoughts or questions about this, please feel free to contact Michael or I.

Overall the summit was an incredible experience.  I have been working with OWASP for a long time - first as a consumer of OWASP materials and then as the San Antonio Chapter lead as well as working on projects like Sprajax and the Open Review Project (ORPRO).  To see the growth that the application security space has undergone during this time has been amazing, and to see OWASP grow along with it has been even more so.  OWASP is a great gathering place for intelligent and dedicated individuals who are experts in their discipline.  I have seen others comment that they view this summit as "the end of the beginning" for OWASP and I think that rings true.  I'm looking forward to working with the Summit attendees and the OWASP community as a whole to continue the work we started there.

--Dan
dan _at_ denimgroup.com