SQLite Injection

There does seem to be a lack of information regarding SQLite injection. This is probably because SQLite is so limited compared to other SQL databases. However, it does seem that given Android (and iOS?) interest in using them, there is something to be said for writing up some basics and findings that I've had so far.

 I will try to write this from a more general SQLite injection angle rather than OS specific. First enumeration. Getting out the master database is fairly straight forward as long as your injection is early on. If you can get results posted to the screen the enumerating the database structure is easy:

"* FROM SQLITE_MASTER; --"

The SQLITE_MASTER database holds descriptions of all the tables so is a quick win for enumeration. From there, more select statements will get you the rest.

If the injection point is not at the WHERE or SELECT clause then things may get a little more difficult. More particularly interesting when the injection is at the ORDER BY clause. This means that not only can you not add in the table to select from, but you also can't use a UNION statement to join it to a fresh select statement. I've yet to find a good way to solve this one so please, answers on a postcard.

This is just an introductory post. I want to cover effective manual blind SQLite injection but this will have to wait until next time.

The other area that I want to look into is the use of the "." commands. SQLite seems to have many extra functions, which I'm guessing can not be used through API calls. Perhaps the PHP exec() function might? It would certainly be good to know where, if anywhere, these values could be used, as it would allow inclusions of other files.

Finally I want to take a look at whether the values can be overwritten with long/specially formatted strings. The .db file could then be manipulated into becoming something else (okay so this one's a long shot, but worth taking a look at).

Stay tuned

vmware quick fix

Quick solution to the "Taking ownership of this virtual machine failed" Error.

Go to the vmware image's folder and delete the .lck file

Apache, php and dlls

For a while now I've been adding more and more features to Apache and PHP for testing. I want to add things like LDAP and SQL support in PHP but the libraries fail to load when I update the PHP.ini file. I have continually come up against error messages like these:

PHP Warning: PHP Startup: Unable to load dynamic library 'c:/php/php_ldap.dll' - The specified module could not be found.\r\n in Unknown on line 0

and

PHP Warning: PHP Startup: Unable to load dynamic library 'c:/php/php_pdo_mysql.dll' - The specified module could not be found.\r\n in Unknown on line 0

The problem I had was actually nothing to do with PHP trying to find these libraries. Instead it was to do with the other libraries that they needed. The Apache logs make no mention of this. You need to search the internet to find which dlls are needed depending on your web server and the dll you wish to include.

For example, running PHP and Apache, to include LDAP, update the php.ini and then also make sure that libeay32.dll and ssleay32.dll are in the Apache bin folder. Then voila! No more nasty errors.

Movember

So Movember isn't about just being manly, it's also an opportunity to raise any points that might help us men live a little healthier:

As men, we are told that we are genetically more likely to die from various diseases than women. Unfortunately (or should that be fortunately?) this is not the case. Many factors are actually more to do with our attitudes that our dna. I'm sure it's a similar story across the world but in the UK, women in our age group are twice as likely to go see a doctor than us men are. The top 10 reasons for us men not wanting to go are:

1. Sitting around - "they don't like the waiting time involved"
2. Health services are feminised - "the decor and bias of information towards women"
3. Embarassment - "Men are embarrassed to discuss intimate feelings and information"
4. No point unless there is something wrong - "Below 40 years of age, men only view doctors in terms of emergencies"
5. Men aren't socialized into visiting the doctor - "whenever men visit the doctors, they only see women and older people."
6. Suck it up' attitude - "men are socialized into internalizing their emotions and physical discomforts"
7. Defects are signs of weakness - "visiting doctors may signal illness or disability"
8. Fear of being judged - "their problem or physical state is something unique"
9. Men exaggerate the negative qualities of health provision - "men find the health care system inadequate, a waste of time."
10. Doctors aren't equated with preventive health - "at age 40, men generally have to see their doctor regularly. They realize the benefits of screening than waiting to happen."


Sadly, I can not stand up as a role model. I have never discussed cancer with my doctor, I remember something vaguely about checking yourself from school and the notion of a prostate exam is something I connect with the over 50 year olds.

People won't tell you what to do to keep you healthy. We don't stand around the bar discussing the best way to check your testicles for lumps (maybe that's not a bad thing). You need to go and find this out for yourself. Otherwise you are just waiting for something to go wrong, which is a really stupid idea when you think about it.


Links to answer your questions:
http://menshealth.about.com/od/diseases/u/concerns.htm - general concerns list
http://cancer.about.com/od/cancersaffectingmen/tp/menscancersign.htm

A statistic to finish up on. Testicular cancer normally affects men between 20 and 39. The survival rate is over 95%. Look after yourselves men.

John the Ripp... oh wait, it's not working

John the Ripper (http://www.openwall.com/john/) is a fantastic Unix based password/hash cracker. If you want to crack md4 hashes then you need the jumbo install, which can fail without the correct bits installed beforehand.

This error:
/usr/bin/ld: cannot find -lcrypto

means you are missing libssl-dev package, which is not something that trips up the standard JtR install. Run this command to fix it all:

apt-get install libssl-dev

It should then complete the make process just fine.

How much do we trust our email?

The purpose of this article is show how an attacker can trick someone into thinking that they are talking to someone else on email. It uses the following two websites:

1.Mailinator [http://mailinator.com] - Instant access and anonymous web mail.
2.Fake Emailer [http://emkei.cz/] - Builds fake emails.

Scenario
Bob wants to trick Alice that her boss is contacting her. Alice works for Fireweb in Japan. He wants to use social engineering to make Alice give up her home phone number.

Using Fake Emailer to create the engineered email
Fake emailer is a really quick and easy way to build an email that looks (from the outside at least), trustworthy. You can tailor it to have any from and two address, and reply-to address, any contents, even the headers themselves can be tailored.

We will use the following:
To address: Alice@herhomeemail.com
From: The.Boss@fireweb.ne.jp
Reply-to Address: The.Boss.a.fireweb.ne.jp
Message: Hi Alice, I'm afraid we are having an emergency here in the office, and I would like to contact you ASAP, could you please send me your home phone. Thank you. The Boss.

What Alice sees:
Alice gets a very official looking email. The from address is the boss' real address.

She clicks reply and the reply to address is The.Boss.a.fireweb.ne.jp . She then types her reply.

The result
Alice sends her information to the Mailinator address which Bob can instantly access anonymously.

Conclusions and preventions:
Alice had very few clues to tell her what was happening. The biggest and most obvious to us now is that the reply-to address is completely wrong. However it gets pretty well hidden. For starters the initial From address is completely legit (assuming Bob knew it). Not many people go out of their way to double check the email reply address is write, and even a quick glance here is still not enough to catch what is going on.

This could be furthered by putting HTML on the site to make it look more official, or getting Alice to do something that doesn't even involve replying to the address, like clicking on a contained link, or contacting a 3rd person on the Boss' behalf.

In this case, we have to look at the header information to see what is going on:

X-Originating-IP: [46.167.245.101]
Authentication-Results: mta1451.mail.mud.yahoo.com from=fireweb.ne.jp; domainkeys=neutral (no sig); from=fireweb.ne.jp; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO emkei.cz) (46.167.245.101)
by mta1451.mail.mud.yahoo.com with SMTP; Wed, 19 Jun 2011 01:18:08 -0700
Received: by emkei.cz (Postfix, from userid 43)
id 6096281AA11; Thu, 30 Jun 2011 06:18:11 +0200 (CEST)
To: alice@yahoo.com
Subject: firey shark
From: "The boss"
X-Priority: 3 (Normal)
Importance: Normal
Errors-To: boss@fireweb.ne.jp
Reply-To: The boss@fireweb.ne.jp
Content-Type: text/plain; charset=utf-8
Message-Id: <20110630041811.6096281AA11@emkei.cz>
Date: Thu, 30 Jun 2011 06:18:11 +0200 (CEST)
Content-Length: 1

Doing an IPlookup [http://ip-lookup.net/index.php], shows us that the originating IP of 46.167.245.101 is obviously wrong and the message-Id contains the source site.
The received information is also different from normal, as if it has bounced off of emkei.cz, not something you normally see on emails.

Despite all of these anomolies, both Yahoo and google mail both send through the information without detecting and warning the user.

Vaio and Skype

Vaio has some webcam issues when it comes to Skype video calls (or should that be the other way around). Anyway, the problem is that Skype defaults to using a bluetooth webcam, which if you only have the basic onboard webcam, you'll crash Skype.

There has been musings of various fixed beta versions and workarounds, but it turns out you can fix it in 5 seconds. Just do the following (and take backups in case it doesn't work).

1. Find the C:\Users\you\AppData\Roaming\Skype\username\ folder and open the config.xml
2. Change the line
from: <Device>Bluetooth Video</Device>
to: <Device>USB Video Device</Device>

voila, now it doesn't try to access a bluetooth device, so it doesn't crash.