Denim Group, Ltd. Blog

Command Injection In Java on Windows: 100% Proven that it is 100% Possible (in Certain Cases)

By Dan Cornell

So Alex Smolen's blog post about command injection in Java and .NET has had me writing some little test cases over the past couple of days (Java command injection, .NET command injection).  When I ran some tests in Java on OS X it looked like simple approaches to command injection weren't effective.  Fantastic!

But wait a minute.  WebGoat has a command injection lesson.  And it is written in Java.  What gives?

So I went and dug through the WebGoat 5.2 code and found that they're playing a little bit of dirty pool - they look through the attack payloads passed in and run some checks and do some other stuff.  Oh, and they make calls to cmd.exe which can chain further calls.  So you actually can inject commands in Java on Windows if you're calling the right original executable.  Not good!

So I updated the previous test code to check for the operating system and run different commands on UNIX versus Windows.  And after some tweaking of the intended.bat and exploit.bat batch files I got new results that did allow me to run multiple commands via a single call to System.getRuntime().exec().  Yikes!  Batch files and commands using cmd.exe can be command injected.

I've uploaded updated test code here:

http://www.dancornell.com/files/JavaCommandInjection_v1_1.zip

So:

• Command injection in Java on OS X: seemingly hard and merits further testing, but be careful if you are making calls to shells like /bin/sh
• Command injection in Java on Windows: not hard if you are running a command that can load other commands - like cmd.exe or batch files (which run via cmd.exe)

The reason I got into Java in the first place was "write once, run anywhere"  That might never have worked as well as Sun had promised, but it was a great goal and Java does it much better than C/C++.  Seeing the results of this testing makes for a great lesson: "Do the right thing - even if you think you don't have to."  Also known as: "Defense in depth."

As is often the case, "Doing the right thing" in this case means:

• Positively validate inputs - type, length, composition, business rules
• Properly encode outputs when they get sent to interpreters

Successful testing finds bugs, but cannot prove a lack of bugs.  In this case the test code demonstrates that you can cause command injection by including "&" and perhaps "&&" characters in your commands if the original executable supports chaining other calls.

The test system is running Windows XP SP2 and the Java environment is Java SE Runtime Environment (build 1.6.0_11-b03) Java HotSpot(TM) VM (build 11.0-b-16, mixed mode, sharing)

Next up: more testing.

--Dan
dan _at_ denimgroup.com

.NET Code for Setting IE Preferences

By Dan Cornell

GregL from Denim Group spent a bunch of time solving a .NET coding issue last week.  Since he couldn't find the information he needed with a simple Google query I figured I would put some of it up here hoping to help folks who had to solve the same problem in the future.

The situation was this: He had a WebBrowser control that we were using in a Windows Forms application to display web pages inside an application that was essentially a custom web browser.  On a new Windows XP installation, the first time you try to submit a form to access the Internet you get the annoying message:

When you send information to the internet, it might  be possible for others to see that information.  Do you want to  continue?

First of all this is a pretty pointless message.  But whatever...

The problem he ran into was that the pop up windows didn't appear when it was initiated by the WebBrowser control, causing the application to hang while waiting for a response.  To get around this he wanted to set the registry key related to this error message so the system treated it as if the message had already been accepted.

To find the correct registry key, he used RegMon from SysInternals to watch for keys being written.  He limited his search to keys off of "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Interent Settings"  He also limited the search to only look at keys associated with iexplorer.exe's registry activity and to highlight all SetValue calls.  There were still a HUGE number of entries because IE is very chatty with the registry...

The code to do this ought to look something like this:

RegistryKey key = Registry.CurrentUser.OpenSubKey("\\Software\\Microsoft\\Windows\\CurrentVersion\\Interent Settings\\Zones\\3",true);
if (key == null)
{
    key = Registry.CurrentUser.CreateSubKey("\\Software\\Microsoft\\Windows\\CurrentVersion\\Interent Settings\\Zones\\3");
}
key.SetValue("1601", 0);

Zone 3 is for the "Internet" zone.
1601 is the message key we are zeroing out.

So this was fun stuff.  Many thanks to GregL for all the detective work tracking this down.

--Dan
dan _at_ denimgroup.com

Michael Howard Speaking at OWASP San Antonio Tomorrow

By Dan Cornell

Microsoft's Michael Howard will be speaking at the OWASP San Antonio meeting tomorrow.

Top Ten Strategies to Secure Your Code
Presented by Michael Howard, Principal Security Program Manager at Microsoft Corp.
Many people think security knowledge is out of their grasp and that such expertise belongs only to the security high-priesthood. First, there is no such thing as a "security high-priesthood"; all software developers should have some security expertise. Second, regardless of the programming languages you use, or the operating systems you deploy on, there are some very simple rules you can follow that will help secure your applications.

Come listen to Michael's thoughts on how to secure code based on his work with thousands of software developers inside and outside Microsoft. There are, of course, plenty of security war stories!

San Antonio Technology Center (Web Room)
3463 Magic Drive
San Antonio, TX 78229

Wednesday, June 25, 2008
11:30 a.m. - 1:00 p.m.

(Sodas and snacks will be provided. Attendees are free to bring a bag lunch.)

Register Now

About the Speaker, Michael Howard:
Michael is a software security expert, author of several books and many papers and articles, and a frequent speaker at security-related conferences. He was notably involved in Microsoft's development and implementation of what was termed the "Security Development Lifecycle". Visit Michael's Security Blog.

--Dan
dan _at_ denimgroup.com

To Thine Own Self Be True

By Michael R.

While working on a .NET 2.0 web application, the team encountered a bug of a particularly maddening sort (often described as a Heisenbug).  The issue can be reproduced reliably, but only when the source is compiled and run in release mode. With debug-mode compilation, or stepping through a release-mode compile in Visual Studio, the code performs as expected.

Essentially, when the release-mode code executes outside of Visual Studio, requesting the index of a known item in a list returns -1, indicating no matching object was found in the list.  IndexOf uses equality between the argument and each object in the list to determine if item is in the list.  In this instance, the object is there, but the test for equality failed.

The details of using the debugger and the "Immediate window" to identify the culprit are fodder for future discussion.  The bug itself, which is recreated in the console application below, shows why it failed, along with a demonstration of the fix. Some readers may notice that several details of implementing the IComparable interface are missing, which were omitted for brevity. 

using System;

 

namespace FloatIssue

{

class Program

    {

static void Main(string[] args)

        {

MyFloat mf0 = new MyFloat(0f);

Console.WriteLine("MyFloat(0f).Equals(self)      : {0}", mf0.Equals(mf0));

 

MyFloat mf1 = new MyFloat(0.01f);

Console.WriteLine("MyFloat(0.01f).Equals(self)   : {0}", mf1.Equals(mf1));

 

Console.WriteLine("MyFloat(0f).EqualsFix(self)   : {0}", mf0.EqualsFix(mf0));

Console.WriteLine("MyFloat(0.01f).EqualsFix(self): {0}", mf1.EqualsFix(mf1));

        }

    }

 

class MyFloat

    {

private readonly float _DisplayValue;

 

public MyFloat(float pDisplayValue)

        {

            _DisplayValue = pDisplayValue;

        }

 

public float Value

        {

get

            {

return _DisplayValue / 100;

            }

        }

 

public float DisplayValue

        {

get

            {

return _DisplayValue;

            }

        }

 

public bool Equals(MyFloat pFloatBug)

        {

return (Value == pFloatBug.Value);

        }

 

public bool EqualsFix(MyFloat pFloatFix)

        {

return (DisplayValue == pFloatFix.DisplayValue);

        }

 

    }

} 

The value object class is a composition of several other value object classes, so its equality test depends on the equality tests for its members.  One member, which implements a percentage-weighted value, is represented by the MyFloat class.  The parameters of the constructor include a display value.  The display value is retrieved using the DisplayValue property, and the derived Value is calculated and returned by the getter each time the property is accessed.  The Equals method tests equality of the (derived) Value properties.

In debug mode, the output of the application is: 

MyFloat(0f).Equals(self)   : True

MyFloat(0.01f).Equals(self): True

MyFloat(0f).EqualsFix(self)   : True

MyFloat(0.01f).EqualsFix(self): True

 

However, in release mode, executed from the command line, the output is: 

MyFloat(0f).Equals(self)      : True

MyFloat(0.01f).Equals(self)   : False

MyFloat(0f).EqualsFix(self)   : True

MyFloat(0.01f).EqualsFix(self): True

A small change to the Equals method (shown as EqualsFix) to compare the readonly DisplayValue attribute rather than the derived-on-demand Value property causes the class to behave as expected in both modes.

—Michael R.

ROOTS Slide Deck Online

By Dan Cornell

The slide deck from my talk at ROOTS 2008 is now up online.  That talk covered security testing with static analysis tools and dynamic analysis tools, looked at strengths and weaknesses of both approaches and then discussed how to us them together.

This has been a great conference and I hope to post some more details shortly.

--Dan
dan _at_ denimgroup.com

(Photo is of a statue of Henrik Ibsen here in Bergen, Norway)

Static Analysis Techniques for Testing Application Security: Slide Deck from OWASP Austin

By Dan Cornell

The slide deck from my presentation Tuesday for OWASP Austin is up online here.  One thing to note - I took the diagrams I drew on the whiteboard and added them to the slide deck.

Thanks to everyone who attended and thanks for all the great questions!

--Dan

Speaking at OWASP Austin: Static Analysis

By Dan Cornell

 

This is kind of late notice, but I will be speaking at the OWASP Austin meeting tomorrow (or today, depending on where you are) - Tue March 25th.

Details are:

When: March 25th, 2008, 11:30am - 1:00pm

Who: Dan Cornell, Principal of Denim Group, Ltd., OWASP San Antonio Leader, Creator of Sprajax

Dan Cornell has over ten years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies.

Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the San Antonio chapter leader of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, OWASP's open source tool for assessing the security of AJAX-enabled web applications.

Topic: Static Analysis Techniques for Testing Application Security

Static Analysis of software refers to examining source code and other software artifacts without executing them. This presentation looks at how these techniques can be used to identify security defects in applications. Approaches examined will range from simple keyword search methods used to identify calls to banned functions through more sophisticated data flow analysis used to identify more complicated issues such as injection flaws. In addition, a demonstration will be given of two freely-available static analysis tools: FindBugs for the Java platform and FXCop for the .NET platform. Finally, some approaches will be presented on how organizations can start using static analysis tools as part of their development and quality assurance processes.

Where: Whole Foods, 550 Bowie Street, Austin, TX 78703. Come to the Whole Foods plaza level and sign in with receptionist. To get to the plaza take the stairs from the main entrance. The stairs are located on the West Side of the building, just north of the main entrance. There is no access to the Plaza level from inside the store.

Sorry for the late notice on this.  If you are in the Austin area hopefully you caught this on the mailing list or via some other channel.  Hope to see folks there!

--Dan
dan _at_ denimgroup.com

Mono 1.9

Last Friday the folks at the Mono Project released Mono 1.9. A list of the new features from its previous version can be found here.

I've watched the Mono project with great interest as they are the group furthest along in an open source version of the .NET platform. If you've ever wondered what a .NET application would look like on Linux or MacOS, then Mono should satisfy that curiosity. What makes this most current version so worthwhile is the inclusion of all the recent additions to the .NET framework. By default, the mono compiler can compile code written for the .NET 3.5 Framework (just released in November!), including such new features as LINQ and Silverlight. Virtually all of the .NET 3.0 foundation components are included as well, including those for web and presentation development. The project includes some fairly robust examples and documentation and an IDE called Monodevelop for more sophisticated development. And of course, if you don't like a certain implementation in Mono, because it is open source, you are free to make a change to the source code and submit it.

The Mono 1.9 SDK is freely available and can run on MacOS, Linux, and (amusingly) Windows operating systems. For web applications, plugins for different web servers exist, although Apache's is the furthest along and the built-in test server is very good for non-deployment purposes. Overall, this is a very good release over the previous and serves to whet the appetite for the much anticipated Mono 2.0.

—Erhan K.

Hello Secure World

Microsoft has just created a new security awareness site. This site, http://www.hellosecureworld.com, attempts to provide security awareness and education in the developer community.

The notion of security awareness is very interesting. Michael Howard, during his security development lifecycle presentation given at Denim Group, discussed some of the security classes he taught up in Redmond. These daylong classes were given to developers of different projects. The goal wasn't to make them security gurus or even to remember the difference between, say, symmetric- and asymmetric-key algorithms (if that doesn't take a security guru). The goals were to simply inform developers of common security scenarios and solutions. If they forgot the solutions the minute they left the class, that was OK, as long as that when presented with similar situations, they might recognize the scenario and perhaps Google for a solution (or, since this is Microsoft, perform a Live search).

And just as Microsoft competes with Google (and, at least for now, Yahoo!), Hello Secure World also requires Silverlight, Microsoft's answer to Adobe's Flash.

—Erhan K.

Static Analysis Slide Deck from OWASP San Antonio Online

By Dan Cornell

The slide deck from last week's presentation on Static Analysis and Application Security to OWASP San Antonio is now online.  Check it out.  This was a great meeting and was one of our best attended ever.

--Dan
dan _at_ denimgroup.com