Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A picture got my PostgreSQL database to start mining Monero

imperva.com

Post reply on HN
Print view View original

21–30 of 99 posts

Re: A picture got my PostgreSQL database to start mining Monero

#21

Post by zaarn »

vbezhenar wrote: post #18
bawana wrote: post #7

If we can subvert computers running databases (think healthcare, insurance companies, the IRS, etc) then isn’t it time to shut down the internet? People can’t have nice things. I think this is proof that we are in hell. There is a god and she is watching from the other side. Well, I take it back. Keep the infrastructure so that the ISPs and broadcasters can keep taking our money but make it like tv used to be - one w…

Could I receive a content of articleId=1;/etc/passwd please?

    { "error": "article not found", "errnum": 229 }cat: /etc/passwd: No such file or directory
I should probably have tried on a real linux system.

Re: A picture got my PostgreSQL database to start mining Monero

#22

Post by lmm »

prepend wrote: post #19

How does the image get executed? I went through the article and in the example the author extracts the executable manually using dd. But how would an unsuspecting user run the executable? Perhaps I missed this, but is there some image viewer or browser that runs the trailing bytes of images?

It's executed from PostgreSQL - the article shows SQL queries containing shell commands. This is a way for an attacker who's already obtained the ability to run arbitrary queries against a PostgreSQL server to run an exploitation payload there; the real solution is not to let the attacker get into that situation.

Re: A picture got my PostgreSQL database to start mining Monero

#23

Post by fps »

prepend wrote: post #19

How does the image get executed? I went through the article and in the example the author extracts the executable manually using dd. But how would an unsuspecting user run the executable? Perhaps I missed this, but is there some image viewer or browser that runs the trailing bytes of images?

I was hoping for some sort of image or binary processing exploit too, but the attack just uses a Postgres vulnerability to execute arbitrary shell code. [0][1] The fact that the executed code was buried in an image seems to just be a camouflage step for the attacker.

0. https://github.com/nixawk/pentest-wiki/blob/master/2.Vulnera... 1. https://www.rapid7.com/db/modules/exploit/linux/postgres/pos...

Re: A picture got my PostgreSQL database to start mining Monero

#26

Post by woodrowbarlow »

yread wrote: post #16

I thought this was one of those files that are an image and an executable AT THE SAME TIME. Slightly disappointed that it's just catted together

even polyglot image/executables are usually _mostly_ two files mashed together. some cleverness is always required to construct a header that is valid for both formats, but then the trick is usually to make the executable jump past the image data (or, for interpreted languages, comment out the image data) and then store the executable payload at the end of the file.

Re: A picture got my PostgreSQL database to start mining Monero

#27

Post by woodrowbarlow »

EGreg wrote: post #15

How exactly can this be exploited? Who has to run the Postgres database? In what kind of way does it has to be accessed to get this happening? Are we talking about web apps that use Postgres on the back end and run arbitrary queries? Are we talking about people who somehow extract the Postgres database username and password and it has admin permissions? I wasn't sure what's happening.

at this point, the attacker has already owned the database and found an exploit that allows arbitrary shell execution on the host. i feel like the title is a little bit click-baity, because the attacker could have just hosted their executable payload on any of a thousand shady file hosting sites without needing to hide it in an image.

Re: A picture got my PostgreSQL database to start mining Monero

#28

Post by xyrouter »

jacob019 wrote: post #6

It's amazing that in 2018 people leave databases publicly exposed.

I want to know why exposing databases on the Internet publicly is considered a problem. Is it because a vulnerability found in a database would allow to exploit the database directly?

I ask this because people expose web-apps on the Internet publicly too and an SQL injection vulnerability on the web-app would also be equally catastrophic.

I guess exposing web-apps on the Internet is a risk we need to accept because it has to be available to users of the Internet. But we should not expose anything else that we don't need to? Is that the reason why exposing databases publicly is considered best practice.

I would like to know what experienced professionals think about this.

Re: A picture got my PostgreSQL database to start mining Monero

#29

Post by Piskvorrr »

yread wrote: post #16

I thought this was one of those files that are an image and an executable AT THE SAME TIME. Slightly disappointed that it's just catted together

One has headers at start of file, other has headers (footers?) at end of file; slightly useful :)
Post reply on HN