3-Tier, Maria (database), Hping3, John, Injection

I. Overview

As part of the practical training, I will install and connect the database server, following up on the previous post. I will also practice a simple DDoS attack using the Hping3 tool. Furthermore, I will practice a technique for cracking account passwords using the John the Ripper tool. Finally, I will explore SQL injection as a simple example of an injection attack.

II. Database

The database server is MariaDBWe plan to use this. Before installing the database server, we need to ensure that it can be connected to. I download the Connector for Tomcat (WAS) and modify the environment variables. This section allows both Java and Tomcat to register for the environmental variables. This is done to enable Tomcat and Java to utilize libraries like Connector.

※ Environmental variables in Linux (Ubuntu) /etc/profileI will register it for you, and then... collection You can retrieve information about environment variable settings using commands.

To modify the /etc/profile file in this way: The `export` command is used to define environment variables. We add the paths for Java and Tomcat execution to the existing PATH variable (the `bin` directory is related to execution). Finally, we specify the Tomcat `lib` directory in the `CLASSPATH` variable, as Connector files are downloaded to this directory. This will then... MariaDB ConnectorIt provides a download link.

MySQL :: Download MySQL Connector/J (Archived Versions)

The MariaDB Connector is called "MySQL" because, in essence, it's the same database. I recommend searching for more detailed information.

※ source /etc/profile Once you enter the command, the modified configuration file is immediately applied.

You can copy the link and use the 'wget' command to download the file to any directory. 'sudo apt install binutils' After the package has been installed. 'ar -x mysql-connector-j_8.0.33-1ubuntu20.04_all.deb' If you extract the file and also decompress the "tar xvzf data.tar.xz" archive, you should find a "usr" folder, as shown in the image below.

/usr/local/apache-tomcat-9.0.82/lib/usr/share/java/ mysql-connector-j-8.0.33.jar Located on this path mysql-connector-j-8.0.33.jar Move the file to the /usr/local/apache-tomcat-9.0.82/lib directory, and remove all other files and directories, including debian, control, data, deb, and usr. The following files and directories should be retained:

Using the "source" command, I apply the environment settings and restart the Tomcat server. Then, I access another virtual machine program to install the database server. 'sudo apt install mariadb-server'You can install it. You can also register it as a startup program when the virtual machine boots, using the command 'sudo systemctl enable mariadb'.

After installation, you can access the MariaDB shell as the root account and perform various database operations with administrator privileges.

create database test; #스키마 생성
create user 'test'@'%' identified by '1234'; #새로운 계정 생성
grant all privileges on *.* to test@'%'; #스키마에 대한 계정 권한 부여
flush privileges; #권한 변경 즉시 적용

While I've included comments, it's important to note that understanding the database requires further study. I highly recommend learning the specific commands and how they function. Due to the extensive nature of the content, I'll provide brief explanations in the comments instead of detailed descriptions.

create table member(
    id int,
    name varchar(15),
    password varchar(20)
);

insert into member(id, name, password)
values
(1, '일', 'abcd'),
(2, '이', 'bcde'),
(3, '삼', 'cdef'),
(4, '사', 'defg'),
(5, '오', 'efgh');

And, for the sake of simplicity, let's assume we have this kind of data.

Now, to verify that the data is being transferred correctly, I will check on the Tomcat (WAS) server. /usr/local/apache-tomcat-9.0.82/webapps You can freely rename the existing ROOT directory of this path (e.g., to ROOT.ori) and create a new ROOT directory using the mkdir command. Then, navigate to the ROOT directory and create an index.jsp file.

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" import="java.sql.*" %>
<!DOCTYPE html>
<%
String DB_URL = "jdbc:mysql://10.10.10.10:3306/test";
String DB_USER = "test";
String DB_PASSWORD = "1234";
String sql = "";
Connection conn = null;
PreparedStatement ptmt = null;
ResultSet rs = null;

try {
        Class.forName("com.mysql.jdbc.Driver");
        conn = DriverManager.getConnection(DB_URL, DB_USER, DB_PASSWORD);
        sql = "select * from member where id = 1";
        ptmt = conn.prepareStatement(sql);
        rs = ptmt.executeQuery();
        if (rs.next()){
                out.println("Success "+rs.getString("name")+" "+rs.getString("password"));
        }else {
                out.println("실패");
        }
}catch(Exception e){
        out.println(e);
}finally{
        conn.close();
        ptmt.close();
        rs.close();
}
%>

Because it's important to verify the connection, I've written it this way. Finally, the database server only allows local access via 127.0.0.1, so please go to the file at the path /etc/mysql/mariadb.conf.d/50-server.cnf bind address This replaces the "restricted" portion with "0.0.0.0," which allows access from any IP address.

And when I restart the database server using `sudo systemctl restart mysqld`,

You can observe these changes. Now, when you access the web server address while all servers are running,

Not only is the connection to the WAS server established successfully, but I can also retrieve data from the database server!

Ⅲ. Hping3

The purpose is to send a large number of packets to overwhelm the server and cause it to crash. DDoS attackI would like to try it out briefly. First, 'sudo apt install hping3'We will install it for you. Once it's installed, 'sudo hping3 --icmp 10.10.10.7 (IP address of the web server with a 3-tier architecture) --rand-source --flood'I will execute the command.

So, when a packet is sent, it won't be recorded in any special log files because it doesn't require any specific logging. tcpdump To save the packet information as a file, you need to use a command to create a file. By running the command "tcpdump -w test.pcap" on the web server, you can save the packet logs to a file.

Because the program continues to write even after you enter the command, you need to manually stop the writing process. WinSCP Please send the "test.pcap" file to your operating system using the program. Wireshark When viewed as a program,

You will see a vast number of ping attack records. Think of this as a purely ineffective DDoS simulation.

※ tcpdump: specifying a port number: There is also an option for the `tcpdump` command that allows you to save only packets entering through a specific port.

Ⅳ. John

Named after the infamous serial killer, "Jack the Ripper," from England. John the RipperThere is a tool called "Crack Tool" that was developed to crack the passwords of Unix operating systems. It was designed to quickly identify and bypass simple passwords. Various encryption algorithmsThis is included. There is a separate file containing a list of passwords for this type of crack.

john --wordlist=경로 및 파일명

This command can be used to access and utilize information that is already available online. List of weak passwordsYou can download this file and use it to make the John Crack program run. To start using it properly, 'sudo apt install john'Install it. Try it out. 'sudo adduser test1 (username)' Create a new Linux account using a command (with a simple password: 'piglet'). Then, verify that the new account was created correctly by checking the /etc/passwd file.

Create a directory named "john" within any existing directory. Since the original "passwd" file contains hashed passwords, it's necessary to "unshadow" the "/etc/shadow" file, which stores the hashed passwords, and replace the "x" portion with the actual hashed password. This process should be performed within the newly created "john" directory. 'sudo unshadow /etc/passwd /etc/shadow' > ./passwdExecute the command to save the converted Linux account password file. Once saved, open the saved `passwd` file to view its contents.

This is how the system is configured. To begin the cracking process (which involves randomly trying different passwords to find the account's password), "John's password file"The process should be executed as described. Because it can take a long time to find the password, we will only attempt to find the password for the test1 account that we have created. 'john --user=test1 ./passwd' When you enter a command, the system will automatically search and then display the results found.

※ /etc/sudoers There is a file that, if edited, could grant a standard account root (administrator) privileges. However, modifying this file is risky, and a warning message will appear. You can ignore this warning.

After making these changes and saving, you can log in again and use administrator privileges. Also, /etc/ssh/sshd_config The file exists, and this file pertains to the root account when accessing via the SSH protocol. Settings to restrict or allow logins on an SSH server.This allows for direct login with root privileges, or the ability to prevent it. When a file is opened, it appears as follows:

Simply modify the `PermitRootLogin` attribute with the desired setting.

※ Injection This technique involves exploiting vulnerabilities in code to attack it with malicious code. A simple example is SQL injection, where a website queries a database for user information during login.

select * from member where id = '' and pw = ''

Okay, let's assume that's the case. At this point, you should change your password.

aaa' or 'x' = 'x

If the input is "로", then the SQL query is:

select * from member where id = 'abc' and pw = 'aaa' or 'x' = 'x'

...and it will function accordingly. "or"If either of these conditions is met, the login will be compromised. This is a basic form of SQL injection, and there are various injection attacks that can occur. For example, when modifying an account, it's possible to change permissions or insert JavaScript code to prevent login.

Review

I think I've finally finalized most of the important aspects related to this week's lesson. There's still the Docker section from last Friday, but I think I need to study it further before I can present it, so I'll post it when the time comes. I plan to either post everything at once, or post it when I've had a chance to study it more thoroughly. 🖐️