2KKUU7ita

234
Part IV: Hacking Operating Systems
Finding Unneeded and
Unsecured Services
When you know which daemons and applications are running — such as FTP,
telnet, and a web server — it’s nice to know exactly which versions are running
so you can look up their associated vulnerabilities and decide whether
to turn them off. The National Vulnerability Database site (http://nvd.
nist.gov) is a good resource for determining vulnerabilities.
Searches
Several security tools can help determine vulnerabilities. These types of utilities
might not identify all applications down to the exact version number, but
they’re a very powerful way of collecting system information.
Vulnerabilities
Be especially mindful of these known security weaknesses in a system:
✓ Anonymous FTP — especially if it isn’t properly configured — can provide
a way for an attacker to download and access files on your system.
✓ Telnet and FTP are vulnerable to network analyzer captures of the
cleartext user ID and password the applications use. Their logins can
also be brute-force attacked.
✓ Old versions of sendmail have many security issues.
✓ R-services, such as rlogin, rdist, rexecd, rsh, and rcp, are especially vulnerable
to attacks.
Many web servers run on Linux, so you can’t overlook the importance of
checking for weaknesses in Apache, Tomcat, and your specific applications.
For example, a common Linux vulnerability is that usernames can be determined
via Apache when it doesn’t have the UserDir directive disabled in
its httpd.conf file. You can exploit this weakness manually by browsing
to well-known user folders, such as http://www.your~site.com/user_
name or, better yet, by using a vulnerability scanner, such as WebInspect or
QualysGuard, to automatically enumerate the system. Either way, you may
be able to find out which Linux users exist and then launch a web passwordcracking
attack. There are also numerous ways to access system files (including
/etc/passwd) via vulnerable CGI code. I cover hacking web applications
in Chapter 14.
Likewise, FTP is often running unsecured on Linux systems. I’ve found Linux
systems with anonymous FTP enabled that were sharing sensitive healthcare
and financial information to everyone on the local network. Talk about a lack