Data communication gateway forwarding data acquisition method based on command injection

Abstract

The invention relates to the technical field of network security, in particular to a data communication gateway forwarding data acquisition method based on command injection. Firstly, a target device architecture is determined, and a corresponding compiling tool chain is configured; determining a binary program of the target device for data forwarding; developing and compiling a shared library A suitable for the target equipment architecture, and writing the transmitted parameters and a command injected into the shared library A into a command file B; writing the command file B and the shared library A into equipment through command injection; injecting an execution command file B through a command; and finally, locally configuring a UDP receiving end, and receiving the obtained equipment forwarding data. According to the method, the potential security vulnerabilities of the data communication gateway in the industrial control system can be discovered, the development of a network security defense technology is promoted, and the detection and defense capabilities on a novel attack technique are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method for acquiring data forwarding by a data communication gateway based on command injection. Background Art

[0002] With the rapid development of industrial control systems (ICS) and automation technology, data communication gateways play a vital role in the field of industrial control. These gateways are not only responsible for forwarding data between different networks and protocols, but also ensure the stability and reliability of the system. However, the problem of data leakage in data communication gateways is becoming increasingly serious. Attackers use various means to steal data forwarded by devices, which may cause significant damage to the information systems of enterprises and government agencies. Data leakage not only threatens the integrity of the system, but may also lead to the loss of trade secrets and sensitive information, affecting the normal operation and security of enterprises.

[0003] Data communication gateways play a vital role in network architecture. Their main function is to achieve data conversion and forwarding between different network protocols. As they process a large amount of sensitive data, the security and reliability of data communication gateways are crucial to the security of the entire network environment. However, with the continuous development of network attack technology, data communication gateways are facing more and more security challenges.

[0004] In the field of security detection of data communication gateways, current research focuses on the following methods. The first is vulnerability scanning, which relies on a database of known vulnerabilities to discover security flaws in the system. Secondly, traffic analysis technology identifies abnormal data transmission behavior by monitoring the network traffic patterns of data communication gateways. Behavioral analysis methods focus on observing the operational behavior of the gateway to detect whether there are abnormal data processing or forwarding activities. Protocol analysis technology checks whether the gateway follows the predetermined protocol specifications to identify potential protocol anomalies. Rule-based detection identifies known attack patterns through a set of rules, while machine learning and artificial intelligence technologies automatically identify new threats by analyzing data patterns, especially in processing large amounts of data and identifying unknown attacks.

[0005] Data theft attacks are a major problem in the current network security field. Attackers use various means to obtain unauthorized data, which poses a serious threat to the security of network systems. Existing technologies and protective measures have some shortcomings in dealing with these attacks:

[0006] Limitations of vulnerability discovery: Existing vulnerability scanning and security detection tools have limitations in identifying potential security vulnerabilities in data communication gateways. These tools may not cover all potential attack vectors and system vulnerabilities, resulting in some security risks not being discovered and fixed in a timely manner.

[0007] Inadequate protection mechanisms: Although data communication gateways are usually equipped with multi-layered security protection mechanisms, such as access control and data encryption, these measures are often unable to effectively respond to complex attack techniques.

[0008] Lag of attack and defense technology: Current defense technology often lags behind the development of attack technology and lacks real-time and effective protection measures. Existing defense mechanisms may not be updated and adapted in time when facing new attack methods, thus reducing the effectiveness of defense.

[0009] By studying the data acquisition method of data communication gateways without authorization, we can reveal the potential data leakage vulnerabilities of data communication gateways in industrial control systems and promote the identification and repair of these vulnerabilities. This method can not only test and verify the effectiveness of existing protection measures, but also promote technological progress in the field of network security and promote the improvement and improvement of defense technology. Therefore, by deeply studying the data theft technology in data communication gateways, we can provide important insights for network security defense, help improve existing security protection strategies, and promote the overall security of equipment and systems. Summary of the invention

[0010] In order to solve the above-mentioned problems existing in the prior art, the present invention aims to provide a method for obtaining data forwarding data of a data communication gateway based on command injection, so as to discover potential security vulnerabilities of the data communication gateway in the industrial control system, promote the development of network security defense technology, and enhance the detection and defense capabilities against new attack methods.

[0011] Specifically, the method comprises the following steps:

[0012] S1: Determine the target device architecture and configure the corresponding compilation tool chain;

[0013] S2: Determine the binary program used by the target device for data forwarding;

[0014] S3: Develop and compile a shared library A suitable for the target device architecture;

[0015] S4: Write the passed parameters and the commands injected into the shared library A into the command file B;

[0016] S5: Write command file B and shared library A into the device through command injection;

[0017] S6: Execute command file B through command injection;

[0018] S7: Locally configure the UDP receiving end to receive the acquired device forwarding data.

[0019] Furthermore, S3 uses the -shared and -fPIC options to compile shared library A to generate position-independent code and build a dynamic link library. When loading shared library A, it first obtains input parameters through the specified environment variables, then initializes the UDP receiving end socket, and finally obtains the dynamic link and socket data operation function address; specifically:

[0020] S31: Get input parameters through environment variables in __attribute__((constructor));

[0021] S32: Initialize the UDP receiving socket used to receive the data forwarded by the device in __attribute__((constructor));

[0022] S33: Use dlsym and RTLD_NEXT to obtain the data sending function and receiving function addresses of the TCP protocol in the shared library;

[0023] S34: Use dlsym and RTLD_NEXT to obtain the data sending function and receiving function addresses of the UDP protocol in the shared library;

[0024] S35: Customize the data sending function send and receiving function recv of TCP protocol;

[0025] S36: Customize the data sending function sendto and receiving function recvfrom of the UDP protocol;

[0026] Among them, when customizing the socket data operation function, directly use the UDP data sending function in the device shared library to send the device forwarding data to the specified UDP receiving end, and then call the original data forwarding function to allow the data to flow normally.

[0027] Furthermore, S4 includes:

[0028] S41: Set the TARGET environment variable that specifies the UDP receiving end address to pass the input parameter;

[0029] S42: Set the LD_PRELOAD environment variable to enable the target process to load shared library A first;

[0030] The command file B includes: TARGET environment variable, closing the target process, LD_PRELOAD environment variable and restarting the target process.

[0031] Furthermore, S5 includes:

[0032] S51: Start a service locally using Netcat and use the contents of the specified file as standard input stdin;

[0033] S52: On the target device, use Netcat to connect to the specified service of the local device and save the standard output stdout to the specified file;

[0034] The file to be sent is divided into multiple files of 4k in size and sent multiple times. Each file fragment is received on the target device, and the file fragments are sequentially merged into a complete file to overcome the limitation of the file size written to the target device.

[0035] The technical solution provided by the present invention can be used for data communication gateways with command injection vulnerabilities in industrial control equipment. By setting the LD_PRELOAD variable to inject a custom shared library into the target process, it can be unaffected by the anti-debugging mechanism of the target process and run stably in a multi-threaded environment. In addition, this method reduces the obvious traces of process operations and effectively reduces the risk of being detected; the custom shared library directly obtains the required function address from the existing shared library of the device and calls it, and the implementation process is simple, fast, low-cost, low overall overhead, easy to implement and maintain; the input parameters are obtained from the environment variables, which improves the flexibility and adaptability of the method; all commands to be executed and the parameters passed through the environment variables are written into the command file, the file is uploaded to the device through command injection, and the command injection is used again to execute the file, thereby bypassing the length limit and filtering mechanism that may exist in the command injection, and at the same time, the execution efficiency and flexibility are also improved. In other words, the technical solution of the present invention can effectively reveal the security risks in the data communication gateway in the industrial control field, promote the development of network security defense technology for industrial control systems, and thus enhance the overall defense capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of the framework of a data communication gateway forwarding data acquisition method based on command injection provided by the present invention.

[0037] Figure 2 This is an operation flow chart of the custom shared library provided by the present invention when it is loaded.

[0038] Figure 3 This is a flow chart of the operation of the custom function provided by the present invention.

[0039] Figure 4 This is a flow chart of writing files to a target device based on command injection provided by the present invention, where nc refers to Netcat. DETAILED DESCRIPTION

[0040] In order to improve the detection and defense capabilities of new data leakage methods and further enhance the security protection level of industrial control systems, the present invention uses a technical solution based on command injection to demonstrate how to obtain data forwarded by a data communication gateway without authorization, thereby revealing the potential risks of data leakage.

[0041] The technical method of the present invention will be further described below in conjunction with the embodiments and drawings. Figure 1 As shown, the method comprises the following steps:

[0042] S1: Determine the target device architecture and configure the corresponding compilation tool chain;

[0043] S2: Determine the binary program used by the target device for data forwarding;

[0044] S3: Develop and compile a shared library A suitable for the target device architecture;

[0045] Specifically, in this embodiment,

[0046] Compile shared library A using the -shared and -fPIC options to generate position-independent code and build a dynamic link library.

[0047] The specific steps include:

[0048] S31: Get input parameters through environment variables in __attribute__((constructor));

[0049] S32: Initialize the UDP (User Datagram Protocol) receiving end socket for receiving the data forwarded by the device in __attribute__((constructor));

[0050] Among them, __attribute__((constructor)) is an attribute provided by the GCC (GNU Compiler Collection GNU compiler suite) compiler, which can mark a function as a constructor. When a shared library is loaded, all functions marked with __attribute__((constructor)) will automatically run before any other functions in the library are executed.

[0051] S33: Use dlsym and RTLD_NEXT to obtain the addresses of the data sending function send and receiving function recv of the TCP protocol in the shared library;

[0052] S34: Use dlsym and RTLD_NEXT to obtain the data sending function sendto and receiving function recvfrom addresses of the UDP protocol in the shared library;

[0053] Among them, dlsym is a function used for symbol resolution in a shared library, allowing the address of a function or variable to be obtained at runtime. RTLD_NEXT is a specific flag of dlsym, which allows skipping the current library in a chain-loaded library and retrieving the next library that defines the symbol.

[0054] Figure 2 The operation flow chart of the custom shared library (i.e. shared library A) provided by the present invention when loaded is shown. Firstly, the input parameters are obtained through the specified environment variables, then the UDP receiving end socket is initialized, and finally the dynamic link and socket data operation function address are obtained.

[0055] S35: Customize the data sending function send and receiving function recv of TCP protocol;

[0056] S36: Customize the data sending function sendto and receiving function recvfrom of the UDP protocol.

[0057] Among them, the custom socket data operation function (i.e., send function, recv function, sendto function, and recvfrom function) directly uses the UDP data sending function in the device shared library to send the device forwarding data to the specified UDP receiving end, and then calls the normal data forwarding function to allow the data to flow normally.

[0058] Figure 3 The operation flow chart of the custom function provided by the present invention is shown. First, the original socket data operation function is called, and then the sendto function is called to send the device forwarding data to the specified UDP receiving end.

[0059] S4: Write the passed parameters and the commands injected into the shared library A into the command file B;

[0060] Specifically, in this embodiment, the specified environment variable is first set to transfer the input parameter, and then the LD_PRELOAD environment variable is set to allow the target process to load the shared library A preferentially.

[0061] Command file B includes setting the TARGET environment variable for specifying the address of the UDP receiving end, shutting down the target process, configuring the LD_PRELOAD environment variable to allow the target process to preferentially load the shared library A, and restarting the target process.

[0062] S5: Write command file B and shared library A into the device through command injection;

[0063] Specifically, in this embodiment, the following steps are included:

[0064] S51: Start a service locally using Netcat and use the contents of the specified file as standard input (stdin);

[0065] S52: On the target device, use Netcat to connect to the specified service of the local device, and save the standard output (stdout) to the specified file.

[0066] The file to be sent is divided into multiple files of 4k in size and sent multiple times. Each file fragment is received on the target device and sequentially merged into a complete file to overcome the limitation of the file size written to the target device.

[0067] Figure 4 The flowchart of writing a file to a target device based on command injection provided by the present invention is shown.

[0068] S6: Execute command file B through command injection.

[0069] S7: Locally configure the UDP receiving end to receive the acquired device forwarding data.

[0070] In summary, the present invention realizes seamless intervention in the target process by setting the LD_PRELOAD variable to inject a custom shared library, which is not affected by the anti-debugging mechanism and multi-threaded operation of the target process, enhances adaptability, reduces obvious traces of process operations, and reduces the risk of detection. Passing parameters through environment variables improves the concealment and flexibility of executing commands. The custom shared library directly calls the existing functions of the target device, reduces development complexity and system overhead, and can be quickly deployed and maintained. By writing all commands and parameters into a command file, and then uploading and executing the file through command injection, the length and filtering restrictions that may exist in command injection are effectively broken. This technical solution reveals the potential data leakage risks in the data communication gateway of industrial control equipment, and promotes the development of network security defense technology for industrial control systems.

Claims

1. A method for acquiring data forwarding from a data communication gateway based on command injection, characterized in that: The following steps are involved: S1: Determine the target device architecture and configure the corresponding compilation tool chain; S2: Determine the binary program used by the target device for data forwarding; S3: Develop and compile a shared library A suitable for the target device architecture; S4: Write the passed parameters and the commands injected into the shared library A into the command file B; S5: Write command file B and shared library A into the device through command injection; S6: Execute command file B through command injection; S7: Locally configure the UDP receiving end to receive the acquired device forwarding data.

2. The method for acquiring data forwarding from a data communication gateway based on command injection according to claim 1, characterized in that: In S3, the -shared and -fPIC options are used to compile the shared library A to generate position-independent code and build a dynamic link library. When loading the shared library A, the input parameters are first obtained through the specified environment variables, then the UDP receiving end socket is initialized, and finally the dynamic link and socket data operation function addresses are obtained; specifically: S31: Get input parameters through environment variables in __attribute__((constructor)); S32: Initialize the UDP receiving socket used to receive the data forwarded by the device in __attribute__((constructor)); S33: Use dlsym and RTLD_NEXT to obtain the data sending function and receiving function addresses of the TCP protocol in the shared library; S34: Use dlsym and RTLD_NEXT to obtain the data sending function and receiving function addresses of the UDP protocol in the shared library; S35: Customize the data sending function send and receiving function recv of TCP protocol; S36: Customize the data sending function sendto and receiving function recvfrom of the UDP protocol; Among them, when customizing the socket data operation function, directly use the UDP data sending function in the device shared library to send the device forwarding data to the specified UDP receiving end, and then call the original data forwarding function to allow the data to flow normally.

3. The method for acquiring data forwarding from a data communication gateway based on command injection according to claim 1, characterized in that: S4 includes: S41: Set the TARGET environment variable that specifies the UDP receiving end address to pass the input parameter; S42: Set the LD_PRELOAD environment variable to enable the target process to load shared library A first; The command file B includes: TARGET environment variable, closing the target process, LD_PRELOAD environment variable and restarting the target process.

4. The data communication gateway forwarding data acquisition method based on command injection according to claim 1 is characterized in that S5 include: S51: Start a service locally using Netcat and use the contents of the specified file as standard input stdin; S52: On the target device, use Netcat to connect to the specified service of the local device and save the standard output stdout to the specified file; The file to be sent is divided into multiple files of 4k in size and sent multiple times. Each file fragment is received on the target device, and the file fragments are sequentially merged into a complete file.

Images