Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 28, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 847
Members: 0
Total: 847
PacketStorm News
·301 Moved Permanently

read more...
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Sql injection -> xp_cmdshell
Post new topic  Reply to topic View previous topic :: View next topic 
xp_cmdshell
PostPosted: Sat Apr 30, 2005 1:41 pm Reply with quote
xt33nx
Regular user
Regular user
 
Joined: May 30, 2004
Posts: 7




I read everything, i tried everything... nothing works
the url goes like this: "newspop.asp?arrID=" <- This is the sql injection part

As i said before, i tried everything i know and read, yet i can't execute one single command like "dir"

Any kind of advise is highly appreciated

_________________
Where will you be, the day after tomorrow?
View user's profile Send private message
PostPosted: Sat Apr 30, 2005 3:40 pm Reply with quote
gulftech
Valuable expert
Valuable expert
 
Joined: Apr 20, 2005
Posts: 9




Well, if you really want help you should give us more details. Also, some servers will disable the type of functionality you are trying to use Smile
View user's profile Send private message Visit poster's website
PostPosted: Sat Apr 30, 2005 4:42 pm Reply with quote
gulftech
Valuable expert
Valuable expert
 
Joined: Apr 20, 2005
Posts: 9




Also, this is a great read for anyone wanting to lock down thier newly installed MSSQL Server Wink

http://www.securitymap.net/sdm/docs/windows/mssql-checklist.html
View user's profile Send private message Visit poster's website
PostPosted: Sun May 01, 2005 7:01 am Reply with quote
xt33nx
Regular user
Regular user
 
Joined: May 30, 2004
Posts: 7




More details? Like...?

It runs on Windows Server 2003 with Microsoft-IIS/6.0, i don't remember the MSSQL version but it will probably be new

_________________
Where will you be, the day after tomorrow?
View user's profile Send private message
PostPosted: Sun May 01, 2005 11:09 pm Reply with quote
d3vilbox
Beginner
Beginner
 
Joined: May 02, 2005
Posts: 3




hey guyz
I`m new 2 ur site Wink

K , dear friend as u know Stored Procedures of mssql - 2000 returns value just in INT type , which usually shows proper execution of S.P.

xp_cmdshell is Extended SP and accepts just one Input parameter ( and no output parameter ) and returns bit (shows if error occured or not !)

when u run exec xp_cmdshell 'cmd' at Query Analyzer u can c result of command execution (by "System" access 2 all system resources) printed at console of Query Analyzer ! but by ADO (ADO.Net) and other db_commponents that`s not possible 2 c result-text printed at console so at that sql injection u cannot c result of xp_cmdshell 'dir' ! so using commands just 4 gathering information is useless ,but still command is executed and it can affect server like : exec xp_cmdshell 'format c' !

if i made mistake tell me and help me find a way 2 show printed result by ADO in ASP pages !

this is a simple scenario 2 help get answer of that question :
Quote:

stored procedure :

create proc test
@input varchar(8000)
as
if @input='show_pwd' print 'password : h4cK3r'
go


test.aspx :

<%@ Import Namespace="System.data.Sqlclient" %>
<script runat=server language=vb>
sub Page_Load
If Not Request.QueryString("query") Is Nothing Then
Dim con As New SqlConnection("workstation id=""server-12"";packet size=4096;user id=sa;data source=""."";persist security info=False;initial catalog=testdb")
With con
.Open()
With .CreateCommand
.CommandText = Request.QueryString("query")
With .ExecuteReader
Response.Write("Result : <br>")
While .Read
Dim i As Integer
For i = 0 To .FieldCount - 1
Response.Write(.GetValue(i).ToString)
Response.Write(" ")
Next
Response.Write("<br>")
End While
.Close()
End With
.Dispose()
End With
.Close()
.Dispose()
End With
End If
End Sub
</script>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<body>
<form id="Form1" method="post" runat="server"></form>
</body>
</HTML>

SQL injection :
test.aspx?query= SQL command 2 Get PWD

Question : AT this scenario , choose select SQL command to make aspx page show pwd (printed at console) by Stored Procedure (exec test 'show_pwd') ????


if anyone got the answer plz post here or mail me @ d3vilbox yahoo dot com
View user's profile Send private message
xp_cmdshell
  www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB © 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.097 Seconds