Waraxe IT Security Portal
Login or Register
November 13, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 86
Members: 0
Total: 86
Full disclosure
SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879)
Security issue in the TX Text Control .NET Server for ASP.NET.
SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater
Unsafe eval() in TestRail CLI
4 vulnerabilities in ibmsecurity
32 vulnerabilities in IBM Security Verify Access
xlibre Xnest security advisory & bugfix releases
APPLE-SA-10-29-2024-1 Safari 18.1
SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600)
SEC Consult SA-20241023-0 :: Authenticated Remote Code Execution in Multiple Xerox printers (CVE-2024-6333)
APPLE-SA-10-28-2024-8 visionOS 2.1
APPLE-SA-10-28-2024-7 tvOS 18.1
APPLE-SA-10-28-2024-6 watchOS 11.1
APPLE-SA-10-28-2024-5 macOS Ventura 13.7.1
APPLE-SA-10-28-2024-4 macOS Sonoma 14.7.1
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Sql injection -> xp_cmdshell
Post new topicReply to topic View previous topic :: View next topic
xp_cmdshell
PostPosted: Sat Apr 30, 2005 1:41 pm Reply with quote
xt33nx
Regular user
Regular user
Joined: May 30, 2004
Posts: 7




I read everything, i tried everything... nothing works
the url goes like this: "newspop.asp?arrID=" <- This is the sql injection part

As i said before, i tried everything i know and read, yet i can't execute one single command like "dir"

Any kind of advise is highly appreciated

_________________
Where will you be, the day after tomorrow?
View user's profile Send private message
PostPosted: Sat Apr 30, 2005 3:40 pm Reply with quote
gulftech
Valuable expert
Valuable expert
Joined: Apr 20, 2005
Posts: 9




Well, if you really want help you should give us more details. Also, some servers will disable the type of functionality you are trying to use Smile
View user's profile Send private message Visit poster's website
PostPosted: Sat Apr 30, 2005 4:42 pm Reply with quote
gulftech
Valuable expert
Valuable expert
Joined: Apr 20, 2005
Posts: 9




Also, this is a great read for anyone wanting to lock down thier newly installed MSSQL Server Wink

http://www.securitymap.net/sdm/docs/windows/mssql-checklist.html
View user's profile Send private message Visit poster's website
PostPosted: Sun May 01, 2005 7:01 am Reply with quote
xt33nx
Regular user
Regular user
Joined: May 30, 2004
Posts: 7




More details? Like...?

It runs on Windows Server 2003 with Microsoft-IIS/6.0, i don't remember the MSSQL version but it will probably be new

_________________
Where will you be, the day after tomorrow?
View user's profile Send private message
PostPosted: Sun May 01, 2005 11:09 pm Reply with quote
d3vilbox
Beginner
Beginner
Joined: May 02, 2005
Posts: 3




hey guyz
I`m new 2 ur site Wink

K , dear friend as u know Stored Procedures of mssql - 2000 returns value just in INT type , which usually shows proper execution of S.P.

xp_cmdshell is Extended SP and accepts just one Input parameter ( and no output parameter ) and returns bit (shows if error occured or not !)

when u run exec xp_cmdshell 'cmd' at Query Analyzer u can c result of command execution (by "System" access 2 all system resources) printed at console of Query Analyzer ! but by ADO (ADO.Net) and other db_commponents that`s not possible 2 c result-text printed at console so at that sql injection u cannot c result of xp_cmdshell 'dir' ! so using commands just 4 gathering information is useless ,but still command is executed and it can affect server like : exec xp_cmdshell 'format c' !

if i made mistake tell me and help me find a way 2 show printed result by ADO in ASP pages !

this is a simple scenario 2 help get answer of that question :
Quote:

stored procedure :

create proc test
@input varchar(8000)
as
if @input='show_pwd' print 'password : h4cK3r'
go


test.aspx :

<%@ Import Namespace="System.data.Sqlclient" %>
<script runat=server language=vb>
sub Page_Load
If Not Request.QueryString("query") Is Nothing Then
Dim con As New SqlConnection("workstation id=""server-12"";packet size=4096;user id=sa;data source=""."";persist security info=False;initial catalog=testdb")
With con
.Open()
With .CreateCommand
.CommandText = Request.QueryString("query")
With .ExecuteReader
Response.Write("Result : <br>")
While .Read
Dim i As Integer
For i = 0 To .FieldCount - 1
Response.Write(.GetValue(i).ToString)
Response.Write(" ")
Next
Response.Write("<br>")
End While
.Close()
End With
.Dispose()
End With
.Close()
.Dispose()
End With
End If
End Sub
</script>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<body>
<form id="Form1" method="post" runat="server"></form>
</body>
</HTML>

SQL injection :
test.aspx?query= SQL command 2 Get PWD

Question : AT this scenario , choose select SQL command to make aspx page show pwd (printed at console) by Stored Procedure (exec test 'show_pwd') ????


if anyone got the answer plz post here or mail me @ d3vilbox yahoo dot com
View user's profile Send private message
xp_cmdshell
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 1 of 1

Post new topicReply to topic


Powered by phpBB © 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.044 Seconds