problems to execute sql-commands with osql.exe

From: otaner@gmx.ch
Date: 12/12/01 

Date: Wed, 12 Dec 2001 10:54:09 +0100 (MET)
From: otaner@gmx.ch
To: pen-test@securityfocus.com

Hi,

I'm playing around with our test ms-sql server. The sa account has no
password. So I tried to execute a command with osql.exe...

c:\osql.exe -S target -U sa -P "" -d master -Q "xp_cmdshell 'dir c:\'"
Client unable to establish connection
[Named Pipes]ConnectionOpen (CreateFile()).

That's the result. But when I fire up CIS (Cerberus Internet Scanner by
D.Litchfield) with ms-sql checks activated, I can see nice results and when I try
to execute my command with osql.exe again, then it works!

How can I establish a connection only with osql.exe? Hand-shake problem? CIS
is a nice tool, but it's GUI based. If I do a pen test and I can compromise
a system in the DMZ, I need a command line tool like osql.exe.

any help would be appreciated
Renato 

-- 
GMX - Die Kommunikationsplattform im Internet.
http://www.gmx.net

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • [Full-Disclosure] Advanced usage of system() function.
    ... and call its arguments as a command for shell. ... as we can see we still didnt get what we want (typing exit ... Connection closed by foreign host. ... think what we want to execute. ...
    (Full-Disclosure)
  • Advanced usage of system() function.
    ... and call its arguments as a command for shell. ... as we can see we still didnt get what we want (typing exit we are ... Connection closed by foreign host. ... think what we want to execute. ...
    (Bugtraq)
  • Re: Wait for background processes to complete
    ... To be able to execute commands in the background and wait for their ... The documentation I am referring to is http://perldoc.perl.org/. ... You can run a command in the background with: ... There is a general problem with perl documentation: ...
    (comp.lang.perl.misc)
  • Execute Process Task not failing, but not executing the batch comm
    ... I can execute the following command from the windows "Run" prompt and it ... Might I have something set weird in SQL Server? ... server being by default configured to run as localsystem account, ...
    (microsoft.public.sqlserver.dts)
  • Re: IIS 6.0 on Windows Server 2003
    ... If PHP insists on using CMD.EXE to execute the shellcommand on the ... server, then no, you have no choice -- you must give read permissions to the ... this would be a security vulnerability caused by PHP. ...
    (microsoft.public.inetserver.misc)