RE: custom xp_cmdshell on SQL Server






From: "Victor Chapela" <victor@xxxxxxxxx>
To: "'Andy Lester'" <pentest1269@xxxxxxxxxxx>, >
1) The problem with CREATE PROCEDURE is that it has to be the first
statement in a batch query. Within a sql injection you are always, at least,
the second statement after the one you injected into.

Correct. But since I am injecting 'CREATE PROCEDURE' inside an OPENROWSET statement, that should solve the issue, as the SQL code inside the OPENROWSET is executed as a batch in itself (correct me if I am wrong)

2) Sometimes xp_cmdshell seems not to be working (especially if you are
doing it through openrowset which ends up being blind). You may have SQL
Server running with an unprivileged user. Did you try a ping to localhost
and check for the 4 sec delay? That almost always works.

I am running my code as an unprivileged user, but I escalated to 'sa' using OPENROWSET

3) Even if you do get execution by restoring xp_cmdshell, injecting through
openrowset has severe complications when trying complex queries. The best
way I have found to overcome these limitations is by temporarily increasing
privileges of the user you are going through.

' and 1=(select * from
openrowset('SQLOLEDB','DRIVER={SQLServer};SERVER=<server>;UID=sa;PWD=<passwo
rd>',N'select user; declare @u varchar(50); set @u = (select system_user);
exec master.dbo.sp_addsrvrolemember @u, ''sysadmin'''))--

Nice trick !... I will give this a try :)

Thanks

Andy

_________________________________________________________________
Don't just search. Find. Check out the new MSN Search! http://search.msn.com/


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------



Relevant Pages

  • Official release of SQL Power Injector 1.2
    ... One of the major improvements is an innovative way to optimize and accelerate the dichotomy in the Blind SQL injection, saving time/number of requests up to 25%. ... Also another great time saver is a new Firefox plugin that will launch SQL Power Injector with all the information of the current webpage with its session context. ... No more time wasted to copy paste the session cookies after you logged... ...
    (Security-Basics)
  • Official release of SQL Power Injector 1.2
    ... One of the major improvements is an innovative way to optimize and accelerate the dichotomy in the Blind SQL injection, saving time/number of requests up to 25%. ... Also another great time saver is a new Firefox plugin that will launch SQL Power Injector with all the information of the current webpage with its session context. ... No more time wasted to copy paste the session cookies after you logged... ...
    (Bugtraq)
  • Official release of SQL Power Injector 1.2
    ... One of the major improvements is an innovative way to optimize and accelerate the dichotomy in the Blind SQL injection, saving time/number of requests up to 25%. ... Also another great time saver is a new Firefox plugin that will launch SQL Power Injector with all the information of the current webpage with its session context. ... No more time wasted to copy paste the session cookies after you logged... ...
    (Pen-Test)
  • [Full-disclosure] OTRS 1.x/2.x Multiple Security Issues
    ... OTRS, the Open Source Ticket Request System, is a trouble ... ranging from cross site scripting to SQL injection. ... A malicious user may be able to conduct blind SQL code ... an attacker may be able to exploit this issue. ...
    (Full-Disclosure)
  • Official release of SQL Power Injector 1.1
    ... I have the pleasure to announce that a new version of SQL Power Injector is now officially available on my web site: ... For now it is SQL Server, Oracle and MySQL compliant, but it is possible to use it with any existing DBMS when using the inline injection (Normal ... Response of the SQL injection in a customized browser ...
    (Pen-Test)