2KKUU7ita

308
Part V: Hacking Applications
(continued)
Finally, it was time to attempt one last act of
database dastardliness. First, Mr. Andrews
loaded the tool called Cain & Abel and set it to
enter sniffing mode. Then, using Paros Proxy
and the already identified vulnerable parameter,
he used the xp_dirtree extended stored
procedure, which is available to all SQL Server
database users, to attempt to show a directory
on his Internet-connected machine using a
Universal Naming Convention (UNC) path. This
forced the target database to actually attempt
to authenticate itself against Mr. Andrews’s
machine. Because Cain & Abel was listening on
the wire, it obtained the hash of the challenge
used to authenticate the exposed file share. By
passing this hash to the password cracker built
in to Cain & Abel, Mr. Andrews would have the
username and password of the account under
which the vulnerable SQL Server was running
in just a matter of time (assuming it wasn’t a
local system account).
SQLPing3 can discover instances of SQL Server hidden behind personal firewalls
and more — a feature formerly only available in SQLPing2’s sister application
SQLRecon.
If you have Oracle in your environment, Pete Finnigan has a great list of
Oracle-centric security tools at www.petefinnigan.com/tools.htm that
can perform functions similar to SQLPing3.
Cracking database passwords
Would this hacked account use the same password
as the admin account of the web application?
Would this password be the same as
the local administrator account on the host?
Those were questions for another day. It was
time to assemble all the collected data, prepare
a report for the client, and put the tools away for
another day.
Chip Andrews is a co-founder of security
consulting firm Special Ops Security, Inc.
and owner of SQLSecurity.com (www.sql
security.com), which has multiple
resources about Microsoft SQL Server security,
including the SQLPing3 tool. A co-author for
several books on SQL Server security (Hacking
Exposed: Windows Server 2003 and SQL
Server Security, both published by McGraw-
Hill Osborne) and a Black Hat presenter, Mr.
Andrews has been promoting SQL Server and
application security since 1999.
SQLPing3 also serves as a nice dictionary-based SQL Server password-
cracking program. As you can see in Figure 15-1, it checks for blank sa
passwords by default. Another free tool for cracking SQL Server, MySQL,
and Oracle password hashes is Cain & Abel, shown in Figure 15-2.
The commercial product Elcomsoft Distributed Password Recovery (www.
elcomsoft.com/edpr.html) can also crack Oracle password hashes.