SQL Injection Attacks and Defense - 2009

184 Chapter 4 • Exploiting SQL Injection
Or maybe your user has only read access to the data, but the aim of your test is to check
whether data can be modified in an unauthorized manner.
In other words, you have to deal with the fact that the user performing the queries is
just a regular user, whose privileges are far lower compared to the DBA’s.
Due to the limitations of regular users, and to fully unleash the potential of several of the
attacks you have seen so far, you will need to obtain access as an administrator. Luckily for
us, in several cases it is possible to obtain these elevated privileges.
SQL Server
One of an attacker’s best friends when the target is Microsoft SQL Server is the
OPENROWSET command. OPENROWSET is used on SQL Server to perform
a one-time connection to a remote OLE DB data source (e.g., another SQL server). A DBA
can use it, for instance, to retrieve data that resides on a remote database, as an alternative
to permanently “linking” the two databases, which is better suited to cases when the data
exchange needs to be performed on a regular basis. A typical way to call OPENROWSET
is as follows:
SELECT * FROM OPENROWSET('SQLOLEDB', 'Network=DBMSSOCN; Address=10.0.2.2;
uid=foo; pwd=password', 'SELECT column1 FROM tableA')
Here we connected to the SQL server at the address 10.0.2.2 as user foo, and we ran the
query select column1 from tableA, whose results will be transferred back and returned by the
outermost query. Note that ‘foo’ is a user of the database at address 10.0.2.2 and not of the
database where OPENROWSET is first executed. Note also that to successfully perform the
query as user ‘foo’ we must successfully authenticate, providing the correct password.
OPENROWSET has a number of applications in SQL injection attacks, and in this case
we can use it to brute-force the password of the sa account. There are three important bits
to remember here:
■■
■■
■■
For the connection to be successful, OPENROWSET must provide credentials
that are valid on the database on which the connection is performed.
OPENROWSET can be used not only to connect to a remote database, but also
to perform a local connection, in which case the query is performed with the
privileges of the user specified in the OPENROWSET call.
On SQL Server 2000, OPENROWSET can be called by all users. On SQL Server
2005, it is disabled by default.
This means that on SQL Server 2000 you can use OPENROWSET to brute-force the
sa password and escalate your privileges. For example, take a look at the following query:
SELECT * FROM OPENROWSET('SQLOLEDB', 'Network=DBMSSOCN;
Address=;uid=sa;pwd=foo', 'select 1')