SQL Injection Attacks and Defense - 2009

192 Chapter 4 • Exploiting SQL Injection
Stealing the Password Hashes
We briefly talked about hashing functions earlier in this chapter, when we discussed
a successful attack that recovered the passwords of the application users. In this section,
we’ll talk about hashes again, this time regarding the database users. On all common DBMS
technologies, user passwords are stored using a non-reversible hash (the exact algorithm used
varies depending on the DBMS and version, as you will see shortly) and such hashes are
stored, you guessed it, in a database table. To read the contents of that table you normally
will need to run your queries with administrative privileges, so if your user does not have
such privileges you should probably return to the privilege escalation section.
If you manage to capture the password hashes, various tools can attempt to retrieve the
original passwords that generated the hashes by means of a brute-force attack. This makes
the database password hashes one of the most common targets in any attack: Because users
often reuse the same password for different machines and services, being able to obtain the
passwords of all users is usually enough to ensure a relatively easy and quick expansion in
the target network.
SQL Server
If you are dealing with a Microsoft SQL server, things vary quite a lot depending on the
version you are dealing with. In all cases, you need administrative privileges to access the
hashes, but differences start to surface when you actually try to retrieve them and, more
importantly, when you try to crack them to obtain the original passwords.
On SQL Server 2000, hashes are stored in the sysxlogins table of the master database. You
can retrieve them easily with the following query:
SELECT name,password FROM master.dbo.sysxlogins
Such hashes are generated using pwdencrypt(), an undocumented function that generates a
salted hash, where the salt is a function of the current time. For instance, here is the hash of
the sa password on one of the SQL servers that I use in my tests:
0x0100E21F79764287D299F09FD4B7EC97139C7474CA1893815231E9165D257ACEB815111F2A
E98359F40F84F3CF4C
This hash can be split into the following parts:
■■
■■
■■
■■
0x0100 Header
E21F7976 Salt
4287D299F09FD4B7EC97139C7474CA1893815231 Case-sensitive hash
E9165D257ACEB815111F2AE98359F40F84F3CF4C Case-insensitive hash