SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 201
The profile_name indicates the profile to use to send the e-mail; if it’s left blank the default
public profile for the msdb database will be used. If a profile does not exist, you can create
one using the following procedure:
1. Create a Database Mail account using msdb..sysmail_add_account_sp. You will need
to know a valid SMTP server that the remote database can contact and through
which the e-mail can be sent. This SMTP server can be some server on the
Internet, or one that is under the control of the attacker. However, if the database
server can contact an arbitrary IP address on port 25, there are much faster ways
to extract the data (e.g., using OPENROWSET on port 25, as I will show you in
a following section) than using e-mail. Therefore, if you need to use this technique
it’s very likely that the database server cannot access external hosts, and so you will
need to know the IP address of a valid SMTP server that resides on the target
network. This may not be as hard as it sounds: If the Web application has some
functionality that sends e-mail messages (e.g., with the results of some action of
the user, or an e-mail to reset a user’s password), it’s very likely that an SMTP server
will appear in the e-mail headers. Alternatively, sending an e-mail to a non-existent
recipient might trigger a response that contains the same information. However,
this might not be enough if the SMTP server is authenticated: If this is the case,
you will need a valid username and password to successfully create the Database
Mail account.
2. Create a Database Mail profile, using msdb..sysmail_add_profile_sp.
3. Add the account that you created in step 1 to the profile that you created in
step 2, using msdb..sysmail_add_profileaccount_sp.
4. Grant access to the profile that you created to the users in the msdb database, using
msdb..sysmail_add_principalprofile_sp.
The process, complete with examples, is described in detail at http://msdn.microsoft.
com/en-us/library/ms187605(SQL.90).aspx. If everything works and you have a valid
Database Mail account, you can finally run queries and have their results sent in an e-mail.
Here is an example of the whole process:
--Enable Database Mail
EXEC sp_configure 'show advanced', 1;
RECONFIGURE;
EXEC sp_configure 'Database Mail XPs', 1;
RECONFIGURE
--Create a new account, MYACC. The SMTP server is provided in this call.