SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 205
Figure 4.16 Using the Server’s
File System to Obtain the Password Hash of User sa
If you need to repeat the process several times, you can make things easier by encapsulating
the code in a stored procedure that can be called at will.
This technique works quite well for extracting small amounts of information, but what
about extracting whole tables? The best option in that case is to rely on bcp.exe, a commandline
utility shipped by default with SQL Server. As stated on MSDN, “The bcp utility bulk
copies data between an instance of Microsoft SQL Server and a data file in a user-specified
format” (see http://msdn.microsoft.com/en-us/library/ms162802.aspx). Bcp.exe is a powerful
utility which accepts a large number of parameters. In our case, however, we are interested in
only a few of them, so here’s an example that retrieves the entire sql_logins table:
EXEC xp_cmdshell 'bcp "select * from sys.sql_logins" queryout
c:\inetpub\wwwroot\hashes.txt -T -c'