SQL Injection Attacks and Defense - 2009

Blind SQL Injection Exploitation • Chapter 5 255
The challenge of extracting all data (regardless of length or type) through DNS is
tricky and solvable on an SQL Server database mainly due to T-SQL, which provides loops,
conditional branching, local variables, and so on. Even though Oracle has explicit DNS
functions, its more serious limitations from an attacker’s point of view (lack of PL/SQL injection
in SQL) prevent the exploitation seen on SQL Server.
Tools & Traps…
Zoning Out
In the examples covered here, we’ve assumed that the attacker controls the zone
attacker.com and has full access to the authoritative server for that zone. However,
when using DNS as an exfiltration channel on a regular basis for assessments or other
work, using your zone’s authoritative DNS server as the staging ground for the attack
seems brash. Apart from the fact that this requires granting all colleagues unfettered
access to the server, it is also not flexible. We advocate creating at least one subdomain
that has an NS record pointing to the machine which you grant full access to all
colleagues. You could even create a subdomain per colleague with the NS pointing to
a machine controlled by that colleague. Here is a quick run-through on how you can
add a subdomain to the zone attacker.com in BIND. In the zone file for the domain
attacker.com add the following lines:
dnssucker.attacker.com. NS listen.attacker.com.
listen.attaker.com. A 192.168.1.1
The first line contains the NS record and the second provides a glue record. On the
machine listen.attacker.com, a DNS server is installed that is authoritative for the
domain dnssucker.attacker.com.
Subsequent DNS exfiltration will use .dnssucker.attacker.com as a suffix.
E-mail Exfiltration
Both SQL Server and Oracle support sending e-mails from within the database, and e-mail
presents an intriguing exfiltration channel. Quite similarly to DNS, e-mails sent using Simple
Mail Transfer Protocol (SMTP) do not require a direct connection between the sender and
recipient. Rather, an intermediate network of mail transfer agents (MTAs), essentially e-mail
servers, carries the e-mail on the sender’s behalf. The only requirement is that there exists a
route from the sender to the receiver and this indirect approach is a useful channel for blind