SQL Injection Attacks and Defense - 2009

Exploiting the Operating System • Chapter 6 273
Tools & Traps…
The Need for Elevated Privileges
In Chapter 4, we discussed the methods that a person can employ to elevate his
privileges through SQL injection attacks. Many of the attacks that are aimed at
compromising the underlying operating system require that the SQL user be running
with elevated privileges. Such elevation was not necessary in the early days, when the
principle of least privilege was less understood and when every application connected
to the back-end database with full db-sysadmin privileges. For this reason, most automated
SQL injection toolkits provide the ability to identify the current user’s privilege
level as well as multiple methods for possibly elevating him from a standard database
user to a database super user.
Accessing the File System
Accessing the file system of the host running the database management system (DBMS)
holds several promises for the potential attacker. In some cases, this is a precursor to attacking
the operating system (e.g., finding stored credentials on the machine); in other cases, it could
simply be an attempt to bypass the authorization efforts of the database itself (e.g., MySQL
traditionally stored its database files in ASCII text on the file system, allowing a file-read
attack to read database contents sans the DBMS authorization levels).
Reading Files
The ability to read arbitrary files on the host running the DBMS offers interesting possibilities
for the imaginative attacker. The question of “what files to read?” is an old one that attackers
have been asking for a long time. The answer obviously depends largely on the attacker’s
objectives. In some cases the goal may be theft of documents or binaries from the host,
whereas in other cases the attacker may be hoping to find credentials of some sort to further