SQL Injection Attacks and Defense - 2009

[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows 2000
Server" /fastdetect
[haroon@hydra squeeza]$ md5sum stolen-net.exe
8f9f01a95318fc4d5a40d4a6534fa76b stolen-net.exe
Exploiting the Operating System • Chapter 6 285
(You can compare the MD5 values to prove that the file transfer worked perfectly, albeit
painfully slowly depending on the !channel you chose.)
In the absence of the bulk insert method, an attacker can accomplish file manipulation
on SQL Server through the use of OLE Automation, a technique discussed in Chris Anley’s
paper, “Advanced SQL Injection.” In Anley’s example, he first used the wscript.shell object
to launch an instance of Notepad on the remote server:
-- wscript.shell example (Chris Anley – chris@ngssoftware.com)
declare @o int
exec sp_oacreate 'wscript.shell', @o out
exec sp_oamethod @o, 'run', NULL, 'notepad.exe'
Of course, this opens the opportunity for an attacker to use any ActiveX control, which
creates a wealth of attacking opportunities. The file system object provides an attacker with
a relatively simple method to read files in the absence of bulk insert. Figure 6.11 shows the
(ab)use of the Scripting.FileSystemObject within SQL Query Analyzer.
Figure 6.11 Browsing the File System Using scripting.filesystemobject