SQL Injection Attacks and Defense - 2009

Figure 6.13 Enabling CLR Integration through an Application
Exploiting the Operating System • Chapter 6 287
This positions us to load any .NET binary from the remote server into the database by
using the CREATE ASSEMBLY function.
We’ll load the .NET assembly c:\temp\test.exe with the following injection string:
sname=';create assembly sqb from 'c:\temp\test.exe' with permission_set =
unsafe--
SQL Server stores the raw binary (as a HEX string) in the sys.assembly_ files table.
As shown in Figure 6.14, you can view this easily within Query Analyzer.
Figure 6.14 Viewing the Attached File within the Database
Viewing this file through our Web page requires that we combine the substring( ) and
master.dbo.fn_varbintohexstr() functions:
sname=' union select NULL,NULL,NULL, master.dbo.fn_varbintohexstr
(substring(content,1,5)) from sys.assembly_files--
Figure 6.15 shows how you can use the union, substring, and fn_varbintohexstr combination
to read binary files through the browser.