SQL Injection Attacks and Defense - 2009

Exploiting the Operating System • Chapter 6 295
paper “HackProofing MySQL,” NGS Software’s Chris Anley documented how to create
a UDF to effectively create a MySQL xp_cmdshell equivalent. Essentially, adding a UDF
(according to the MySQL manual) requires simply that your UDF is compiled as an object
file which is then added and removed from the server using the CREATE FUNCTION
and DROP FUNCTION statements.
Microsoft SQL Server
You can use the aforementioned scripting.filesystem object method of reading files just as
effectively to write files to the file system. Anley’s paper again demonstrates the method
shown in Figure 6.17.
Figure 6.17 Writing to the File System Using sp_oacreate
Although we used this technique for writing binary files too, it is reported that some
code pages may have errors with this technique. In such cases, you can use an object other
than the filesystemobject, such as ADODB.Stream.