SQL Injection Attacks and Defense - 2009

Exploiting the Operating System • Chapter 6 297
One of the limitations of using this method is that debug.exe can only build executables
smaller than 64KB in size. This does not prove to be a huge hindrance when you ponder
that a fully working bind shell can be squeezed into fewer than 200 bytes. However, if you
really need to use this technique to upload a larger file, you can split it into chunks, each
one 64KB bytes long, separately upload them, and “glue” them together with the DOS copy
command:
copy /b chunk-1.exe_ + chunk-2.exe_ + … + chunk-n.exe original-file.exe
If you were building the executable using debug, you would probably have combined it
with the copy command anyway, since debug.exe is built to build .com files. Most automated
tools simply rename the created .com file to .exe after it has been built.
Notes from the Underground…
SQL Injection Worms
In 2008, at the Black Hat Conference in Las Vegas, this book’s lead author, Justin Clarke,
demonstrated a proof-of-concept SQL injection worm that utilized many of the
techniques listed in this chapter. In addition, it utilized a simple scanning engine to
detect and exploit Web sites with a Microsoft SQL Server back end running in an insecure
configuration (i.e., no privilege escalation was necessary to execute xp_cmdshell).
The worm utilized the debug.exe uploading technique described earlier to
upload a copy of itself to the DBMS, and to then execute the remote instance (using
xp_cmdshell) of the worm to continue to spread.
Although this was a proof of concept, it is entirely possible for a vulnerability
such as SQL injection to be used in this way as part of a hybrid attack by utilizing SQL
injection and the techniques outlined in this chapter—say, for example, to install
server operating system-level malware.
You can find more details on the worm at www.gdssecurity.com/l/b/2008/08/21/
overview-of-sql-injection-worms-for-fun-and-profit/.
A few tools allow you to upload executable files using debug.exe. If you use Windows,
you can try the Automagic SQL Injector from Sec-1 Ltd. (www.sec-1.com). It includes a
helper script to first convert a binary to its .scr equivalent, and then to facilitate the remote
creation of the .scr file through echo commands. Automagic also includes a courtesy reverse
User Datagram Protocol (UDP) shell and a port scanner (fscan.exe).