SQL Injection Attacks and Defense - 2009

310 Chapter 6 • Exploiting the Operating System
CREATE OR REPLACE FORCE VIEW "SYS"."ALL_USERS"
("USERNAME", "USER_ID", "CREATED") AS
select u.name, u.user#, u.ctime
from sys.user$ u, sys.ts$ dts, sys.ts$ tts
where u.datats# = dts.ts#
and u.tempts# = tts.ts#
and u.type# = 1
You can find further information concerning Oracle rootkits at the following Web sites:
■■
■■
www.red-database-security.com/wp/db_rootkits_us.pdf
www.databasesecurity.com/oracle-backdoors.ppt
In 2008, two additional contributing authors of this book, Marco Slaviero and Haroon
Meer, showed that newer versions of SQL Server now have the native ability to expose
Simple Object Access Protocol (SOAP)-based Web services through http.sys, the same kernel
component that manages Internet Information Server (IIS). This means that an attacker who
has obtained the necessary privileges can create an HTTP listener that is bound to an SQL
stored procedure. The collection of images in Figure 6.23 walks through the attack. Starting
from the left, we note that /test returns a page on the Web server. The query manager
windows to the right create the ENDPOINT3 endpoint on path /test. The next two frames
show that the /test page has now been “virtually overwritten.”
Figure 6.23 Creating SOAP Endpoints within SQL Server