the-web-application-hackers-handbook

326 Chapter 9 n Attacking Data Stores
Attacking databases is a huge topic that is beyond the scope of this book. This
section points you toward a few key ways in which vulnerabilities and functionality
within the main database types can be leveraged to escalate your attack.
The key conclusion to draw is that every database contains ways to escalate
privileges. Applying current security patches and robust hardening can help
mitigate many of these attacks, but not all of them. For further reading on this
highly fruitful area of current research, we recommend The Database Hacker’s
Handbook (Wiley, 2005).
MS-SQL
Perhaps the most notorious piece of database functionality that an attacker can
misuse is the xp_cmdshell stored procedure, which is built into MS-SQL by
default. This stored procedure allows users with DBA permissions to execute
operating system commands in the same way as the cmd.exe command prompt.
For example:
master..xp_cmdshell ‘ipconfig > foo.txt’
The opportunity for an attacker to misuse this functionality is huge. He can
perform arbitrary commands, pipe the results to local files, and read them back.
He can open out-of-band network connections back to himself and create a
backdoor command and communications channel, copying data from the server
and uploading attack tools. Because MS-SQL runs by default as LocalSystem,
the attacker typically can fully compromise the underlying operating system,
performing arbitrary actions. MS-SQL contains a wealth of other extended
stored procedures, such as xp_regread and xp_regwrite, that can be used to
perform powerful actions within the registry of the Windows operating system.
Dealing with Default Lockdown
Most installations of MS-SQL encountered on the Internet will be MS-SQL 2005
or later. These versions contain numerous security features that lock down the
database by default, preventing many useful attack techniques from working.
However, if the web application’s user account within the database is sufficiently
high-privileged, it is possible to overcome these obstacles simply by
reconfiguring the database. For example, if xp_cmdshell is disabled, it can be
re-enabled with the sp_configure stored procedure. The following four lines
of SQL do this:
EXECUTE sp_configure ‘show advanced options’, 1
RECONFIGURE WITH OVERRIDE
EXECUTE sp_configure ‘xp_cmdshell’, ‘1’
RECONFIGURE WITH OVERRIDE