SQLViking is a post exploitation tool written in Python focused on leveraging unencrypted connections between database and web servers. It is comprised of two pieces: one passive and one active. The passive piece, dubbed Scout, sits on the wire and silently collects information passed between database servers and clients. The active piece, Pillage, leverages TCP injection to run arbitrary queries against a database without credentials or man in the middling. SQLViking was designed with extensibility in mind allowing the open source community to easily add support for new databases without needing to touch any of the actual logic of the tool itself via Python's abstract base classes. This talk will cover how the tool works from a functional perspective as well as existing and future features. It will also discuss the root issue which allows this tool to work and how to protect yourself against such an attack.

2. Bio
• AppSec analyst for nVisium. Cut my teeth in
the DoD working on a .NET stack. Love
researching and learning all things security
from hardware to crypto to social engineering.

3. What’s a sqlviking?
• Post exploitation tool that leverages plain text
connections between database server and
clients
• Why pwn the database when all the data you
could ever want is flying over the network in
plain text?

4. Inspiration

5. Inspiration

6. Structure
• Python 2.7.x (blame scapy)
• Broken up into two pieces
– Scout: passive
– Pillage: extremely intrusive
• Built with extensibility in mind; adding new
database support is very easy

7. Using SQLViking
• python sqlviking -c <config_file.txt>
• Config file allows you to:
– Specify target databases
– Pre-load queries to run via Pillage
– How to handle data logging
• Menu allows for most of this functionality to
be modified during runtime

8. Config

9. UI

10. Scout

11. Scout
• Pulls traffic off the wire, parses, and stores
– Builds database schema
– Stores captured credentials
– Correlates queries with their results

12. Demo!
• Demo gods be damned, I made a video

13. Pillage

14. Pillage
• Leverages TCP injection to run arbitrary
queries against a database
• Extremely intrusive, will break open
connections
• How this effects web servers and other clients
varies pretty greatly

15. TCP Overview

16. TCP Overview
• Biggest take away:
– Seq/ack numbers are predictable
– No authenticity verification
• What happens if we put a packet on the wire
with valid seq/ack and a spoofed MAC/IP?

17. TCP Injection!

18. Demo!

19. More Pillage Fun
• MySQL authentication protocols
– mysql_native_password: secure!
– mysql_old_password: broke as hell, but still
supported
• Leverage pillage to direct clients to use
mysql_old_password auth protocol
• Login attempt fails but now you have a valid
credential pair

20. MySQL Handshake

21. MySQL Handshake

22. The Fix
• Encrypt everything!
– Traffic can be wrapped in TLS
– Use a cipher that supports PFS (DH key exchange)
– Enable certificate verification for both server and
client
• SSL can be disabled in transit via MiTM pre-MySQL
5.7.x/6.x (BACKRONYM attack)

23. Future Improvements
• Fingerprinting
– Parse all TCP traffic and attempt to identify as
database traffic
• Encryption support
– So you stole some private keys, eh? Looks like
we’re back in business!
• More databases supported!

24. Dir/File Breakdown
• TODO

25. Repo
https://github.com/atticuss/sqlviking