Hacking SQL Server The best defense is a good offence by Dustin Prescott @nujakcities Created: Modified: 11/24/2012

Learning Content on Security Street User groups RSS Exploit-DB updates Cisco, SQL, Virtualization Conferences GrrCON, SQL Saturday Hands-On Capture the Flag Forensics RSS Exploit-DB updates SecurityFocus Vuln.. Content on Security Street Twitter @markrussinovich @Wh1t3Rabbit @EggDropX @msftsecurity

Initial Attack Vectors Network communication vital Proxies Whitelist inbound, Blacklist outbout Corporate/Windows Firewalls

Authentication vs. Authorization Try to steal credentials of highly privileged users such as Application IDs, DBA Accounts or Domain Admins. Onion. Problem: Hackers don’t care about Authorization

Tools BackTrack (bt) Zenmap Metasploit framework Bootable, vm, phone Zenmap Metasploit framework 927+ exploits 251+ payloads Meterpreter Social Engineering Toolkit Netdiscover Fasttrack & autopwn

Tools (NEW HOTNESS) Kali Linux Metasploit framework Bootable, vm, phone Metasploit framework 927+ exploits 251+ payloads Meterpreter Social Engineering Toolkit Netdiscover BBQSQL (sql injection) AND MORE!

Meterpreter Payload Interesting Commands Getuid GetSystem Ps kill Migrate Shell Hashdump Webcam_snap clearev

Demo – Information Gathering & Exploit

Patches and Misconfigurations If you are not patching, no reason for pen testing Don’t forget 3rd party utilities Peer review servers cleanup

Misconfigurations Blank or weak ‘sa’ password Default 3rd party passwords Accidental administrators(Dev) Over privileged services(System) Extra un-used services(Writer) Extra un-used protocols (SQL Auth)

Patches Reversing patches is common practice Midi file buffer overflow exploited in wild 16 days after the patch Common msf exploits used MSYY- naming convention CVE – common vulnerabilities and exposures Know unsupported dates

Layers Layers that still work DR Firewalls Strong Passwords Antivirus Patches Group Policy Log Monitoring Least privilege Audits and Testing DR Did someone say zombies?

Roadblock Don’t be a disabler for business. Dan Lohrmann

Openwall & pastebin

PaSsW0rD

PaSsW0rD

PaSsW0rD

PaSsW0rD

Back to Demo Post Carnage Analysis

Q&A Other hacks? Review whiteboarding ‘ OR 1=1; -- Create table, insert web.config Browser based attacks The next MS08_067 Review whiteboarding

Review