Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What methods can be used to bypass a signature which detects "xp_cmdshell"?

share|improve this question
4  
Hi @Bahi - what exactly are you trying to get from this question? It is very sparse on detail. Simple answer is obfuscate the xp_cmdshell string, but what environment, what platform, what are you aiming at? –  Rory Alsop Jul 6 '11 at 13:53
2  
Do you have the signatures at hand which are used? –  Dog eat cat world Jul 6 '11 at 15:16
    
The signature is matching the exact key word "xp_cmdshell" –  Bahi Jul 7 '11 at 14:50

1 Answer 1

If you're trying to get around a trivial filter that simply checks if the query contains the string "xp_cmdshell"...
and you're dealing with MSSQL...
and you know that xp_cmdshell is active...
and you know that the user has permissions to access xp_cmdshell...
and you need to specifically run xp_cmdshell, e.g. to prove an exploit, or validate the severity of the finding...

you have several options:

  1. you can obfuscate the "xp_cmdshell" string, in several ways:
    DECLARE @s varchar
    SET @s = 'xp_' + 'cmdshell'
    EXEC (@s)

    Or, you can generate if from charcodes... etc.
  2. If what you really want to do is get unrestricted access to the OS, there are other ways besides xp_cmdshell - there are the sp_OA*** set of procs (to instantiate COM objects), assembly access procs, etc.
share|improve this answer
    
Getting access to COM and assemblies would still require the proper permissions in any case... –  Steve Jul 6 '11 at 19:54
    
@SteveS correct - but, if the signature is filtering specifically for "xp_cmdshell", COM and assemblies are an easy way to get around that: simply dont call xp_cmdshell... –  AviD Jul 6 '11 at 20:31
    
Guys I am talking about bypassing a WAF/IPS signature!! –  Bahi Jul 7 '11 at 11:27
    
@Bahi okay, so these are good solutions, no? –  AviD Jul 7 '11 at 12:28
    
These options will are blocked as well, you cant use these. –  Bahi Jul 7 '11 at 14:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.