During a pentest engagement, I found a blind SQLi and I can read all tables and data in them. There is just one problem. They are using a static AES key (defined in web.config and I don't have access to it) and all CMS login credentials are encrypted. All critical data are encrypted at cell level, even first name, last name, email, etc,
Although client accepted the finding, they say its not too critical as I couldn't really get access to anything, I couldn't even login to CMS, I couldn't really do "anything" other than reading encrypted BLOBs. I know finding is enough, I just want to be able to prove my point and take it to the next level.
The server is MSSQL 2012 and Win server 2012, web app is written in C# / ASP.NET. I read everything in DB, but the web app's SQL user is low privilege, I only have blind SQLi (time based, slow and no stacked queries, just reading data) and MSSQL port is not open to internet.
Am I missing something here? Can I do more here? Can I get more access than I got? I just want to prove a point and don't like how client downplayed my finding by (rightfully) claiming that my finding didn't really amount to "something". Please advise. I have full sqlmap sql shell here, I even ran custom queries, got stored procedures list, got list of all DBs, all tables, etc but as I said, they wrote some code and using a static (unknown to me) key, everything is encrypted at cell level.