An attacker’s location in the application space and/or the network will largely define how they would approach breaking into a SQL Server 2000 machine from a remote location. If their attacks go through SQL Injection via a web server then their ‘cursus incursi’ will be considerably different from those when direct access can be gained to the SQL Server. Consequently, this paper will be split into four main sections. The first section will cover attacks that do not require the attacker to have a user ID and password for the SQL Server, that is, the attacks are unauthenticated. The second section will cover those attacks that do require authentication; to succeed the user must be logged onto the SQL Server. The third section will consider those attacks that can be launched from a compromised server.

Before any job is undertaken, be it grouting the shower or paving a patio, a lot of unnecessary grief can be avoided by getting the right tools before hand and attacking a computer system is no different. As far as compromising a Microsoft SQL Server is concerned the ‘tools of the trade’ are a combination of the SQL Server client tools, such as Query Analyzer, SQLPing and a C compiler. One of the most important tools is a copy of MS SQL Server itself. It’s far better to examine vulnerability and code an exploit for it on a system in the lab, rather than experimenting on the live target system. Whilst SQL Server is generally good at handling exceptions and remains up, there are some areas where an access violation will bring the server down and this generally is not a good thing. Further, for every exception raised and caught an entry is added to the Application Event Log, again something that should be avoided where possible. If the attacker is intent upon breaking into the SQL Server, and it’s fully patched, then they may need to discover their own new vulnerability. Having access to the server software, in this scenario, is an absolute must. A good decompiler such as Datarescue’s IDA Pro will help enormously too, where stress testing turns up nothing and one must turn to reverse engineering.

source: ngssoftware.com
Download pdf Threat Profiling Microsoft SQL Server