Re: [PEN-TEST] SQL Server blank account

["M. Burnett" <mburnett () XATO NET>]

You may also be interested in our new tool that is currently in beta called
Squelch.  It simulates a command-line and also allows for registry edits via
sql server.  The final version that will be released later this week will
include a brute-force option.

Anyone interested in a beta preview of this tool can download it here:
http://www.xato.net/downloads/squelch.zip



Mark Burnett
Xato Network Security, Inc.
www.xato.net






----- Original Message -----
From: "Marc Maiffret" <marc () eeye com>
To: <PEN-TEST () SECURITYFOCUS COM>
Sent: Tuesday, August 29, 2000 3:05 AM
Subject: Re: [PEN-TEST] SQL Server blank account


> http://www.ntsecurity.nu/toolbox/sqldict/ <-- neato tool for some sql
brute
> forcing.
>
> and if you luck out then use linsql.c:
http://www.securityfocus.com/templates/archive.pike?list=1&date=2000-08-15&m
> sg=200008150352.UAA09523 () user3 hushmail com
>
> Quote from linsql.c:
> "Note that these commands
> are executed with the privileges of the MSSQL service - usually `NT
> Authority\System'.
> "
> "
>  * A simple command-line client for MS SQL server.
>  * Designed for executing commands on the underlying operating system
rather
> than SQL engine.
>  * That said, it has the ability to perform SQL queries on the server.
>  * Also added file upload system - usually works ;-) if it fails, try
again.
>  * Setup to login as the user 'sa' with no password by default, although
> this can be changed.
> "
>
> Signed,
> Marc Maiffret
> Chief Hacking Officer
> eCompany / eEye
> T.949.349.9062
> F.949.349.9538
> http://eEye.com
>
>
> | -----Original Message-----
> | From: Penetration Testers [mailto:PEN-TEST () SECURITYFOCUS COM]On Behalf
> | Of Seth Georgion
> | Sent: Tuesday, August 29, 2000 5:20 PM
> | To: PEN-TEST () SECURITYFOCUS COM
> | Subject: SQL Server blank account
> |
> |
> | Okay, so here is a question that we've encountered, internally, that
seems
> | to have been made more relevant by the recent Napster related
defacements.
> | Specifically, how is it that a hacker can subvert a system, i.e.
> | deface web
> | pages, change user accounts, on a system with a SQL installation
> | and a known
> | username and password. For example let's say you have a Windows
> | machine with
> | an IIS install and a SQL install, given an attacker with a valid,
> | administrator SQL username and password how would they be able to take
> | control of the server?
> |