Penetration Testing mailing list archives

Re: JET sql help please anyone


From: Bob Wright <wright () isoblock com>
Date: Fri, 07 Dec 2001 22:59:54 -0500


Tom Vandepoel sez:
At 11:03 PM 12/5/2001 +0100, you wrote:
Gary O'leary-Steele wrote:


various other errors occurred during the test such as
Microsoft JET Database Engine error '80040e14'
Invalid SQL statement; expected 'DELETE', 'INSERT', 'PROCEDURE', 'SELECT',
or 'UPDATE'.


Ran into this myself a while ago.

The reason you can't invoke shell() is probably because it's running in sandbox mode, which I think is the default in more recent versions. Tough luck.

See: http://support.microsoft.com/default.aspx?scid=kb;EN-US;q239482

Tom.

I have not tried this myself, but MS has a utility named JetComp.exe which is a free
download.  As the name implies, it's primary use is to compress Jet db files.
however, it will also repair corrupted Jet db files and will even open such where they
are so hosed as to be inaccessible from ODBC or Access.   If I remember right,
the kicker is that it can apparently be used to repair password protected files, but in doing so removes the password protection.... And, in order to do any of this it obviously must have some intimate access (no pun intended) to the database itself,
and it looks like it pulls the db over to poke at it.
hth


----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/


Current thread: