Skip to main content

SQLNINJA: A Powerful Sql injection t00l!!

By

SQL NINJA:

Fancy going from a SQL Injection on Microsoft SQL Server to a full GUI access on the DB? Take a few new SQL Injection tricks, add a couple of remote shots in the registry to disable Data Execution Prevention, mix with a little Perl that automatically generates a debug script, put all this in a shaker with a Metasploit wrapper, shake well and you have just one of the attack modules of sqlninja!

Sqlninja is a tool targeted to exploit SQL Injection vulnerabilities on a web application that uses Microsoft SQL Server as its back-end.Its main goal is to provide a remote access on the vulnerable DB server, even in a very hostile environment. It should be used by penetration testers to help and automate the process of taking over a DB Server when a SQL Injection vulnerability has been discovered.
Have a look at the flash demo and then feel free to download. It is released under the GPLv3

FEAUTRES:

The full documentation can be found in the tarball and also here, but here's a list of what the Ninja does:
Fingerprint of the remote SQL Server (version, user performing the queries, user privileges, xp_cmdshell availability, DB authentication mode)

Bruteforce of 'sa' password (in 2 flavors: dictionary-based and incremental)
Privilege escalation to sysadmin group if 'sa' password has been found
Creation of a custom xp_cmdshell if the original one has been removed
Upload of netcat (or any other executable) using only normal HTTP requests (no FTP/TFTP needed)
TCP/UDP portscan from the target SQL Server to the attacking machine, in order to find a port that is allowed by the firewall of the target network and use it for a reverse shell

Direct and reverse bindshell, both TCP and UDP
ICMP-tunneled shell, when no TCP/UDP ports are available for a direct/reverse shell but the DB can ping your box
DNS-tunneled pseudo-shell, when no TCP/UDP ports are available for a direct/reverse shell, but the DB server can resolve external hostnames (check the documentation for details about how this works)
Evasion techniques to confuse a few IDS/IPS/WAF
Integration with Metasploit3, to obtain a graphical access to the remote DB server through a VNC server injection
Integration with churrasco.exe, to escalate privileges to SYSTEM on w2k3 via token kidnapping
Support for CVE-2010-0232, to escalate the privileges of sqlservr.exe to SYSTEM

FOR MAC & LINUX

Labels:

Comments

Post a Comment

Popular posts from this blog

Place Files Inside EXE and Execute them using Gamemaker

By
I am fond of creating games in Gamemaker and Mugen. However I found an interesting way to create executable files that may contain anything inside them (may be a whole cracked Program) and may act as extractors or copy protectors Tools required  GameMaker 7 or above Procedure  1) Download and Install Gamemaker and start a Game Project by going to File -> New.  2) Every game consists of a Room in which all objects shall act and interact with each other.So Create a new room by either clicking on the icon on Standard toolbar or by going to Resources Menu -> Create Room.Name it anything you want.In my case ROOM0  3)Every Game consists of Objects which are responsible for all interactions. So create a new object by either clicking on the icon on Standard toolbar or by going to Resources Menu -> Create Object.Name it anything you want.In my case VIRUS  4)Now create a new script (Press CTRL+ALT+C or Resources Menu -> Create Script),Name it SCRIPT0...
Post a Comment
Read more

How to use Keyloggers – Detailed Tutorial and FAQs

By
Here is a DETAILED tutorial which contains every possible information that you need to know about keyloggers which includes how to use it, how it works etc. WARNING: I highly recommend that you read this post completely since every single piece of information is important. I know most of you are new to the concept of keyloggers. For some of you, this might be the first time you heard about the term “keylogger”. So to give you a clear picture and make you understand better I would like to take up this post in the form of FAQs (Frequently Asked Questions). Here we go… 1. What is a Keylogger? A keylogger (also called as spy software) is a small program that monitors each and every keystroke a user types on a specific computer’s keyboard. A keylogger program can be installed just in a few seconds and once installed you are only a step away from getting the victim’s password. 2. How Keylogger works? Once the keylogger is installed on a PC, it starts operating in the backgrou...
Post a Comment
Read more

Download Zbigz Server Files from Mobile

By
Zbigz has emerged as biggest  Torrent Leeching Site. From the introduction of new interface the website is giving some problems to mobile users. Whenever We leech torrent we can not copy the link into other IP.For this a have a trick using which you can download files from any IP. Requirement for the trick First These Link- http://zbigz.com/file/Torrent Info Hash/file serial no . Second- The Hash Info Of The Torrent u want to download [like : BAB089AAE7FE057D74943F4AADD6BEDEA6EA854D]. You need to copy the hash info and paste it in Torrent Info hash. Third- Now What is file serial no. Every torrent contains file like 2, 3, 4 etc. Put the file serial no there. [note: the file number start from 0 to onwards.] Now you will get a link like this [after making the above step] http://zbigz.com/file/BAB089AAE7FE057D74943F4AADD6BEDEA6EA854D/0 Your Link is Ready To Download. Remember The Link You Get Is Free Link Not Premium. NOW I WILL SHOW YOU A EXAMPLE  Torrent Name : ...
1 comment
Read more