CODEWITHSUNDEEP
mysqlsql-injection
Neil M.
Neil M.

Reputation: 456

What is this SQL injection doing?

Long story short, through an old asp site I run someone found an unfiltered URL parameter and was able to run this query. I'm trying to figure out what it DOES though...

The query should read:

select * from reserve where id = 345

the one that was ran was:

select * from reserve where id = 345 and ascii(substring((select concat(user,0x3a,password,0x3a,host) from mysql.user limit 0,1),17,1))=53

I'm really not sure what this obtains. Any Input?

Upvotes: 6

Views: 2127

Answers (5)

shawty
shawty

Reputation: 5829

The SQL is trying to read user data from the My-Sql user table which typically contains a list of users and hosts that are allowed to access a given my-sql server.

It looks to me like the perp is trying to trick mysql into dumping the contents of the user table so they can then record the password hashes offline and dcrypt them to find valid logins.

If your web application is using a login that will allow access to the mysql users table, then this is a serious security flaw, if it's using a login that is only granted permission to the tables required for the app then no information will be obtainable.

Security tip: When setting up ANY kind of database it's vitally important that the application using does so with a login/access role that grants it ONLY what it needs.

If your application only ever needs to read data and never modify it, then it should never have any permissions other than to read. You always need to double check this, because most database systems will by default create user roles for a given database with full read, create, modify privileges.

Always create a specific user, just for that db and or collection of tables, and always give that user the absolute minimum that's required, if your app does then get hacked with a cross site scripting attack, the most their going to get access too is that one specific database.

Upvotes: 2

Willem Hengeveld
Willem Hengeveld

Reputation: 2776

An sql injection exploit does not necessarily immediately output the query result to the attackers screen, often the result is only either an error, or no error, or maybe the injection causes a measurable (to the attacker) delay. in that way the attacker can obtain 1 bit of information per request.

By sending lots of requests, iterating over string positions, doing a binary search on the characters - or as in this case a linear search ( which may indicate that the attacker does not really understand what he is doing, but he will get there eventually ), he will be able to find all the characters in the mysql root user passwordhash. ( Which can possibly be bruteforced offline ).

Upvotes: 2

newtover
newtover

Reputation: 32084

the query is seemingly one from the a set of them:

  • by changing the charcode and substring start position and you can find out all usernames and the corresponding password hashes (when the page renders as expected you have a char match)
  • it allows to find out that the current user has access to the mysql schema.

Upvotes: 2

Salaros
Salaros

Reputation: 1456

The second part of where condition is really strange: it looks for a mysql credentials and process them as follows:

  • concat(user,0x3a,password,0x3a,host) will be something like 'someUser:hisPass:localhost'
  • the above string will be splitted in a smaller one
  • the above string is converted to ascii code (you might know it from legacy languages as ord())
  • the result of the conversion is compared to 53 integer

I suppose that the first part of WHERE statement (id = 345) will always return true while the second one is too specific, so the entire query will probably return an empty result all the time.

Upvotes: 2

Michael Berkowski
Michael Berkowski

Reputation: 270599

It might be probing whether or not the web application is accessing the database as root. Removing the ascii(substring()) portions returns the following when run as root:

mysql> select concat(user,0x3a,password,0x3a,host) from mysql.user limit 0,1;
+--------------------------------------+
| concat(user,0x3a,password,0x3a,host) |
+--------------------------------------+
| root:<rootpw-hash>:localhost         |
+--------------------------------------+

Following a successful probe, they may then attempt to retrieve the contents of mysql.user from which they can start cracking passwords against rainbow tables.

Upvotes: 5

Related Questions