Hacking SQL Server The best defense is a

Hacking SQL Server The best defense is a good offence

Learning User groups o Cisco, SQL, Virtualization Conferences o Grr. CON, SQL Saturday RSS Content on Hands-On Security Street o Capture the Flag o Forensics Exploit-DB updates Security. Focus Vuln. . Twitter @markrussinovich @Wh 1 t 3 Rabbit @Egg. Drop. X @msftsecurity

Initial Attack Vectors Network communication vital Proxies Corporate/Windows Firewalls

Authentication vs. Authorization Problem: Hackers don’t care about Authorization

Tools Back. Track (bt) • Bootable, vm, phone o Zenmap o Metasploit framework • 927+ exploits • 251+ payloads • Meterpreter o Social Engineering Toolkit o Netdiscover o Fasttrack & autopwn

Tools (NEW HOTNESS) Kali Linux • Bootable, vm, phone o Metasploit framework • 927+ exploits • 251+ payloads • Meterpreter o Social Engineering Toolkit o Netdiscover o BBQSQL (sql injection) o AND MORE!

Meterpreter Payload Interesting Commands o Getuid o Get. System o Ps o kill o Migrate o Shell o Hashdump o Webcam_snap o clearev

Demo – Information Gathering & Exploit

Patches and Misconfigurations If you are not patching, no reason for pen testing Don’t forget 3 rd party utilities Peer review servers cleanup

Misconfigurations Blank or weak ‘sa’ password Default 3 rd party passwords Accidental administrators(Dev) Over privileged services(System) Extra un-used services(Writer) Extra un-used protocols (SQL Auth)

Patches Reversing patches is common practice o Midi file buffer overflow exploited in wild 16 days after the patch Common msf exploits used MSYY- naming convention CVE – common vulnerabilities and exposures Know unsupported dates

Layers that still work o Firewalls o Strong Passwords o Antivirus o Patches o Group Policy o Log Monitoring o Least privilege o Audits and Testing DR o Did someone say zombies?

Roadblock Don’t be a disabler for business.

Openwall & pastebin

Pa. Ss. W 0 r. D

Back to Demo Post Carnage Analysis

Q&A Other hacks? o ‘ OR 1=1; -- Create table, insert web. config o Browser based attacks o The next MS 08_067 Review whiteboarding

Review