Dark Reading

A researcher at Black Hat Europe this month will demonstrate a new hack that uses SQL injection as a stepping stone to take control of a database server.

"SQL injection becomes a stepping stone to the real target: the operating system," says Bernardo Damele Assumpcao Guimaraes, an IT security engineer based in London. "I will focus on exploiting SQL injection in a Web application to get control over the underlying OS," in addition to the database software, says the researcher, who goes by the surname Damele .

SQL injection is a popular attack vector in Web applications, mainly because it's one of the most common flaws found in these apps. Web application SQL injection attacks typically target client browsers, infecting them when the victim visits a compromised Website. Another SQL injection attack is on the database itself, via a Web application carrying that vulnerability.

But Damele's new hack kicks SQL injection up a notch, using it as a first level of attack to gain control of the database server itself, as well as any systems connected to it. That includes other servers in the same LAN, plus the data in the database itself. His attack goes after MySQL, Microsoft's SQL Server, and PostgreSQL running on Windows or Linux servers. "[This] possible scenario of attack for a SQL injection is the most overlooked and [under]researched," he says.

In one attack demo, Damele will show how to exploit a buffer overflow flaw in the database software by injecting valid SQL code. He has a few other attacks up his sleeve for Black Hat, too: "I will demonstrate other possible techniques to exploit other Windows design flaws to escalate privileges via a SQL injection," he says. "The idea is to take advantage of some of the design weaknesses of the database management system, and combine it with [weaknesses] in the programming development of the Web app to execute arbitrary code, upload binary infection files, and carry out also buffer overflow exploitation."

Damele says some of the attacks he'll demonstrate have never been done publicly via SQL injection -- such as privilege escalation on the operating system, buffer overflow exploitation, and arbitrary command execution on MySQL.

And in keeping with Black Hat tradition, he'll also release a hacking tool -- a new version of his sqlmap SQL injection tool that includes each of the database server hacking techniques. "This version has all of my brand-new research," he says. "I'll release it immediately after the presentation."

The tool includes a buffer overflow exploit that targets a flaw Microsoft patched in SQL Server in February -- the first publicly available exploit of that bug, Damele says. Any SQL Server that hasn't been patched with that Microsoft security update is at risk of being overtaken by an attacker via this technique, he says.

Damele says a database server attack via SQL injection is a real threat to organizations that don't have secure Web applications or properly configured database servers. "I think that the attacks described are realistic threats when the Web application does not follow a proper security development life cycle and the database server is used with default configurations in place or is badly configured," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message