Give Me a SQL Injection, I Shall PWN IIS and SQL Server
summary
SQL injection into any app that lets SQL Server or Access call the ancient Jet 4.0/ACE 12.0 provider lets a remote attacker point the engine at an attacker-controlled DB file served over WebDAV/SMB/FTP, trigger memory corruption by mutating DB records and SQL payloads, and get RCE in IIS or sqlservr with one web request. Fuzzing the provider and database-file formats finds ~100 bugs, demos use a WebDAV server and WinDbg to crash and pivot to SYSTEM via token impersonation, and exploits work from XP through Windows 10.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:55Agenda
- 1:15Who are we
- 1:37Motivation
- 2:22Circuit Injection
- 3:43Jet Database Engine
- 5:13Main Dish
- 5:39Cross Database
- 7:48MSJet
- 10:00MS Excel
- 13:35Summary
- 14:29Attack Scenarios
- 14:53Access Scenario
- 16:04Analysis
- 19:20Demo
- 20:07Scenario 2 is and the second server
- 21:21Example
- 21:53Information
- 26:18Web Shell
- 27:45Core EX
- 29:10Memory Copy
- 29:44Destination Address Buffer
- 30:30Page Description Object
- 31:18Demonstration
- 32:08Short Summary
- 33:10Conclusion
- 34:23Security Boundary
related talks
50mDefensive Programming - A Look at how to Break your Web App
56mD1T2 - Attacking Microsoft’s .NET Framework Through CLR
41mSQL Injection Isn't Dead: Smuggling Queries at the Protocol Level
22mSecure Your Code — Injections and Logging
54mTaking on the King: Killing Injection Vulnerabilities
49mBlended Web and Database Attacks on Real-time, In-Memory Platforms
48mO My Data: OData Injection attack in Microsoft Power Platform and UiPath
38mInjections - 4 Ways of Penetration