Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A friend pointed out a sql injection vulnerability one an application I work with.

This search parameter:

'; exec xp_cmdshell 'dir';  --

Returned the message:

The EXECUTE permission was denied on the object 
   'xp_cmdshell', database 'mssqlsystemresource', schema 'sys'. 

Because the search is run from an account that only has select permissions on a few tables and stored procedures.

I was wondering, if a malicious user happened to know the login information of an admin account for the sql server, would it be possible for them use the credentials get to root access to the machine through the cmd shell, or some other naughty work?

share|improve this question

closed as off topic by Michael Hampton, Brent Pabst, Scott Pack, John Gardeniers, EightBitTony Oct 20 '12 at 18:45

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

"through the cmd shell" <-- Do you mean that the 'attacker' would have access to the CLI of the machine? Or do you mean the SQL Query Interface? What SQL server? And why not just fix the injection vulnerability?! – Chris S Oct 16 '12 at 14:13
@ChrisS I am going to get that done, I'm just wondering if someone better at this sort of thing could exploit this to get a raise in privilege on the machine. – asawyer Oct 16 '12 at 14:26
up vote 2 down vote accepted

It's possible an SQL Injection could change to a higher privilidged user on the SQL server using exec as {credentials}. However, the original user running the query would have to have IMPERSONATE permissions for the user they're trying to switch up to. This is not a default configuration, you would have to add it (it would be rather odd to add this as well).

share|improve this answer
'; execute as login = 'adminlogin'; exec xp_cmdshell 'dir'; revert; -- is returning a permission error so I suppose things could be worse. – asawyer Oct 16 '12 at 15:30
This could still be used to query any information in the database... So I wouldn't underestimate the importance of fixing the injection vulnerability. But at least nobody is going to pwN your machine this way. – Chris S Oct 16 '12 at 15:53
I had also identified a possible man in the middle vector that could expose admin credentials this morning, which is what prompted the question. It's been a bad morning so far. – asawyer Oct 16 '12 at 16:01

It really doesn't matter if it is possible or not, you have a legit problem here that you should be looking to solve. This command should not have even been posted back to the server.

share|improve this answer
I certainly agree, this scares the hell out of me, but this doesn't really answer the question. – asawyer Oct 16 '12 at 14:24
The only real answer to this question was a profound YES, of course it could and will happen given long enough for someone to find. – Brent Pabst Oct 16 '12 at 16:33
Fair enough point. – asawyer Oct 16 '12 at 17:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.