1. Hacking SQL Server The best defense is a good offence by Dustin Prescott @nujakcities
Created:
Modified: 11/24/2012

2. Learning Content on Security Street User groups RSS Exploit-DB updates
Cisco, SQL, Virtualization
Conferences
GrrCON, SQL Saturday
Hands-On
Capture the Flag
Forensics
RSS
Exploit-DB updates
SecurityFocus Vuln..
Content on Security Street
Twitter
@markrussinovich
@Wh1t3Rabbit
@EggDropX
@msftsecurity

3. Initial Attack Vectors
Network communication vital
Proxies
Whitelist inbound, Blacklist outbout
Corporate/Windows Firewalls

4. Authentication vs. Authorization
Try to steal credentials of highly privileged users such as Application IDs, DBA Accounts or Domain Admins. Onion.
Problem: Hackers don’t care about Authorization

5. Tools BackTrack (bt) Zenmap Metasploit framework
Bootable, vm, phone
Zenmap
Metasploit framework
927+ exploits
251+ payloads
Meterpreter
Social Engineering Toolkit
Netdiscover
Fasttrack & autopwn

6. Tools (NEW HOTNESS) Kali Linux Metasploit framework
Bootable, vm, phone
Metasploit framework
927+ exploits
251+ payloads
Meterpreter
Social Engineering Toolkit
Netdiscover
BBQSQL (sql injection)
AND MORE!

7. Meterpreter Payload Interesting Commands Getuid GetSystem Ps kill
Migrate
Shell
Hashdump
Webcam_snap
clearev

8. Demo – Information Gathering & Exploit

9. Patches and Misconfigurations
If you are not patching, no reason for pen testing
Don’t forget 3rd party utilities
Peer review servers
cleanup

10. Misconfigurations Blank or weak ‘sa’ password
Default 3rd party passwords
Accidental administrators(Dev)
Over privileged services(System)
Extra un-used services(Writer)
Extra un-used protocols (SQL Auth)

11. Patches Reversing patches is common practice
Midi file buffer overflow exploited in wild 16 days after the patch
Common msf exploits used MSYY- naming convention
CVE – common vulnerabilities and exposures
Know unsupported dates

12. Layers Layers that still work DR Firewalls Strong Passwords Antivirus
Patches
Group Policy
Log Monitoring
Least privilege
Audits and Testing DR
Did someone say zombies?

13. Roadblock
Don’t be a disabler for business.
Dan Lohrmann

14. Openwall & pastebin

15. PaSsW0rD

16. PaSsW0rD

17. PaSsW0rD

18. PaSsW0rD

19. Back to Demo Post Carnage Analysis

20. Q&A Other hacks? Review whiteboarding
‘ OR 1=1; -- Create table, insert web.config
Browser based attacks
The next MS08_067
Review whiteboarding

21. Review