SQL Injection | Welcome to world of Abhay Mathur

Archive for the 'SQL Injection' category

Symantec exposed passwords,serials… SQL Injection, full database access

Nov 23 2009 Published by Abhay Mathur under SQL Injection

“Symantec was founded in 1982 by visionary computer scientists. The company has evolved to become one of the world’s largest software companies with more than 17,500 employees in more than 40 countries.Symantec helps consumers and organizations secure and manage their information-driven world. Our software and services protect against more risks at more points, more completely and efficiently, enabling confidence wherever information is used or stored.”

We can read on their site … Interesting …. Especially in light of the finds. A secured bad parameter allows full access to Symantec servers, allows access to many sensitive data stored on this server. So, it seems quite strange how a company like Symantec, which sells software and security solutions, the famous Norton for example, wants to protect ourselves. Instead, it is not able to protect its own database. Let’s see what actually is.

Blind SQL Injection is not as spectacular as a normal SQL injection, as the error (the result of injection) does not appear on the website. It is based on the concept of true and false. When “i put a question” real server (and 1 = 1 in our case), we will answer truly, that page is loading properly.

And when “asking” something untrue (and 1 = 2) web page no longer load.

Therefore, to show vulnerability will use 2 tools, Pangolin and sqlmap.
We find that:
web server operating system: Windows 2003 or 2000
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000

In the first picture appears information about the server. The worst thing is highlighted in red on me in the picture, we have access to drivers (C: \ and D: \), that WE CAN WALK ON THE SERVER AS IN YOUR PC.

In these two pictures we see available databases that have access:

It is clear that we are on Symantec server. Oasis, Northwind, OneCare, etc are important projects Symantec. But they seemed to me particularly interesting 2 databases, highlighted in red in the picture, one related to Norton and Symantecstore.
Nortonplus database is huge, contains 91 tables. I will enumerate, without further details.

Instead I will insist more on Symantecstore database, especially for a database shop should be protected. The database contains 56 tables.

One of the tables is TB_MEMBER, which contains 70,356 rows, the data members (for help “I called the tool’s sqlmap)

[16:27:41] [INFO] fetching number of columns ‘M_EMAIL, M_NAME, M_PASS, M_USERID’
entries for table ‘TB_MEMBER’ on database ’symantecstore’
[16:27:41] [INFO] query: SELECT ISNULL(CAST(LTRIM(STR(COUNT(*))) AS VARCHAR(8000
)), CHAR(32)) FROM symantecstore..TB_MEMBER
[16:27:41] [INFO] retrieved: 70356

We randomly selected 6 users, from number 100 to 105, in the table. I was outraged when I saw the result shown by sqlmap. These users passwords are stored in CLEAR TEXT !!!!!!!. (To protect users of those data, we replaced some letters with X’s)

Similarly, in CLEAR TEXT, passwords are saved and the 134 employees of TB_EMPLOYEE table.

Database: symantecstore
Table: TB_EMPLOYEE
[6 entries]
+———–+———–+——————+
| E_ID | E_NAME | E_PASSWORD |
+———-+————+————+
| sysedit2 | XXX | s76083XXX |
| zany | XXX | asdXXX |
| zany1 | XXX | hm12XXX |
| s0167 | XXX | hm12XXX |
| s0166 | XXX | hm12XXX |
| s0191 | XXX | hm12XXX |

Is about one one shop, I was curious what the table contains PaymentInformationInfo. Table columns will show no other details

TB_ORDER table columns are:

And when we put sqlmap’s tool to work, there is little surprise us to find that this table contain 122,152 of Serial Number.

[16:39:22] [INFO] fetching number of columns ‘ProductName, ProductNumber, Serial
Number’ entries for table ‘TB_ORDER’ on database ’symantecstore’
[16:39:22] [INFO] query: SELECT ISNULL(CAST(LTRIM(STR(COUNT(*))) AS VARCHAR(8000
)), CHAR(32)) FROM symantecstore..TB_ORDER
[16:39:22] [INFO] retrieved: 122152

If you remember, in February, Kaspersky faced with a sql injection. Then they had the courage to admit vulnerability, why have my admiration. There was fair play, they quickly secured vulnerable parameter, and even if at first they were very angry at me, finally understood that I did not extract, I saved nothing, I have not abused in any way by the data found. My goal was, what is still, to warn. To call attention.

That being said, expect the curious reaction from Symantec.

Source: http://unu123456.baywords.com

No responses yet

HI, Its so nice to see you here on my Blog, Please write your comment and reviews so that i could make my blog Better. Thanks have a nice time on my blog.
Get updates by email
Pages
- About Abhay Mathur
Categories
Twitter Updates
- दो हजार किसानों ने मांगी राष्ट्रपति से इच्छामृत्यु - IBN Khabar http://bit.ly/d7V3tM 2 weeks ago
- bbyee gud ngt 2 weeks ago
- In the walk of life, do't wry of people moving ahead of u take ur own time.. but once u r ready to run, make sure you are best of all! 2 weeks ago
- @SrBachchan Hi, BIG B, is this ur marrige time picure? http://twitpic.com/2gafei Both are made for each other... 2 weeks ago
- @Ayeshatakia hi, got you, thnx GOD atleast now i can talk to you, n tell my frnds i talked with Ayesha Takia :) 2 weeks ago
Recent Posts
Blogroll
Meta

Archive for the 'SQL Injection' category

Symantec exposed passwords,serials… SQL Injection, full database access

Pages

Categories

Twitter Updates

Recent Posts

Blogroll

Meta