CVE-2000-0402
published 2000-05-30CVE-2000-0402: The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable…
PriorityP434low2.1CVSS 2.0
AVLACLAuNCPINAN
EXPLOIT
EPSS
90.61%
99.8th percentile
The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack Password" vulnerability.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | sql_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
12 01 00 34 00 00 00 00 00 00 15 00 06 01 00 1b 00 01 02 00 1c 00 0c 03 00 28 00 04 ff 08 00 02 10 00 00 00
bytes↗
00 24 01 00 00
- →Detect SQL Server Hello overflow attempts by monitoring TCP/1433 for login packets with a 560-byte crap-filled attack string following the standard MSSQL prelogin header (starting 0x12 0x01 0x00 0x34). ↗
- →Monitor for xp_cmdshell invocations embedded in HTTP GET parameters as a sign of SQL injection exploitation; look for patterns like ';exec xp_cmdshell' or ';[SQLi];--' in web request paths. ↗
- →Alert on SQL Server Mixed Mode authentication log files being read by non-privileged users; the 'sa' account password is stored in plaintext in a log file readable by any user. ↗
- →Payload executables dropped on target systems via mssql_upload_exec or powershell_upload_exec will persist after exploitation; hunt for unexpected executables spawned from the SQL Server process. ↗
- ·CVE-2000-0402 specifically affects SQL Server 7.0 Mixed Mode authentication with a Service Pack applied; the plaintext 'sa' password exposure only occurs in that configuration. ↗
- ·The Hello overflow exploit (exploit-db 21693) targets TCP/1433 and fires before authentication; the CVE reference in that script is commented out, indicating it may target a related but distinct vulnerability (buffer overflow vs. password disclosure). ↗
- ·The debug.com delivery method for payload execution is not available on x86_64 systems because it invokes ntvdm. ↗
- ·Bind payloads on port 80 should be avoided during SQL injection exploitation as they will block access to the vulnerable web server. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft SQL Server - Payload Execution (via SQL Injection) (Metasploit)
exploitdb·2011-02-08
CVE-2000-1209 Microsoft SQL Server - Payload Execution (via SQL Injection) (Metasploit)
Microsoft SQL Server - Payload Execution (via SQL Injection) (Metasploit)
---
##
# $Id: mssql_payload_sqli.rb 11730 2011-02-08 23:31:44Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft SQL Server Payload Execution via SQL injection',
'Description' => %q{
This module will execute an arbitrary payload on a Microsoft SQL
Server, using a SQL injection vulnerability.
Once a vulnerability is identified this module
will use xp_cmdshell to upload and execute Metasploit payloads.
It is necessary to specify the exact point where th
Exploit-DB
Microsoft SQL Server - Payload Execution (Metasploit)
exploitdb·2010-12-21
CVE-2000-1209 Microsoft SQL Server - Payload Execution (Metasploit)
Microsoft SQL Server - Payload Execution (Metasploit)
---
##
# $Id: mssql_payload.rb 11392 2010-12-21 20:36:34Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft SQL Server Payload Execution',
'Description' => %q{
This module executes an arbitrary payload on a Microsoft SQL Server by using
the "xp_cmdshell" stored procedure. Currently, three delivery methods are supported.
First, the original method uses Windows 'debug.com'. File size restrictions are
avoidied by incorporating the debug bypass method presented by SecureStat
Exploit-DB
Microsoft SQL Server 2000 - User Authentication Remote Buffer Overflow
exploitdb·2002-08-06·CVSS 2.1
CVE-2002-1123 [LOW] Microsoft SQL Server 2000 - User Authentication Remote Buffer Overflow
Microsoft SQL Server 2000 - User Authentication Remote Buffer Overflow
---
source: https://www.securityfocus.com/bid/5411/info
A vulnerability has been discovered in Microsoft SQL Server that could make it possible for remote attackers to gain access to target hosts.
It is possible for an attacker to cause a buffer overflow condition on the vulnerable SQL server with a malformed login request. This may allow a remote attacker to execute arbitrary code as the SQL Server process.
This vulnerability reportedly occurs even before authentication can proceed.
##
#
# this script tests for the "You had me at hello" overflow
# in MSSQL (tcp/1433)
# Copyright Dave Aitel (2002)
# Bug found by: Dave Aitel (2002)
#
##
#TODO:
#techically we should also go to the UDP 1434 resolver service
#and get
Metasploit
Microsoft SQL Server Payload Execution
metasploit
Microsoft SQL Server Payload Execution
Microsoft SQL Server Payload Execution
This module executes an arbitrary payload on a Microsoft SQL Server by using the "xp_cmdshell" stored procedure. Currently, three delivery methods are supported. First, the original method uses Windows 'debug.com'. File size restrictions are avoided by incorporating the debug bypass method presented by SecureStat at Defcon 17. Since this method invokes ntvdm, it is not available on x64 systems. A second method takes advantage of the Command Stager subsystem. This allows using various techniques, such as using a TFTP server, to send the executable. By default the Command Stager uses 'wcsript.exe' to generate the executable on the target. Finally, ReL1K's latest method utilizes PowerShell to transmit and recreate the payload on the target. NOTE: This m
Metasploit
Microsoft SQL Server Payload Execution via SQL Injection
metasploit
Microsoft SQL Server Payload Execution via SQL Injection
Microsoft SQL Server Payload Execution via SQL Injection
This module will execute an arbitrary payload on a Microsoft SQL Server, using a SQL injection vulnerability. Once a vulnerability is identified this module will use xp_cmdshell to upload and execute Metasploit payloads. It is necessary to specify the exact point where the SQL injection vulnerability happens. For example, given the following injection: http://www.example.com/show.asp?id=1;exec xp_cmdshell 'dir';--&cat=electrical you would need to set the following path: set GET_PATH /showproduct.asp?id=1;[SQLi];--&cat=foobar In regard to the payload, unless there is a closed port in the web server, you dont want to use any "bind" payload, specially on port 80, as you will stop reaching the vulnerable web server host. You want a "rev
No writeups or analysis indexed.
http://www.microsoft.com/technet/support/kb.asp?ID=263968http://www.securityfocus.com/bid/1281https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-035http://www.microsoft.com/technet/support/kb.asp?ID=263968http://www.securityfocus.com/bid/1281https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-035
2000-05-30
Published