Code dotnet in the sql injection in management studio

Question

Code dotnet in the sql injection in management studio

inosys

SSC Rookie

Points: 40
More actions
September 30, 2015 at 11:18 am

#308403

Hello,
I have developed a solution that allows to inject code directly in dotnet requettes sql . which allows to use all the dotnet framworks on the fly in the sql management studio.
an example of which execute my function today:
Select dbo.Execute1('
var p1 = decimal.Parse(@p1.ToString());
return 15 + Math.Abs(p1);
',5)
Execute1 dotnet 'll execute the code and return the result , of course everything can be possible, ( work on the chains , on numeric , created and instantiated class , ...) and there are possible to put it in a select ( the function will execute on each line ) .
So you can easily deploy it on my sql server I would have the opportunity for a dotnet dll instantiated in sql server , to find a directory with read / write by the sql server processes (of course when recording my dll j ' I put unsafe ) and I bit or execute an exe from the command line .
integration of code from my dll .
CREATE ASSEMBLY SqlFX from 'D:\SqlServerFX.dll' WITH PERMISSION_SET = UNSAFE /*SAFE | EXTERNAL_ACCESS | UNSAFE */
Go
CREATE FUNCTION [dbo].Execute1(@Algo sql_variant, @p1 sql_variant)
RETURNS sql_variant WITH EXECUTE AS CALLER
AS
EXTERNAL NAME [SqlFX].[SqlServerFX.FX].Execute1
go
Thank you to all.

Viewing 7 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply

Phil Parkin SSC Guru Points: 246695 More actions · Answer 1

I cannot see a question there.

If you haven't even tried to resolve your issue, please don't expect the hard-working volunteers here to waste their time providing links to answers which you could easily have found yourself.

inosys SSC Rookie Points: 40 More actions · Answer 2

Hello,

[highlight]So you can easily deploy it on my sql server I would have the opportunity for a dotnet dll instantiated in sql server , to find a directory with read / write by the sql server processes (of course when recording my dll j ' I put unsafe ) and I bit or execute an exe from the command line .[/highlight]

juste find directory access read write for all sql server, get directory directly in the clr dotnet assembly in sql server.

thanks

inosys SSC Rookie Points: 40 More actions · Answer 3

I gave much explanation on the operation , because the restriction sql server are large for assembly dotnet integrate .

I must find a Repertoir from the assembly to read and write , and then execute a command line executable in from the integrated assembly.

Lynn Pettis SSC Guru Points: 442467 More actions · Answer 4

inosys (9/30/2015)
Hello,
[highlight]So you can easily deploy it on my sql server I would have the opportunity for a dotnet dll instantiated in sql server , to find a directory with read / write by the sql server processes (of course when recording my dll j ' I put unsafe ) and I bit or execute an exe from the command line .[/highlight]
juste find directory access read write for all sql server, get directory directly in the clr dotnet assembly in sql server.
thanks

But why? What problem does this solve?

Phil Parkin SSC Guru Points: 246695 More actions · Answer 5

Please state your question. Put a question mark at the end. Because I have no idea what your problem is.

If you haven't even tried to resolve your issue, please don't expect the hard-working volunteers here to waste their time providing links to answers which you could easily have found yourself.

inosys SSC Rookie Points: 40 More actions · Answer 6

How do we find a folder that is accessible for reading and writing from an assembly in adding sql server ? and this issue must also allow the execution of an executable command line . How to find this folder by the code?