- Joined
- Jan 11, 2007
- Messages
- 806
- Reaction score
- 7
Since i have got some request On this matter I thought we would take a look into some of its security.
As many know I'm the owner of a Irose server using what some call Arcturus.
Arcturus seems to have its Bugs and security holes. This is no Surprise.
What my objective here is to help plug some of these holes.
Now lets start plugging...
First Matter we will take a look into is the SQL injection
when a sql injection is wrote its usually done in this manor,
Example 1
What this Injection dose is look for your Seven_ORA Db and find the accounts with right 1 and make them right 768.
In thus the Whole server is GM..
Example 2
Now what this one does is drops all chars in the SHO Db. Loss of all chars,
Example 3
And this one will delete all non Gm Accounts.
Now that we see how simple sql Injections are wrote lets add some Security for this type of inject.
The first step we would take to start to protect this is
Step 1
Create 3 new db's
:busted_co DON'T name them seven_ORA, SHO, Or SHO_LOG
Use a unique Db name for each Db but know what they are.
Step 2
Make backups of all your current db's back them up to your desktop you will need then in a min.
Step 3
Now after you have them all Backed up delete the original ones.
Step4
Now you will need to restore the backups into the new Db's.
This is simply done the same way you backed up your dbs,
right click db restore db select drive and find the db. In the tabs there's a
option to force over right make sure that is checked.
Do the same for all 3 Db's
Step 5
Now you have all your data in the New Dbs, We need to fix the user rights.
A good friend of mine has wrote a sql Script for a easy way to add user rights
You will need to change the Db names the users and passes used.
Step 6
Now we have users for the dbs next we need to fix the odbc
Open odbc and change the the login to the ones you created in the last script and link seven_ORA to your new SO db and SHo to your new SHO db
And same with SHO_LOG.
Step 7
You will need to go thru your stored proc and change the db names in them to use your new db name.
Stage 1 Complete....... This will Secure 90% of the people trying to exploit your server.
Now Xp_cmdShell exsploit i like this one it can make a admin account on your host for the hacker...
The Injection looks something like this
The simeple fix for this would be this small script
This may cause a random error in your console window witch a few have told me it has. The server runs fine and if it's running good then why worry about it as long as you are secure.
Now I will say this is not all the security we use at Inferno but is some of our security fixes.
And i won't release all, But this should get you in the right direction. I hope this tut helps some out. If you don't understand most of this I'm sorry but learn your mssql a bit better. Ill show you the water but you need to figure out how to drink it.
As many know I'm the owner of a Irose server using what some call Arcturus.
Arcturus seems to have its Bugs and security holes. This is no Surprise.
What my objective here is to help plug some of these holes.
Now lets start plugging...
First Matter we will take a look into is the SQL injection
when a sql injection is wrote its usually done in this manor,
Example 1
Code:
a';UPDATE SEVEN_ORA..UserInfo SET [right]=768 WHERE [right]=1--In thus the Whole server is GM..
Example 2
Code:
a';DELETE SHO..tblGS_AVATAR WHERE [dwRIGHT]=0--Example 3
Code:
a';DELETE SEVEN_ORA..UserInfo WHERE [right]=1--Now that we see how simple sql Injections are wrote lets add some Security for this type of inject.
The first step we would take to start to protect this is
Step 1
Create 3 new db's
:busted_co DON'T name them seven_ORA, SHO, Or SHO_LOG
Use a unique Db name for each Db but know what they are.
Step 2
Make backups of all your current db's back them up to your desktop you will need then in a min.
Step 3
Now after you have them all Backed up delete the original ones.
Step4
Now you will need to restore the backups into the new Db's.
This is simply done the same way you backed up your dbs,
right click db restore db select drive and find the db. In the tabs there's a
option to force over right make sure that is checked.
Do the same for all 3 Db's
Step 5
Now you have all your data in the New Dbs, We need to fix the user rights.
A good friend of mine has wrote a sql Script for a easy way to add user rights
You will need to change the Db names the users and passes used.
Code:
/*****************************************************************/
exec sp_addlogin 'Username1', 'pass1', 'YournewSevenOradbnamehere', 'us_english', 0x05000000000000000000000000000000
exec sp_addlogin 'Username2', 'pass2', 'YournewSHOdbnamehere', 'us_english', 0x07000000000000000000000000000000;--
use YournewSHOdbnamehere
/*exec sp_adduser 'Username1'
GRANT SELECT, INSERT, UPDATE ON UserInfo TO Username1*/
exec sp_adduser 'Username2'
GRANT SELECT, INSERT, UPDATE ON UserInfo TO Username2
use YournewSevenOradbnamehere
exec sp_adduser 'Username1'
GRANT SELECT, INSERT, DELETE, UPDATE ON WS_CheatLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON tblGS_AVATAR TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON tblGS_BANK TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON tblWS_CLAN TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON tblWS_ClanCHAR TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON tblWS_FRIEND TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON tblWS_MEMO TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON tblWS_VAR TO Username1
use SHO_LOG
exec sp_adduser 'Username1'
GRANT SELECT, INSERT, DELETE, UPDATE ON WS_CheatLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_ChangeAbility TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_CharacterLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_CreateLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_DieLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_GemmingLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_ItemLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_LevelUpLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_PeriodicCHARLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_QuestLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_SkillLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_UnionLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON GS_UpgradeLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON UpdatePoint_Log TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON WS_ClanLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON WS_LoginLog TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON tblGS_ERROR TO Username1
GRANT SELECT, INSERT, DELETE, UPDATE ON tblGS_LogIN TO Username1
/*****************************************************************/
/*****************************************************************/
use YournewSevenOradbnamehere
GRANT EXEC ON ws_ClanUPDATE TO Username1
GRANT EXEC ON gs_GetACCOUNT TO Username1
GRANT EXEC ON gs_SelectBANK TO Username1
GRANT EXEC ON gs_SelectCHAR TO Username1
GRANT EXEC ON ws_CharDELETE TO Username1
GRANT EXEC ON ws_ClanBinUPDATE TO Username1
GRANT EXEC ON ws_ClanCharADD TO Username1
GRANT EXEC ON ws_ClanCharADJ TO Username1
GRANT EXEC ON ws_ClanCharALL TO Username1
GRANT EXEC ON ws_ClanCharDEL TO Username1
GRANT EXEC ON ws_ClanCharGET TO Username1
GRANT EXEC ON ws_ClanDELETE TO Username1
GRANT EXEC ON ws_ClanINSERT TO Username1
GRANT EXEC ON ws_ClanMOTD TO Username1
GRANT EXEC ON ws_ClanMarkUPDATE TO Username1
GRANT EXEC ON ws_ClanSELECT TO Username1
GRANT EXEC ON ws_ClanSLOGAN TO Username1
GRANT EXEC ON ws_CreateCHAR TO Username1
GRANT EXEC ON ws_DelMEMO TO Username1
GRANT EXEC ON ws_DeleteCHAR TO Username1
GRANT EXEC ON ws_DeleteUnregCHAR TO Username1
GRANT EXEC ON ws_GetCharID TO Username1
GRANT EXEC ON ws_GetCharLIST TO Username1
GRANT EXEC ON ws_GetFRIEND TO Username1
GRANT EXEC ON ws_GetMEMO TO Username1
GRANT EXEC ON ws_SelectCHAR TO Username1
GRANT EXEC ON AddCharacterLog TO Username1
GRANT EXEC ON AddCheatLog TO Username1
GRANT EXEC ON AddClanLog TO Username1
GRANT EXEC ON AddCreateLog TO Username1
GRANT EXEC ON AddDieLog TO Username1
GRANT EXEC ON AddGemmingLog TO Username1
GRANT EXEC ON AddItemLog TO Username1
GRANT EXEC ON AddLevelUpLog TO Username1
GRANT EXEC ON AddLoginLog TO Username1
GRANT EXEC ON AddPeriodicCHARLog TO Username1
GRANT EXEC ON AddQuestLog TO Username1
GRANT EXEC ON AddSkillLog TO Username1
GRANT EXEC ON AddUpgradeLog TO Username1
GRANT EXEC ON DeleteGS_Log TO Username1
GRANT EXEC ON gs_M_DefLOG TO Username1
GRANT EXEC ON gs_M_DescLOG TO Username1
GRANT EXEC ON gs_M_LogInOut TO Username1
GRANT EXEC ON gs_M_ObjDescLOG TO Username1
GRANT EXEC ON gs_M_ObjLOG TO Username1
use SHO_LOG
GRANT EXEC ON gs_M_ObjLOG TO Username1
GRANT EXEC ON gs_M_ObjDescLOG TO Username1
GRANT EXEC ON gs_M_LogInOut TO Username1
GRANT EXEC ON gs_M_DescLOG TO Username1
GRANT EXEC ON gs_M_DefLOG TO Username1
GRANT EXEC ON DeleteGS_Log TO Username1
GRANT EXEC ON AddUpgradeLog TO Username1
GRANT EXEC ON AddSkillLog TO Username1
GRANT EXEC ON AddQuestLog TO Username1
GRANT EXEC ON AddPeriodicCHARLog TO Username1
GRANT EXEC ON AddLoginLog TO Username1
GRANT EXEC ON AddLevelUpLog TO Username1
GRANT EXEC ON AddItemLog TO Username1
GRANT EXEC ON AddGemmingLog TO Username1
GRANT EXEC ON AddDieLog TO Username1
GRANT EXEC ON AddCreateLog TO Username1
GRANT EXEC ON AddClanLog TO Username1
GRANT EXEC ON AddCheatLog TO Username1
GRANT EXEC ON AddCharacterLog TO Username1
/*****************************************************************/
use YournewSHOdbnamehere
GRANT SELECT, INSERT, UPDATE ON Statistic TO Username2
GRANT EXECUTE ON UpdateStat TO Username2
/*use YournewSHOdbnamehere
exec sp_adduser 'Username1'
GRANT SELECT, INSERT, DELETE, UPDATE ON UserInfo TO Username1 */
GRANT INSERT ON Ch_Pw TO Username2
GRANT UPDATE ON UserInfo TO Username2
GRANT EXECUTE ON UpdatePWD TO Username2
GRANT UPDATE ON Restart_Flag TO Username2Now we have users for the dbs next we need to fix the odbc
Open odbc and change the the login to the ones you created in the last script and link seven_ORA to your new SO db and SHo to your new SHO db
And same with SHO_LOG.
Step 7
You will need to go thru your stored proc and change the db names in them to use your new db name.
Stage 1 Complete....... This will Secure 90% of the people trying to exploit your server.
Now Xp_cmdShell exsploit i like this one it can make a admin account on your host for the hacker...
The Injection looks something like this
Code:
a';exec master..xp_cmdshell 'net user Myaccountname mynewpass /add';exec master..xp_cmdshell 'net localgroup administrators Myaccountname /add'--
Code:
use master
exec sp_dropextendedproc 'xp_cmdshell'
goNow I will say this is not all the security we use at Inferno but is some of our security fixes.
And i won't release all, But this should get you in the right direction. I hope this tut helps some out. If you don't understand most of this I'm sorry but learn your mssql a bit better. Ill show you the water but you need to figure out how to drink it.
Last edited:
explains a lot of things i was busting my head with.
