Give Me a SQL Injection, I Shall PWN IIS and SQL Server

This presentation examines how SQL injection combined with vulnerabilities in the Microsoft JET database engine can expose remote attack surfaces in IIS and SQL Server. It presents attack scenarios, vulnerability analysis, demonstrations, and mitigations.

Syllabus

Introduction
Agenda
Who are we
Motivation
Circuit Injection
Jet Database Engine
Main Dish
Cross Database
MSJet
MS Excel
Summary
Attack Scenarios
Access Scenario
Analysis
Demo
Scenario 2 is and the second server
Example
Information
Web Shell
Core EX
Memory Copy
Destination Address Buffer
Page Description Object
Demonstration
Short Summary
Conclusion
Security Boundary