Forums: Some Sql Exploit Help Please! - Forums

Jump to content

  • (2 Pages)
  • +
  • 1
  • 2
  • You cannot start a new topic
  • You cannot reply to this topic

Some Sql Exploit Help Please! Confusion about port 1434

#1 Guest_SyN/AcK_*

  • Group: Guests

Posted 21 January 2004 - 02:37 PM

Hello guys,

I'm in a network security class right now... I want to use the exploit that hit SQL so hard on port 1434. The UDP exploit, I'm sure you guys know what I'm talking about. Anyway, I had always thought that this was in all SQL 2000 Installations by default, but in all my test installations for this class, I have not been able to get port 1434 open and listening period. I know that the service that runs there is called SQL Server Manager, but I cannot figure out anyway to start it. Does anyone else know more about this?

Thanks! :)
0

#2 User is offline   Blown_Thunder 

  • Private
  • Icon
  • Group: Members
  • Posts: 1
  • Joined: 16-January 04

Posted 22 January 2004 - 05:10 AM

Isn't SQL normally running on port 1433?
0

#3 Guest_Armani_*

  • Group: Guests

Posted 22 January 2004 - 05:12 AM

yes port 1433
0

#4 User is offline   macca 

  • Private
  • Icon
  • Group: Members
  • Posts: 18
  • Joined: 06-January 04

Posted 22 January 2004 - 08:01 AM

ill 3rd that ;)


defo sql is on default port of 1433
0

#5 User is offline   detonator 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 76
  • Joined: 29-August 03

Posted 22 January 2004 - 11:39 AM

no no both are right ;)
the sqlslammer for example triggered port 1434
mssql is listening on both ports 1433 and 1434

greetz
0

#6 User is offline   vnet576 

  • Specialist
  • Icon
  • Group: Members
  • Posts: 1,000
  • Joined: 01-August 03

Posted 22 January 2004 - 12:13 PM

There are two types of ports, tcp & udp. SQL runs on TCP 1433 UDP 1434...btw SYN, I think I found slammer, gonna let u check it out later. ;)
0

#7 Guest_SyN/AcK_*

  • Group: Guests

Posted 22 January 2004 - 01:34 PM

I've got the code, that's not the problem. The problem is that I can't figure out why port 1434 UDP isn't listening by default. This was supposed to attack a default SQL Installation, but a default SQL installation for me leaves only port 1433 open. SQL manager is what runs on 1434 if that helps anyone figure this out.
0

#8 User is offline   unknown00 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 36
  • Joined: 17-January 04

Posted 22 January 2004 - 05:09 PM

if ur thinkin about hackin and scanning for expliots its usually on p1433 which is ms-sql-s aka Microsoft-SQL-Server. p1434 is ms-sql-m aka Microsoft-SQL-Monitor
0

#9 Guest_SyN/AcK_*

  • Group: Guests

Posted 22 January 2004 - 07:24 PM

unknown00, on Jan 23 2004, 01:09 AM, said:

if ur thinkin about hackin and scanning for expliots its usually on p1433 which is ms-sql-s aka Microsoft-SQL-Server. p1434 is ms-sql-m aka Microsoft-SQL-Monitor

I know this. There was a nice exploit that came out awhile ago. It made use of port 1434 UDP. It was a buffer overflow. The source code for the vulnerability is on this site. It was the same exploit that SQL Slammer used.

What I need to know is why port 1434 is not running by default, which I believe it to be.
0

#10 User is offline   as0l0 

  • Sergeant
  • Icon
  • Group: Members
  • Posts: 248
  • Joined: 14-September 03

Posted 22 January 2004 - 10:55 PM

if it's a default install then the sa password will be blank
0

#11 Guest_SyN/AcK_*

  • Group: Guests

Posted 23 January 2004 - 03:42 AM

Sigh... am I not phrasing my question right? I realize that it has a blank SA password, I don't care about that. I want to know why port 1434 isn't running by default when I believe it should be, and what I need to do to enable it. This is for a hacking class that I am a TA for. I know SQL has other vulnerabilities, I need to know this one.
0

#12 User is offline   Blake 

  • Former Commander In Chief
  • Icon
  • Group: Retired General
  • Posts: 7,317
  • Joined: 24-September 02

Posted 23 January 2004 - 06:09 AM

Ok this could help you out. MSQL utilizes TCP/UDP BUT it can also use other communication methods such named pipes. In that case SQL would not be listning ;)
Posted Image Subscribe To Our RSS Feed For the Latest News from GovernmentSecurity.org
Would you like to earn money posting on GSO?
0

#13 Guest_Dinos_*

  • Group: Guests

Post icon  Posted 23 January 2004 - 06:13 AM

Greetings,
Port 1434 (UDP) is used by MS-SQL server, provides a way for clients to query for the appropriate network endpoints to use for a particular SQL Server instance (SQL Server Resolution Service). Check at your "SQL Server Client Network Utility" At the Enabled protocols property page.

Regards,
Dinos
0

#14 User is offline   Nick W 

  • Master Sergeant
  • Icon
  • Group: Members
  • Posts: 1,250
  • Joined: 12-August 03

Posted 23 January 2004 - 06:54 AM

Two quick guesses:

1) It is really listening on port 1434 UDP, but your ISP or local IPS is preventing any UDP packets to and from that port. Microsoft's ISA server (for example) may be doing this if you are using a Windows Server as a router.

2) It is not listening on port 1434 UDP and you need to run "netstat -an" on the machine to determine for certain that it is or isn't.
0

#15 Guest_SyN/AcK_*

  • Group: Guests

Posted 23 January 2004 - 08:47 AM

Yorn, on Jan 23 2004, 02:54 PM, said:

Two quick guesses:

1) It is really listening on port 1434 UDP, but your ISP or local IPS is preventing any UDP packets to and from that port. Microsoft's ISA server (for example) may be doing this if you are using a Windows Server as a router.

2) It is not listening on port 1434 UDP and you need to run "netstat -an" on the machine to determine for certain that it is or isn't.

I've already determined it isn't.

That brings me to three possibilities:

1.) It does not run by default, but then how were so many machines raped by SQL Slammer?

2.) It runs by default on everything pre Service Pack X, and somehow my install disk is pushing on a service pack.

3.) It runs by default on MOST common SQL installs and is in something that I'm not installing, or turning on.

If anyone knows how to turn it on, please let me know!
0
  • (2 Pages)
  • +
  • 1
  • 2
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users

  • Share



Our Sponsors:


SwiftLayer Affiliate Web Hosting