SQLCMD and the tempdb adventure

I had a call today from a colleague to help her out with an issue. Some customer had moved their tempdb and now she had to fix it because the SQL server instance did not come up. Since I handled such a case in the past she asked me to tell her how I've fixed it. I write this blog post because I had already forgotten a couple of things.

1. Make sure the SQL instance is stopped.

2. Activate the named pipes protocol.

3. Start the SQL instance with the -m option

4. Open a sqlcmd connection with the -e option. Sqlcmd is case sensitive so lookout when you type in the instance name (server\instance).

5. alter the file location

Meet Joe McCray

Yesterday there was a last minute OWASP chapter meeting and 2 presentations by Joe McCray of learnsecurityonline.com. The intro was great: Joe loves hacking, swearing and drinking rum and coke (a.k.a Cuba Libre).

The first presentation was about SQL Injection. Most things Joe talked about where things I already knew but it is always interesting to hear somebody explain how he or she does it, and yes, I've learned new things. I have been to presentations where they had prepared a VM with a vulnerable webapp but not Joe. He did his demo on a live website and enumerated all databases on the webserver. He explained in great detail what kind of injections there are and the conclusion was "Fix your shit". He demonstrated how IDS can help you but is not a silver bullet.

The most important thing I took home from this presentation is that he experienced that not everybody terminates SSL connections, normalized the input and then feeds it to the IDS ... and of course "Fix your shit" :). At the end of the evening we discussed what is the easiest way to get the stuff fixed and his experience was to get vulnerabilities classified as bug by the Quality Assurance people. I think this is a trick I will apply in the future :)

The second presentation was about Web Application Firewalls. I have no experience with application firewalls. I saw some presentations in the past and Joe confirmed what I was thinking about it. It is something to give you some time to "fix your shit" but not the solution.

Joe is coming to BruCon in September 2010 to give a session titled "You Spent All That Money And You Still Got Owned".

Wait a second in batch - the ping hack

If you have to wait a couple of seconds in a batch script you can use the following trick:

PING -n 11 127.0.0.1 >NULL

This will make 11 pings and by chance this takes approximately 11 seconds. If you have a better system let me know.

Lock picking basics

Recently the lock of my mailbox fell into my hands (yes, it is junk but the mailbox is temporary). Now to your regular Joe out there this is usually an inconvenience but I was happy about it because now I could study the lock and try to understand what the good people of Toool where demonstrating at HAR2009.

	First we have a look at the lock how it fell into my hands.
	If we take out the pins, we see the little, tiny, springs that give the resistance when you put your key into the lock.
	This is a detail of a pin. The key goes through the little hole.
	If we have a look at the key we notice the pointy and flat parts.
	If we put the key into the lock we see that the pins move into their positions. The pins move up and down when the key goes trough it.
	If you have a good look you will recognise the flat parts of the key. They are exactly positioned where the pins are.

The picking is done with fine picks you slide into the lock and put gentle pressure on the pins so that they line up. It is easier said than done but it is fun to see a lock pop open without a key and not damaging it ... do you have a mailbox?

Even a 10 year old would guess it

Recently I was somewhere in a data center in Belgium where the local administrator password was written down on a post-it and was next to the screen of the console. I don't say I would approve but I could understand if you put it there and the password was complex. This was absolutely not the case, it was the company name.

Some people wonder how those evil hackers can get into their systems even if they have the latest antivirus updates and a firewall ... there is no patch for HumanOS.

My first SQL 2008 cluster on vSphere

Recently I had to install a SQL 2008 cluster on Windows 2008 cluster which was virtualized. I learned some valuable lessons I want to share with you.

First of all there is this new feature in the VM Tools called shared folders. Make sure it is off. It causes an error message and the description has nothing to do with the cause.

The second thing is if you want to install service pack 1 for SQL Server, slipstream it. There is a bug that crashes your installation and you can't actually remove it. The term slipstream is a not really the correct term but it works.

First you unpack the service pack with the /x option and then you need to run /x64/setup/1033/sqlsupport.msi and run it. The next step is to start the SQL Server setup and start it from the command line with the parameter /PCUSource=

More info on slipstream can be fount at http://support.microsoft.com/kb/955392.

Kind of grep in your dos-prompt

Do you recognise the situation where you wish that you are on a windows box and grep would be handy to go logs and other text files. There is something called findstr, and it can handle regular expressions.