MS SQL Server Resolution Service Exploit Analysis

This technical report presents an analysis of a specific exploit targeting the Microsoft SQL Server Resolution Service (SSRS). It outlines the exploit code, identified as sql2.cpp, which takes advantage of a stack-based overflow vulnerability in SQL Server 2000. The report details the operating systems affected, including various versions of Microsoft Windows, and describes the protocols and services involved. An attack scenario is provided, illustrating the tools and methods employed by an attacker, as well as the incident handling process utilized by a fictitious security team. This process is divided into six phases: preparation, identification, containment, eradication, recovery, and lessons learned. The report also references the SQLSlammer worm, which exploited the same vulnerability, and discusses the implications of the exploit, including the potential for remote command shell access. Overall, the document serves as a comprehensive examination of the exploit and its associated risks.