📖
Building a Windows AD lab
  • Building a Windows AD lab
  • Lab-setup
    • Lab overview
    • Building the lab
      • Prerequisite
      • Creating images
        • Optional: Install software & Settings
      • Network setup
      • Cloning & Creating VM's
      • Creating bank.local
        • Creating Domain Controller - DC01
          • Enable RDP
        • Creating amsterdam.bank.local
          • Creating Domain Controller - DC02
            • Creating a AD structure
            • Create a CA
            • Configure LDAPS
          • Creating Fileserver - FILE01
            • File services
          • Creating W10 client - WS01
            • PSRemoting
          • Creating Webserver - WEB01
            • Web Services
            • SQL Server
              • Create database
      • Creating secure.local
        • Creating Domain Controller - DC03
        • Creating File/SQL Server - DATA01
          • SQL Server
            • Create database
    • Attack Paths
      • Attack path 1 (hard)
        • Configuring
        • Tasks
        • Manual
      • Attack path 2
        • Configuring
        • Task
        • Manual
    • Troubleshooting
    • To-Do
  • Vulnerabilities & Misconfigurations & Attacks
    • Initial Access Attacks
      • Username Enumeration
        • Password Spraying
        • AS-REP Roasting
        • Empty Password
      • SMB Relaying
      • SMB Null-Session (To-Do)
      • SQL Server default login
    • Active Directory Attacks
      • Password spraying
      • AS-REP Roasting
      • Empty password
      • Password in description
      • Kerberoasting
      • Delegation Attacks
        • Unconstrained Delegation
          • Printerbug
        • Constrained Delegation
        • Resource Based Constrained Delegation
          • Computeraccount Takeover
          • Change-LockScreen
          • Webclient Attack (todo)
      • DACL-Abuses
        • Write Owner
        • Owns
        • WriteDacl
        • GenericAll
        • GenericWrite (todo)
        • ForceChangePassword
        • Add user to group (todo)
        • Targeted Kerberoast (todo)
        • Get-Changes
      • Reused local administrator (todo)
      • SQL Server Attacks (todo)
        • Initial Access
          • SQL Server default login
          • Normal domain user access
        • Privilege Escalation
          • Impersonation
          • DB-Owner
          • Enumerate Logins
            • Weak passwords
        • Executing Commands
        • Database-Links
        • Capturing hashes & Relaying
      • Reading LAPS passwords (todo)
      • Priviliged Groups (todo)
        • DNS-Admins (todo)
        • Account Operators (todo)
        • Backup Operators
        • Server Operators (todo)
      • Hopping domains and forests
        • Child to parent domain
          • Krbtgt hash
          • Trust key
        • Cross forest Attacks (todo)
          • Foreign user
    • Misc
      • Reverse shell trick
      • Lateral Movement
        • PSRemoting
        • PsExec (todo)
      • Misconfigured Service (todo)
        • Unqouted Service Path
      • Discovering Shares
      • Password on shares
      • Different methods of dumping credentials
        • LSASS (todo)
        • Dumping DPAPI
          • Browser passwords
        • Scheduled tasks (todo)
        • Services (todo)
        • Vssadmin Shadow Copy
      • ms-ds-machineaccountquota (todo)
      • add DNS Records (todo)
      • Bypassing UAC
    • Template page
  • Defence
    • Detection
    • Hardening
      • LDAP
        • LDAP Signing
        • LDAPS Binding
      • Strong Password Policy
      • Change who can join computers to the domain
      • Protected users group
      • Account is sensitive and cannot be delegated
      • Powershell Execution Policy
      • Template page
Powered by GitBook
On this page
  • Configuring
  • Prerequisite
  • Configuring
  • Attacking
  • How it works
  • Tools
  • Executing the attack
  • Defending
  • Recommendations
  • Detection
  • References
Edit on GitHub
  1. Vulnerabilities & Misconfigurations & Attacks
  2. Active Directory Attacks
  3. SQL Server Attacks (todo)
  4. Initial Access

Normal domain user access

PreviousSQL Server default loginNextPrivilege Escalation

Last updated 2 years ago

Configuring

Prerequisite

Configuring

  1. Login to WEB01 as the Administrator user with password Welcome01!.

  2. Open "Microsoft SQL Server Management Studio"

3. Login with the Administrator user using Windows Authentication.

4. Expand the "Security" and "Logins" folders. Right click on "Logins" and click "New Login".

5. Click on "Search", click "Locations" and expand the directories and click on "Amsterdam.bank.local".

6. Fill in "Richard" and click "Check Names".

7. At "Default Database" select "Production".

8. Click on "User Mapping" and select "Production".

9. Click "OK".

Attacking

How it works

Check for MSSQL servers inside the domain and try to login using the credentials from the current user or from another user. Sometimes all Domain Users have access to the database and its even possible that everyone is sysadmin on the database.

Tools

Executing the attack

PowerUpSQL

  1. Download PowerUpSQL on the kali machine and host it on a webserver:

wget https://raw.githubusercontent.com/NetSPI/PowerUpSQL/master/PowerUpSQL.ps1
python3 -m http.server 8090

2. Login to WS01 as Richard with the password Sample123.

3. Start PowerShell and download and execute an amsi and PowerUpSQL in memory:

4. Get the SQL instances from the domain:

Get-SQLInstanceDomain

The output shows one SQL Instance.

5. Get the SQL instances from the domain and check access:

Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded

The output shows that we can access the MSSQL instance WEB01.amsterdam.bank.local.

If ran from a user that doesn't have access (for example John), it says not accessible.

6. To get more info about the session on the SQL server run:

Get-SQLServerInfo -Instance WEB01.amsterdam.bank.local

It shows that we aren't sysadmin. Which means we can't execute commands on the database, but our user has access to the database. So we can look into the database for sensitive information or we might be able to escalate our privileges to sysadmin.

Connecting with HeidiSQL

  1. To execute SQL queries and look into the database start heidiSQL.

  2. Click on "New" on the left bottom and configure the following settings:

  • Network Type: Microsoft SQL Server (TCP/IP)

  • Library: SQLOLEDB

  • Hostname / IP: WEB01.amsterdam.bank.local

  • Select: "Use Windows Authentication"

  • Port: 1433

4. Click "OK" on the security Issue warning.

5. Click on the databases on the left and see if we got access to any:

We are able to access the Production database, but not the Development one.

Defending

Recommendations

  • Periodically audit who has access to which SQL servers / databases etc.

Detection

References

Download on WS01.

PowerUpSQL
HeidiSQL
HeidiSQL
Username Enumeration
GitHub - NetSPI/PowerUpSQL: PowerUpSQL: A PowerShell Toolkit for Attacking SQL ServerGitHub
Logo
HeidiSQL - MariaDB, MySQL, MSSQL, PostgreSQL and SQLite made easy
Logo