In this lesson,
we're going to focus on PowerUpSQL,
a powerful tool for automating the discovery
and exploitation of SQL Server instances during a pentest.
PowerUpSQL is a collection of PowerShell functions
that make it easier to find, access,
and exploit SQL Server installations,
which are often critical assets in an organization.
Now, let's start by understanding
what PowerUpSQL is designed to do.
Essentially, it helps you discover SQL Server instances
on a network, assess the configuration,
and exploit any vulnerabilities you find.
Now, this tool is particularly useful
in environments where SQL Server is widely used
as it automates many of the tasks
that would otherwise be time-consuming and manual.
First, let's talk about discovering SQL Server instances
on the network.
One of the first steps in any SQL Server attack
is finding where the servers are.
PowerUpSQL can automate this process
using the Get-SQLInstance command.
Here's how you might use it, Get-SQLInstanceLocal -Verbose.
Running this command will scan the network
for SQL Server instances
and return a list of all of the servers that it finds.
This is your starting point
for understanding the SQL landscape
in your target environment.
Also, it's important not to waste time
trying to crack passwords
for accounts that require two-factor authentication,
such as those using smart cards.
These accounts are generally more secure
and harder to compromise.
PowerUpSQL provides a useful command
to identify these accounts within a domain.
Here's that command,
Get-SQLDomainUser -UserState SmartCardRequired.
This command will list all domain users
who are configured to require smart card authentication.
By identifying these accounts,
you can focus your efforts
on other potential vulnerabilities
instead of spending time on accounts
that have enhanced security
through two-factor authentication.
Continuing on, you'll want to check the privileges
you have on these instances.
It's common to begin with low-level access
and then try to escalate your privileges.
The Get-SQLServerInfo command
can help you gather detailed information
about a specific SQL Server instance,
including the version, users, and rows.
For example, if we were interested
in the server SQLSERVER01,
we will run the following command.
Get-SQLServerInfo -InstanceName "SQLSERVER01".
This command gives you a comprehensive overview
of the servers configuration,
which can help you identify weak points or misconfigurations
that might be exploitable.
Now, let's move on to privilege escalation.
If you found an instance
where you have some level of access,
the next step is to see if you can elevate those privileges.
PowerUpSQL includes the Invoke-SQLEscalatePriv function,
which can automate attempts
to escalate your privileges on the SQL Server.
Here's that command using SQLSERVER01 again.
Invoke-SQLEscalatePriv -Instance "SQLSERVER01" -Verbose.
This command will try various methods
to increase your privileges,
such as exploiting stored procedures
or other common vulnerabilities in SQL Servers.
Successful privilege escalation can give you access
to more data or control over the server.
Another important task you might want to automate
is a discovery of SQL Servers and a domain,
and check in if they're using default passwords.
PowerUpSQL provides the Get-ServerLoginDefaultPw command,
which allows you to find SQL Server instances in the domain
and determine if they are configured with default passwords
commonly used by applications.
Let's take a look at the following command,
Get-SQLInstanceDomain | Get-SQLServerLoginDefaultPw
Verbose.
Again, this command will first discover
the SQL Server instance within the domain
using the Get-SQLInstanceDomain command,
and then check each instance
with the Get-SQLServerLoginDefaultPw
to see if they're using default passwords,
which could indicate a security vulnerability.
If you're looking to identify accounts
that could be used for privilege escalation
or lateral movement, it's important to find those
that are trusted for delegation.
Accounts trusted for delegation
can impersonate other users,
which might allow you to access resources
or perform actions on their behalf.
PowerUpSQL provides the following command for that,
Get-SQLDomainUser -UserState TrustedForDelegation.
This command will list all domains that are configured
with a "TrustedForDelegation" setting.
By identifying these accounts,
you can target them for a potential privilege escalation
as they could allow you to gain additional access
across the network.
Now, if you're looking to perform lateral movement
or pivot to other systems,
understanding the links between the SQL Servers
can be crucial.
PowerUpSQL helps this through the Get-SQLServerLink command,
which identifies linked servers
that might allow you to move from one server to another.
Using SQLSERVER01 as an example, again,
we'll run the following command,
Get-SQLServerLink -Instance "SQLSERVER01".
This command will list any servers
linked to the one you specify,
providing you with potential new targets to explore.
By understanding these links,
you can strategize your lateral movement more effectively,
potentially gaining access to additional systems
within the network.
So, remember, PowerUpSQL is a robust tool
for automating many of the tasks
involved in attacking SQL Server instances.
By using these commands, you can efficiently discover,
assess, and exploit SQL Servers in your target environment.
This automation not only saves you time,
but also increases your chances
of finding and exploiting vulnerabilities
that might otherwise go unnoticed.