Everything you should already know about MS-SQL post-exploitation

ATTACK RESEARCH
ADVANCED COMPUTER SECURITY
RESEARCH & CONSULTING

MS-SQL Post Exploitation:
Everything you should already know.
Presented By: Rob Beck

Name: Rob Beck (whitey)
Title: Director of Assessment
Contact: rob.beck@attackresearch.com
Background:
Career pen-tester (MS/@stake/Honeywell/AR)
Security hobbyist and researcher
Slacker
All About Me
1
Copyright ©2011 Attack Research - 107 Central Park Square #110, Los Alamos, New Mexico 87544 - Tel: (505) 750-3007 - Email: info@attackresearch.com

What Is SQL Post-Exploitation?
The steps taken by an attacker following successful SQL access or command execution.
Motivation or purpose
Level of access achieved
Amount of stealth required
Persistence
2

Why MS-SQL Post Exploitation?
Most pen-test resources lack details
The explanations given are limited
Extended functionality not covered
Lots of don’ts without reason in hardening docs
People still aren’t using this stuff or get stuck
Apparently it was interesting enough for you
3

Nothing covered in this presentation is new
Everything presented is actively being used
Everything presented can be prevented
This talk assumes you have SQL access
MS-SQL is a subject of interest, not expertise
The subject is databases, which is boring
Pro-tip: You might be bored
4

What’s Covered
Utilizing SQL procedures to attack the host
Lesser known evils (some don’ts explained)
Credential harvesting scenario
Potential for using the DB in attacks
Persistence tricks
5

If you have DBO/sa you win! (There’s more to it)
Owning the host or just the DB
Persistence
If you don’t have DBO/sa it could be research time
Stored procedures
Extended stored procedures
Assemblies
Good old fashioned exploits
Sometimes it’s just about the data
I Have Access Now What?
6

What’s Really Important
Getting xp_cmdshell() – Do you need it?
Adding accounts - Not too stealthy
Total capabilities in the SQL instance
Blind injection: not always so blind
Network access to/from SQL instance
Validity of SQL credentials elsewhere
Things to Consider
7

Lessons Learned
Over the past year: 30 assessments
20 of them were successful due to SQL
0 of them detected anything wrong
All of them neglected to restrict access
3 of them had blank sa account instances
Only 5 of them had plans to upgrade to SQL 2k8
Development environments were always BAD
8

Large numbers of organizations are still running SQL as NT AUTHORITYSYSTEM
If it’s not local system, it’s most likely still admin
If it’s a domain account
Used elsewhere
Still likely to be system admin
Of the small percentage who aren’t local system or admin
Few if any additional hardening steps are being taken
Shared accounts on hosts that were using privileged accounts
People Are Still Running SQL As System
9

A majority of SQL instances that exist are legacy and will be for some time
Everything is vanilla
Shared accounts are a certainty
Logging is performed, but never observed
Lack of access is usually a by-product
Reality
10

People are lazy
Nobody has the resources
The people who make the rules
Good enough is better than best
Why Are Things Broken
11

Extended Stored Procedures - The Hidden Usage
The other fun extended stored procedures:
xp_dirtree*
xp_enumdsn
xp_enumerrorlogs
xp_enumgroups
xp_fileexist*
xp_fixeddrives
xp_getnetname
xp_subdirs*
xp_regdeletekey
xp_regdeletevalue
xp_regread
xp_regwrite
xp_dirtree
xp_enumdsn
xp_enumerrorlogs
xp_enumgroups
xp_fileexist
xp_fixeddrives
xp_getnetname
xp_subdirs
xp_regdeletekey
xp_regdeletevalue
xp_regread
xp_regwrite
xp_dirtree*
xp_enumdsn
xp_enumerrorlogs
xp_enumgroups
xp_fileexist**
xp_fixeddrives
* Can specify a UNC path
* Still around in SQL 2k8
sp_addextendedproc*
xp_cmdshell
sp_OACreate
12

Check That Advanced Options Are Enabled
If it doesn’t execute, it might need some help.
Each of these may require a call to sp_configure*:
xp_cmdshell
Procedure Name
Configuration Option Name
xp_cmdshell
sp_OACreate
xp_sendmail
Ole Automation Procedures
SQL Mail XPs
* A query of ‘UPDATE sys.configurations [..]’ also does the trick
13

xp_cmdshell Isn’t The Only Command Shell
Commands can be executed by means of sp_OACreate the sp_OAMethod procedures:
Used for OLE Automation
Access to the Wscript object (command execution)
Doesn’t require the creation of additional procedures
Caveats:
Limited to sysadmin role by default
Results aren’t always as easy to get as xp_cmdshell
Even if procedure access is allowed, object access might not be
14

You Don’t Have To Script A File Read
If sp_OACreate and the Scripting.FileSystemObject is nice, but it’s a bit much for just reading the contents of a file.
A bulk insert will usually get the job done.
15

Credential Harvesting From SQL
Creating accounts is useful, but not too stealthy..
Accounts already exist on the host
Tokens most likely exist on the host (incognito)
Using existing accounts is a lot less noticeable
..all of the usual host-based tricks are open to SQL
SYSTEM is still SYSTEM
Administrator can still become SYSTEM
You can still operate as the SQL account
16

Some Things Require Finesse
..there are limitations even to the ex-sprocs.
17

Some Things Require More Finesse
Wscript’sRegRead would be a good choice, but..
..though not all failures are a bad thing (not for us).
18

Forget Finesse, Go With What You Known
Finally.
19

The OA Methods – Not Just For Wscript
The OA methods are for OLE Automation, not Wscript automation; any OLE object the SQL server context has access to can be utilized.
System configuration information
(Shell.LocalMachine)
Windows firewall configuration
(HNetCfg.FwMgr)
(HNetCfg.NATUPnP)
Fun things like UPnP mappings
Any custom registered component
20

Why Not Register Your Own
If you can execute commands and have elevated access, why not use your own controls?
-- RegSrv32.exe /c <your OLE DLL/OCX>
21

SQL Methods For Compiled Code
SQL provides a number of facilities for running compiled code:
Extended stored procedures
Assemblies
OLE Automation
Standard console access
22

File Locations Can Be Fun
SQL Recognizes Standard File Paths:
UNC shares are valid paths in the creation of extended stored procedures and assemblies.
Alternate streams work just fine.
23

The SQL As An Attack Framework
Depending on the level of access, SQL makes a great attack platform
Loading of compiled code modules
Local files
Network shares
Execution of scripting resources
Facilitates the storage of results (go figure)
No one ever expects the SQL instance!
24

Where To Go From Here
Silly Persistence Tricks – The dumb stuff usually works best.
Triggers
Guest account
Spiking the Model database
ALWAYS dump the SQL passwords
Data copying and backup permissioning
25

Questions?
26

Everything you should already know about MS-SQL post-exploitation

by SOURCE Conference on Jun 16, 2011

Accessibility

Categories

Upload Details

Usage Rights

Statistics

Everything you should already know about MS-SQL post-exploitation — Presentation Transcript