Now as you progress through your penetration testing phases,
you will also look for SQL databases.
So as we've learned that we can use PowerShell for a number of
different attacks within a Windows environment,
but what about using PowerShell for SQL attacks?
Well, that is also possible,
and that can be done by using a really awesome module called PowerUpSQL.
PowerUpSQL contains functions that support SQL Server discovery,
auditing, and these audits look for common weak configurations.
You can also use it for privilege escalation,
data discovery, and more, so let's look at a few examples of using the tool.
Now the tool would need to be downloaded from GitHub,
and you would need to import the module as you would
usually import a module within PowerShell.
The first command that I'm going to look at is the Get‑SQLInstanceLocal.
This command will actually look for any type of local SQL
Server instances on the local machine.
Now in this case, this machine has a local SQL Server,
so now we have a target SQL Server.
But what if I wanted to search for this across the domain?
That is also possible because PowerUpSQL has modules that work with
local SQL instances and domain SQL instances.
So using the same command as before, but this time changing Local to domain,
we are able to query the domain for any SQL Servers,
and you can see from the results, we get the same PC.
So now that we've discovered the SQL Server,
let's look at information about the server itself,
and to do that, I'm going to use the command Get‑SQLServerInfo.
This is going to go out and fetch information about the server.
Here we can see the ComputerName, the Instance,
we can see the ServiceAccount that's being used,
and the SQLServerVersion that is currently installed.
Now this is a good way for us to go and look for further exploits
that we could use on this specific version.
So as we move on,
you would have probably in your penetration testing phase conducted a port scan.
This port scan would have returned computers that are running SQL Servers.
Now you could also make use of PowerUpSQL to actually go and scan
those computers by defining the IP address.
Now, I've got a document where I've just put in two IP addresses,
and I can use that document in conjunction with the
Get‑SQLInstanceScanUDP function.
Here we can see that it did a simple port scan and it has returned back
which of those IP addresses currently are running SQL.
And we can see that this is the same machine which we have seen before.
So now let's move on to the information discovery.
I'm going to use the command Get‑SQLColumnSampleDataThreaded,
defining the number of threads,
and I'm going to be looking for a specific keyword.
In my case,
I am interested in any SQL column that contains the keyword of password.
So taking a look at the results,
we get information about the different databases,
we can see which ones of these are password protected,
and more importantly, we get the actual data from one of the tables,
and here we find an interesting password.
Now PowerUpSQL can also be used to perform different types of commands.
For example, if I make use of the Invoke‑SQLOSCmd,
I can define the command that I would like to run,
and then when I hit Enter, this will actually go and run this command.
Now there are a couple of checks that it looks for
because it checks if you are part of the sysadmins group
or if the xpcmd shell is enabled.
In this case, the user meets that criteria,
hence the command is able to execute.
Now let's take a look at the auditing capabilities of PowerUpSQL.
The first command that I would use is the Invoke‑SQLAudit.
Now this command will go and run a couple of audit checks
and it will return back information to me.
Taking a look at the results,
we can see that this SQL Server has a number of vulnerabilities,
and these relate to excessive privileges.
PowerUpSQL goes one step further and gives you a
description about the vulnerability.
It also tells you if the server is vulnerable and exploitable and then also
provides you with references on the specific exploit.
So as I scroll through the results,
we see that they are all related to excessive privileges.
So this is a good way that you can leverage PowerUpSQL to
immediately check for any vulnerabilities that you can exploit on
the targeted SQL Server. Another great command that you could work
with is the Invoke‑SQLDumpInfo.
This command will actually go out, query the SQL Server,
and dump information from that server.
Now just keep in mind that this will dump this information as CSV
files in the directory that you're currently working in. As the
command is completed, let's take a look at the results. Within the C
directory, which is where I've executed this command, I have a list
of all of the CSV files.
These CSV files contain a lot of great information.
For example, if I take a look at the database privileges,
I can see all of the privileges that exist on the various databases.
Looking at the database tables will give me a good indication of
the type of data that exists within the SQL database, and looking
at the database columns, this will show me the various columns that
exist within the database.
So for example,
here, these two look pretty interesting because this shows me a
Globoticket‑Forest Admin account and a Globomantics‑Robocopy
account, which I could probably use.
So this concludes this video. Here we have learned that making
use of PowerUpSQL can be really beneficial and aid us in
obtaining more information about SQL Servers.