Hey there.
Welcome to Pluralsight.
I'm Ricardo.
I'm a cybersecurity specialist,
and I'll be showing you how to use the PowerUpSQL to collect
sensitive data from Microsoft SQL servers.
You may be wondering, why is Microsoft SQL such an important asset?
Why should we spend time trying to hack into it?
And the reality is, whenever in a red team engagement,
finding a Microsoft SQL Server is like finding gold.
And the reason for that is the Microsoft SQL servers usually
have a lot of insecure configurations,
such as unpatched vulnerabilities or even weak credentials.
Also, because Microsoft SQL is tied to the Windows operational system,
it is fairly easy to escalate privileges on the database,
and with that, also escalate privileges on the operational system.
And as we're talking about a database system,
it usually contains a lot of sensitive information,
such as customer data and even credentials for other systems.
So, whenever in a red team engagement and you find a Microsoft SQL Server,
you can easily get initial access to database via insecure configurations.
From there,
you can escalate your privileges and get admin access to
both database and the sever that runs it.
And with that done, you can collect sensitive information from your target.
And if you really want to simulate a malicious hacker,
you can even cause impact by deleting tables or modifying data.
All those attacks that I mentioned the previous slide can be performed manually.
But we all know that during a red team engagement we don't have time for that.
And for this reason, we have the PowerUpSQL tool.
The PowerUpSQL is a tool developed by Scott Sutherland.
He's a really famous guy on the cybersecurity community,
so you should definitely follow him.
Years ago, I found about this tool by watching one of his talks on black hat,
and since then, my life as a red team specialist became way easier.
So, thanks Scott.
The PowerUpSQL is a tool that provides several
functions such as SQL Server discovery, weak configuration,
auditing, privilege escalation, and even post exploitation.
As you see in this course,
we can use the PowerUp tool in all the phases of a red team engagement,
from reconnaissance to sensitive data collection.
What I love about this tool is that it is an open source software,
meaning that you can download the source code from
GitHub and modify it as much as you want.
Also, I love this tool because it is a full framework for Microsoft SQL auditing,
including finding SQL servers, getting initial access to the database,
escalate privileges, collect sensitive information,
and much more.
With just one tool, we can execute dozens of attacks.
And, as in this course we focus in collection,
I like PowerUpSQL because we can automate the collection of
sensitive data across several SQL servers at same time.
For example, we can find sensitive data based on regular expressions,
and we can also find credit card data stored in the database
and even dump entire tables or databases.
If you're familiar with the red team kill chain,
we can map the PowerUpSQL to pretty much all the phases of a red team
engagement, from reconnaissance to the action phase.
However,
in this course, we focus on the action phase, in which you learn how to
collect sensitive information with the PowerUpSQL.
Also, we can map this course to three areas of the MITRE ATT&CK framework,
the initial access, collection, and impact.
Instead of initial access, you see how to get valid account using PowerUpSQL.
We will use an auditing feature of the tool to find weak credentials and
use those credentials to collect sensitive information.
The collection part is the main focus of this course.
More specifically, the technique T1005, which is data from local system.
In here,
you learn how to find sensitive information inside of the
database. And we also cover the impact area. And inside of
this area, we cover two techniques.
The first one is data destruction, in which you'll learn how to delete
data from the database. And the second technique is the T1565.001,
which is manipulating stored data, in which would change the data on
the database to hide our tracks.
But it is really important to note that the majority of the clients
will not approve impact attacks on their environment.
But it's important for you to know how criminals do the
attack in case you need to simulate it.
Before getting to the technical part of this course, I want to keep
in mind that performing any of those attacks without authorization
is illegal in most of the countries. And this means that if you
enter in a computer and start collecting data without authorization,
you may go to jail.
Also, you should be really careful when performing any
attack that impacts the customer environment.
Make sure the client's okay with you performing such attacks,
and make sure you have everything formalized.
And also, it is really important to stay legal.
So first, if you're working a red team project,
make sure you have a letter of engagement from the client
detailing the dates that the test will be executed, as well
as the types of attacks in scope.
Also,
it is important to have a formal document signed by the client detailing
and authorizing the attacks that you'll be performing.
And this is a document that differentiates a criminal
from a professional red team specialist.
And as a personal recommendation,
always consult the client before executing any
attack that may impact the network.
So bottom line, don't be a criminal.
Before we jump into our demos, let's take a minute to understand
the attacks that we'll be performing here.
Imagine you're working on a red to engagement.
You already did some attacks and got inside of the client network.
Inside of this network, you found a Microsoft SQL Server.
So then, in our demos, we'll try to get into the database by looking
for insecure configurations and weak credentials.
Once we get access to the database, we'll look for sensitive data in the tables,
including credit card data and credentials stored in the database.
And after that,
we will modify some of the data in the database to hide our
tracks. And later, we'll delete some tables in the database to
cause impact on the environment. Again,
it is important to remember that the majority of the clients do
not like the idea of modifying or deleting data, so make sure
your client is okay with this kind of attack, and make sure you
get formal approval for that.
If you want to follow our labs, you need two machines.
The first one is the attacker machine.
In my case,
I will be using a Windows 10 machine since it already has
PowerShell and all the libraries installed.
But if you want, you can even use a Kali Linux machine.
You just need to install PowerShell on it, and you're good to go.
The second machine that we need is our target machine. In
here, it can be any Microsoft SQL Server.
In my case,
I'm using the Microsoft SQL Express 2012, but you
can use any version of the tool.
So, okay, enough of talking.
Let's go to our virtual machines and see how those attacks work in real life.