Hey there, welcome to a Windows 10 virtual machine. We'll be
using this computer to attack our victim SQL Server. To start
the PowerUpSQL is really simple.
First, I'm here at the PowerUpSQL GitHub page.
So let's start by downloading the source code from here.
For that, I'll click on the button Code and then clicking Dowload ZIP. Perfect.
When that finishes, I will open the file and then unzip it to my desktop.
Awesome.
As you can see, the folder is now here on my desktop.
So, as you may remember, the PowerUpSQL is based on Windows PowerShell.
So let's open the command prompt as administrator, and then navigate to the
PowerUpSQL folder, and then it starts PowerShell. Awesome. Here we are in
PowerShell. To load the PowerUp modules into the memory, let's use the command
Import‑Module and then the PowerUpSQL.psd1 file.
Oh, take a look.
We got his error here saying that is not an assigned script,
and that's a very common error.
So what I need to do is allow unassigned scripts to run. For that
I'll type Set‑ExecutionPolicy Unrestricted.
Perfect.
And now let me rerun the Import‑Module command.
Awesome.
Now that works. In here now, PowerShell is just giving a
warning about this insecure script.
But we can accept it by typing R and pressing Enter. And then
typing R again and pressing Enter again.
Perfect.
Now we have the PowerUpSQL ready to use. And to test things out,
we can use the command Get‑Command ‑Module,
and then PowerUpSQL, and this will list out the modules
from the PowerUpSQL tool. As you can see,
we have a lot of stuff in here and I do recommend you taking
some time and reviewing the tool documentation.
So then you can learn about all these features. And if you
want to get more information about a one specific module,
we can use this function, Get‑Help,
and then the name of the module you want to know more about. And
also, I do recommend using the option ‑full.
So then you can get all the information about a module.
As you can see,
the specific module scans an IP address using UDP to check if
there's a Microsoft SQL instance active in the server.
So let's use this function. I'll type Get‑SQLInstanceScanUDP and
then use the flag ‑ComputerName to specify the IP address that I
want to scan for SQL instances.
In my case, my target is 192.168.1.21. Awesome.
When I press enter this script will try to access the server via UDP
and then get more information about the database.
As you can see,
my target is a Microsoft SQL Express server version 11.0. If
you're familiar with PowerShell, what these scripts have
returned is actually an instance object,
meaning that I can reuse the output of this command into another command.
For example,
let's say I have a set of low‑level credentials and I want to get
more information about this specific server.
I can type the same comment that I used before,
but now I can pipe it into another command,
which is the Get‑SQLServerInfo.
What happens here is that the first command will create a server instance,
and then the second command will use this instance to
get more information about the server.
This command requires a set of credentials.
So I use the flag ‑Username to specify the username that I know, and then
the flag ‑Password to specify the password for the other username. In the
right to engagement, you might find low‑level credentials like this one by
brute forcing common credentials.
Or also, if you compromise the web server,
you can check the web application source code and
may find SQL credentials in there.
Once I press enter it will connect to the SQL server using these
credentials and get even more information about the server.
Take a look.
Now we can see that the server belongs to the domain called GLOBOMANTICS.
And also, you can see that this test account is not a Sysadmin account.
So we need to figure out a way to escalate our privilege to Sysadmin.
The good thing is that PowerUpSQL has tons of features for privilege escalation.
But as this is not a focus of this course,
I'll use the most common way of escalating privileges,
which is weak credentials. Here, since we have a valid set of
credentials to the database, we can query the database for all
the usernames. And then we can try to brute force those
usernames with common passwords.
And doing this manually would take a lot of effort.
But thanks to PowerUpSQL, we can do this in just one line.
Take a look, I started by using the same Get‑SQL instance
command, so I have an instance object.
Then I pipe this into a command called Invoke‑SQLAuditWeakLoginPw,
and this command requires a username and password. So we
use our low privilege test account.
Once I press enter this command will retrieve all the users from the database
and then try to brute force them with common passwords.
And, as you can see, after a few seconds,
we can see there is one user called robert that has this password set as robert.
And the best part is that this user is a Sysadmin user.
That's pretty cool, right?
So let's test those credentials. For that, I'll use the same
Get‑SQLServerInfo command that I used before,
but now with Robert's credentials. And there we go, we are
now Sysadmin. And believe it or not, this attack works in a lot of cases.
It is really common that people set a weak password in databases.
And if that's not successful for you,
check out the PowerUpSQL documentation and you find there at
least a dozen of other privilege collection techniques that
you may want to try to use.