Hey there, welcome back to our lab environment.
Now that we have a privileged account,
let's search for sensitive information in your target.
In a large company, a database server will have tons of database and end tables.
I've seen databases with more than 500 tables,
so there's no way to manually check all the data in there.
Lucky for us, we have the PowerUp tool to help us to find sensitive data.
So, I'll use this command here.
Wait, I know, it's a long command and it looks really complicated,
but let's break it down so you can understand it.
First, as we've done before,
we use the Get‑SQLInstance to get an instance object into the server.
Then, we'll pipe the result of this command to this other command,
which is Get‑SQLColumnSampleDataThreaded.
Basically,
this command will check the name of other columns in our tables to see if
the name of the column matches what we're looking for.
Also, it collects a sample of the data so we can see what we were looking for.
And, this command is threaded,
meaning that it can open parallel connections to the SQL
Server so it can find the data way faster.
Okay, so that's a command.
Let's take a look at the variables.
First, I'm enabling the Verbose mode so we can see every step of the script.
Then, I set the number of Threads to 10,
which means it will open 10 parallel connections to
the server to find sensitive data.
Then, I put that keyword that I'm looking for.
In my case,
I'm looking for columns that contain the words credit, of credit cards,
ssn, from social security numbers, and passwords.
And with this,
if any column of the table matches with those values, we'll get something.
Next, we set the SampleSize to 2 lines,
and this means that whenever we find a column with those keywords,
you select two random lines from the table.
So then, we can take a look at what type of data is in there.
Then, enable the flag called NoDefaults,
which means they will not be looking for sensitive data on
the default tables of Microsoft SQL.
And last, we provide a username and password to access the database.
That's a lot, right? But again, it's not that complicated.
Feel free to pause this video and try to understand the command.
And once you run this,
the PowerUp will search for the column names that match
with those keywords that are specified.
And if they match,
then we'll collect two samples from the table so we can analyze the data.
And here you go.
There are quite a few matches, and it is a little bit hard
to see the data in this list format.
So, let me show you a PowerShell trick here.
You can run the exact same command, just adding | Format‑Table. From a table,
and this way the data will be displayed as a table and
is way easier to see the information.
So, let's rerun this.
Then, take a look,
there are a few columns in the database that match those keywords.
First, we have the accesslogs table,
which it has a column called isvalidpassword.
And this table is in a database called HRGlobomantics,
and it belongs to the dbo schema.
And although the column name seems really interesting,
the data shows that it is just a Boolean variable
with no sensitive information there.
But, take a look in the next two tables.
This purchases table contains a column call creditcard,
which sounds really promising.
And if we take a look in the sample data,
it does look like credit card information.
That's very cool, right?
This other table, called users, also sounds promising.
It has a column called passwords, and by looking at the sample data,
it does look like user passwords,
and that can be really interesting in a red team engagement.
So, let's take notes of those table names so we can
take a look at them in more detail.
So, let's clear this screen,
and now I'll query the database to get all the data
from those tables that we just saw.
I'll use this command, Get‑SQLQuery, which executes queries in the server.
So, I start by using the flag ‑Instance to define the
IP and port of my target server.
And then, I define the username and password that I will use.
Perfect.
Then, I use the flag ‑Query,
and I put the query that I want to execute. In my case,
I want to see all the data in the table,
so I'll put Select * from HRGlobomantics,
which is the database name, .dbo, which is the name of the schema,
.users, which is the name of the table.
And this command will select all the roles from the users table.
Pretty easy, right?
So whenever we press Enter,
it will query the server and return me everything that is in the users table.
Take a look, we have passwords for some users.
That's pretty interesting, right?
If you're in red team engagement,
you can reuse those passwords in other systems to try to
move laterally in the environment.
So, let's take a look in the other table.
I'll use the exact same command, but now querying the purchases table.
Done. The data here is showing a weird format,
so let me do the same trick I've done before.
Let me execute the exact same query,
but now with a | Format‑Table at the end. Perfect,
take a look.
This definitely looks like some credit card information.
As we can see, in just a few minutes,
we're able to search the whole database and find sensitive
information that is critical to the client.