Attacking MSSQL

Microsoft SQL server is a popular Relational Database Management System (RDBMS). In this article we will be looking at some ways of attacking SQL Server 2022, including;

• Identifying MSSQL Listeners
• Brute Force Attacks
• Data Extraction
• SQL Roles
• Database Privilege Escalation: Impersonation
• Database Privilege Escalation: db_ddladmin Abuse
• Database Privilege Escalation: xp_dirtree
• Command Execution
• Linked Server Exploitation

---

Identifying MSSQL Listeners

By default, MSSQL will not listen for network traffic. Enable this using the Sql Server Configuration Manager;

You can then use NMap to identify the server on the network;

---

Brute Force Attacks

SQL Server supports two types of authentication, Windows Authentication, and SQL Server authentication. You can configure this using SQL Server Management Studio.

SQL Server authentication provides only one account by default, the SA (System Administrator) account, which is disabled. You can reactivate it and set a password using the following SQL query.

You can bruteforce SQL Server accounts with CrackMapExec by using the local-auth flag.

Data Extraction

Databases may contain useful information to perform further attacks, such as credentials. As such, it’s worth examining the contents of the database.

---

SQL Roles

The following roles apply server-wide and link to logins.

Role	Description
sysadmin	Can perform any action on the server
serveradmin	Can change system wide configuration options and shut down the server
securityadmin	Can manage logins and their properties
processadmin	Can end running processes
setupadmin	Can add and remove linked servers
bulkadmin	Can execute the BULK INSERT statement
diskadmin	Can manage disk files
dbcreator	Can create, alter or drop any database
public	Every SQL login is a member of this role

By default, the SA account is a member of the sysadmin role. All other accounts will be members of the public role.

In addition to server roles, there are additional database specific roles. These allow granular access control to databases;

Role	Description
db_owner	Can perform all configuration and maintenance tasks on a database
db_securityadmin	Can modify role membership for custom roles and manage permissions
db_accessadmin	Can add or remember access to the database
db_backupoperator	Can backup the database
db_ddladmin	Can run Data Definition Language commands
db_datawriter	Can add, delete or change data
db_datareader	Can read all data from the user tables
db_denydatawriter	Members cannot write any data to the database
db_denydatareader	Members cannot read any data in the database

---

Database Privilege Escalation: Impersonation

SQL server support impersonation, where one account can execute commands in the context of another. The following SQL statement allows Zelda to execute commands on behalf of the SA user;

Using impacket-mssql, we can connect to the database as Zelda, then impersonate the SA account;

---

Database Privilege Escalation: db_ddladmin Abuse

The sp_syspolicy_purge_history stored procedure can be altered by users with the db_ddladmin database role. If we have with role on the MSDB database, this can be used to escalate privileges.

First, create a login link:

Add login link to the db_ddladmin role:

When an adversary logs into the server using this account, we can see we are not a member of the sysadmin role;

You issue the following SQL statements to modify the stored procedure and add link as a member of the sysadmin group. Although this provides a warning, it will complete.

The stored procedure will execute once per day. After it executes, the login link becomes a sysadmin.

Database Privilege Escalation: xp_dirtree

xp_dirtree is a stored procedure that allows you to query the filesystem. By pointing it at a UNC path running responder.py, we can capture the Net-NTLM hash of the service account.

In this instance, the service is running as local system (which we won’t be able to crack) although an administrator may have set it to use another account.

---

Command Execution

To execute operating system commands on SQL server, we can use the xp_cmdshell stored procedure. We can enable this with impacket using the enable_xp_cmdshell command.

---

Host Privilege Escalation

The SQL service account by default has SeImpersonatePrivilege enabled.

Because of this, we can use GodPotato to elevate our level of access to SYSTEM.

---

Linked Server Exploitation

MSSQL supports a feature called Linked Servers. Essentially the MSSQL database is configured to connect to remote databases running on other systems. This allows you to execute a query against one host, but the data to be retrieved from multiple systems.

If linked servers are configured, and attacker may be able to exploit this feature to move laterally between different database systems.

To configure a linked server, in SQL Management Studio, select SERVER1 > Linked Servers > Right click and select new Linked Server.

On the general tab, set the data source to the target SQL server hostname.

In the security tab, set the user account used to login to the remote server.

Ensure RPC and RPC out is enabled in the server options.

impacket-mssql can be used to determine server links in place, and execute commands on the remote SQL server:

This can also be done manually using the following SQL commands:

---

In Conclusion

This article covers the basics of assessing the security of an MSSQL server using impacket-mssql. There are a number of other useful tools which can also be used to perform MSSQL security audits, including;

• https://github.com/NetSPI/PowerUpSQL
• https://github.com/quentinhardy/msdat