WEBVTT

00:00:01.540 --> 00:00:02.020
Hey there.

00:00:02.029 --> 00:00:03.220
Welcome to Pluralsight.

00:00:03.230 --> 00:00:03.990
I'm Ricardo.

00:00:04.000 --> 00:00:05.370
I'm a cybersecurity specialist,

00:00:05.380 --> 00:00:08.890
and I'll be showing you how to use the PowerUpSQL to collect

00:00:08.890 --> 00:00:11.350
sensitive data from Microsoft SQL servers.

00:00:12.840 --> 00:00:16.770
You may be wondering, why is Microsoft SQL such an important asset?

00:00:17.140 --> 00:00:19.060
Why should we spend time trying to hack into it?

00:00:19.740 --> 00:00:22.350
And the reality is, whenever in a red team engagement,

00:00:22.380 --> 00:00:25.350
finding a Microsoft SQL Server is like finding gold.

00:00:25.350 --> 00:00:29.260
And the reason for that is the Microsoft SQL servers usually

00:00:29.260 --> 00:00:31.170
have a lot of insecure configurations,

00:00:31.250 --> 00:00:34.350
such as unpatched vulnerabilities or even weak credentials.

00:00:35.440 --> 00:00:39.550
Also, because Microsoft SQL is tied to the Windows operational system,

00:00:39.560 --> 00:00:42.530
it is fairly easy to escalate privileges on the database,

00:00:42.540 --> 00:00:45.970
and with that, also escalate privileges on the operational system.

00:00:46.740 --> 00:00:49.100
And as we're talking about a database system,

00:00:49.110 --> 00:00:51.590
it usually contains a lot of sensitive information,

00:00:51.600 --> 00:00:54.960
such as customer data and even credentials for other systems.

00:00:55.640 --> 00:00:59.420
So, whenever in a red team engagement and you find a Microsoft SQL Server,

00:00:59.430 --> 00:01:03.560
you can easily get initial access to database via insecure configurations.

00:01:04.440 --> 00:01:05.000
From there,

00:01:05.010 --> 00:01:07.700
you can escalate your privileges and get admin access to

00:01:07.700 --> 00:01:10.170
both database and the sever that runs it.

00:01:10.840 --> 00:01:14.050
And with that done, you can collect sensitive information from your target.

00:01:14.940 --> 00:01:17.490
And if you really want to simulate a malicious hacker,

00:01:17.500 --> 00:01:21.270
you can even cause impact by deleting tables or modifying data.

00:01:23.340 --> 00:01:26.550
All those attacks that I mentioned the previous slide can be performed manually.

00:01:26.940 --> 00:01:30.360
But we all know that during a red team engagement we don't have time for that.

00:01:30.840 --> 00:01:33.660
And for this reason, we have the PowerUpSQL tool.

00:01:35.040 --> 00:01:38.370
The PowerUpSQL is a tool developed by Scott Sutherland.

00:01:38.940 --> 00:01:41.320
He's a really famous guy on the cybersecurity community,

00:01:41.340 --> 00:01:42.960
so you should definitely follow him.

00:01:43.640 --> 00:01:47.810
Years ago, I found about this tool by watching one of his talks on black hat,

00:01:47.860 --> 00:01:51.050
and since then, my life as a red team specialist became way easier.

00:01:51.440 --> 00:01:52.460
So, thanks Scott.

00:01:53.240 --> 00:01:55.750
The PowerUpSQL is a tool that provides several

00:01:55.750 --> 00:01:59.020
functions such as SQL Server discovery, weak configuration,

00:01:59.030 --> 00:02:02.150
auditing, privilege escalation, and even post exploitation.

00:02:03.040 --> 00:02:03.920
As you see in this course,

00:02:03.920 --> 00:02:07.160
we can use the PowerUp tool in all the phases of a red team engagement,

00:02:07.250 --> 00:02:09.669
from reconnaissance to sensitive data collection.

00:02:12.140 --> 00:02:14.930
What I love about this tool is that it is an open source software,

00:02:14.940 --> 00:02:16.740
meaning that you can download the source code from

00:02:16.740 --> 00:02:19.160
GitHub and modify it as much as you want.

00:02:19.740 --> 00:02:24.540
Also, I love this tool because it is a full framework for Microsoft SQL auditing,

00:02:24.550 --> 00:02:28.440
including finding SQL servers, getting initial access to the database,

00:02:28.450 --> 00:02:31.080
escalate privileges, collect sensitive information,

00:02:31.090 --> 00:02:31.850
and much more.

00:02:31.850 --> 00:02:35.550
With just one tool, we can execute dozens of attacks.

00:02:36.740 --> 00:02:39.060
And, as in this course we focus in collection,

00:02:39.070 --> 00:02:42.410
I like PowerUpSQL because we can automate the collection of

00:02:42.410 --> 00:02:45.650
sensitive data across several SQL servers at same time.

00:02:46.340 --> 00:02:49.850
For example, we can find sensitive data based on regular expressions,

00:02:50.340 --> 00:02:53.160
and we can also find credit card data stored in the database

00:02:53.470 --> 00:02:55.770
and even dump entire tables or databases.

00:02:57.840 --> 00:03:00.050
If you're familiar with the red team kill chain,

00:03:00.050 --> 00:03:04.090
we can map the PowerUpSQL to pretty much all the phases of a red team

00:03:04.090 --> 00:03:06.660
engagement, from reconnaissance to the action phase.

00:03:07.540 --> 00:03:08.140
However,

00:03:08.150 --> 00:03:12.110
in this course, we focus on the action phase, in which you learn how to

00:03:12.110 --> 00:03:15.070
collect sensitive information with the PowerUpSQL.

00:03:17.440 --> 00:03:21.550
Also, we can map this course to three areas of the MITRE ATT&CK framework,

00:03:22.040 --> 00:03:25.250
the initial access, collection, and impact.

00:03:26.140 --> 00:03:31.060
Instead of initial access, you see how to get valid account using PowerUpSQL.

00:03:31.740 --> 00:03:35.580
We will use an auditing feature of the tool to find weak credentials and

00:03:35.580 --> 00:03:37.950
use those credentials to collect sensitive information.

00:03:39.340 --> 00:03:42.000
The collection part is the main focus of this course.

00:03:42.100 --> 00:03:47.350
More specifically, the technique T1005, which is data from local system.

00:03:47.830 --> 00:03:48.320
In here,

00:03:48.330 --> 00:03:50.890
you learn how to find sensitive information inside of the

00:03:50.890 --> 00:03:56.320
database. And we also cover the impact area. And inside of

00:03:56.320 --> 00:03:58.210
this area, we cover two techniques.

00:03:58.330 --> 00:04:01.880
The first one is data destruction, in which you'll learn how to delete

00:04:01.880 --> 00:04:09.130
data from the database. And the second technique is the T1565.001,

00:04:09.140 --> 00:04:13.360
which is manipulating stored data, in which would change the data on

00:04:13.360 --> 00:04:15.270
the database to hide our tracks.

00:04:16.240 --> 00:04:19.300
But it is really important to note that the majority of the clients

00:04:19.310 --> 00:04:21.850
will not approve impact attacks on their environment.

00:04:22.240 --> 00:04:24.590
But it's important for you to know how criminals do the

00:04:24.590 --> 00:04:26.470
attack in case you need to simulate it.

00:04:28.340 --> 00:04:31.060
Before getting to the technical part of this course, I want to keep

00:04:31.060 --> 00:04:34.380
in mind that performing any of those attacks without authorization

00:04:34.390 --> 00:04:37.590
is illegal in most of the countries. And this means that if you

00:04:37.600 --> 00:04:40.530
enter in a computer and start collecting data without authorization,

00:04:40.530 --> 00:04:42.060
you may go to jail.

00:04:42.740 --> 00:04:45.180
Also, you should be really careful when performing any

00:04:45.180 --> 00:04:47.420
attack that impacts the customer environment.

00:04:47.430 --> 00:04:50.660
Make sure the client's okay with you performing such attacks,

00:04:50.670 --> 00:04:52.760
and make sure you have everything formalized.

00:04:53.540 --> 00:04:55.850
And also, it is really important to stay legal.

00:04:56.440 --> 00:04:58.750
So first, if you're working a red team project,

00:04:58.760 --> 00:05:01.220
make sure you have a letter of engagement from the client

00:05:01.220 --> 00:05:04.020
detailing the dates that the test will be executed, as well

00:05:04.020 --> 00:05:05.770
as the types of attacks in scope.

00:05:06.740 --> 00:05:07.130
Also,

00:05:07.140 --> 00:05:10.790
it is important to have a formal document signed by the client detailing

00:05:10.790 --> 00:05:12.770
and authorizing the attacks that you'll be performing.

00:05:13.240 --> 00:05:15.620
And this is a document that differentiates a criminal

00:05:15.630 --> 00:05:17.350
from a professional red team specialist.

00:05:18.340 --> 00:05:20.020
And as a personal recommendation,

00:05:20.030 --> 00:05:22.640
always consult the client before executing any

00:05:22.640 --> 00:05:24.160
attack that may impact the network.

00:05:24.840 --> 00:05:27.060
So bottom line, don't be a criminal.

00:05:28.740 --> 00:05:31.730
Before we jump into our demos, let's take a minute to understand

00:05:31.730 --> 00:05:33.360
the attacks that we'll be performing here.

00:05:34.440 --> 00:05:36.360
Imagine you're working on a red to engagement.

00:05:36.660 --> 00:05:39.660
You already did some attacks and got inside of the client network.

00:05:40.340 --> 00:05:43.460
Inside of this network, you found a Microsoft SQL Server.

00:05:44.240 --> 00:05:47.620
So then, in our demos, we'll try to get into the database by looking

00:05:47.620 --> 00:05:50.060
for insecure configurations and weak credentials.

00:05:50.940 --> 00:05:54.280
Once we get access to the database, we'll look for sensitive data in the tables,

00:05:54.290 --> 00:05:57.660
including credit card data and credentials stored in the database.

00:05:58.440 --> 00:05:59.220
And after that,

00:05:59.230 --> 00:06:02.030
we will modify some of the data in the database to hide our

00:06:02.030 --> 00:06:05.660
tracks. And later, we'll delete some tables in the database to

00:06:05.660 --> 00:06:08.360
cause impact on the environment. Again,

00:06:08.370 --> 00:06:10.920
it is important to remember that the majority of the clients do

00:06:10.920 --> 00:06:14.390
not like the idea of modifying or deleting data, so make sure

00:06:14.390 --> 00:06:16.810
your client is okay with this kind of attack, and make sure you

00:06:16.810 --> 00:06:18.050
get formal approval for that.

00:06:20.040 --> 00:06:22.650
If you want to follow our labs, you need two machines.

00:06:23.140 --> 00:06:25.150
The first one is the attacker machine.

00:06:25.540 --> 00:06:26.240
In my case,

00:06:26.250 --> 00:06:28.770
I will be using a Windows 10 machine since it already has

00:06:28.770 --> 00:06:30.850
PowerShell and all the libraries installed.

00:06:31.340 --> 00:06:33.930
But if you want, you can even use a Kali Linux machine.

00:06:34.020 --> 00:06:36.860
You just need to install PowerShell on it, and you're good to go.

00:06:37.940 --> 00:06:41.000
The second machine that we need is our target machine. In

00:06:41.000 --> 00:06:43.750
here, it can be any Microsoft SQL Server.

00:06:44.240 --> 00:06:44.910
In my case,

00:06:44.920 --> 00:06:48.140
I'm using the Microsoft SQL Express 2012, but you

00:06:48.140 --> 00:06:49.460
can use any version of the tool.

00:06:50.540 --> 00:06:51.970
So, okay, enough of talking.

00:06:51.980 --> 00:06:55.850
Let's go to our virtual machines and see how those attacks work in real life.