WEBVTT 00:00:01.540 --> 00:00:04.580 Hey there, welcome to a Windows 10 virtual machine. We'll be 00:00:04.580 --> 00:00:08.140 using this computer to attack our victim SQL Server. To start 00:00:08.140 --> 00:00:10.150 the PowerUpSQL is really simple. 00:00:10.840 --> 00:00:13.550 First, I'm here at the PowerUpSQL GitHub page. 00:00:14.090 --> 00:00:16.550 So let's start by downloading the source code from here. 00:00:17.100 --> 00:00:23.260 For that, I'll click on the button Code and then clicking Dowload ZIP. Perfect. 00:00:23.270 --> 00:00:27.750 When that finishes, I will open the file and then unzip it to my desktop. 00:00:30.240 --> 00:00:30.760 Awesome. 00:00:30.780 --> 00:00:33.150 As you can see, the folder is now here on my desktop. 00:00:33.840 --> 00:00:38.150 So, as you may remember, the PowerUpSQL is based on Windows PowerShell. 00:00:38.640 --> 00:00:44.030 So let's open the command prompt as administrator, and then navigate to the 00:00:44.030 --> 00:00:50.650 PowerUpSQL folder, and then it starts PowerShell. Awesome. Here we are in 00:00:50.650 --> 00:00:54.760 PowerShell. To load the PowerUp modules into the memory, let's use the command 00:00:54.900 --> 00:01:00.050 Import‑Module and then the PowerUpSQL.psd1 file. 00:01:01.700 --> 00:01:02.290 Oh, take a look. 00:01:02.300 --> 00:01:05.050 We got his error here saying that is not an assigned script, 00:01:05.489 --> 00:01:06.750 and that's a very common error. 00:01:07.200 --> 00:01:11.800 So what I need to do is allow unassigned scripts to run. For that 00:01:11.800 --> 00:01:15.950 I'll type Set‑ExecutionPolicy Unrestricted. 00:01:17.340 --> 00:01:17.820 Perfect. 00:01:17.900 --> 00:01:20.250 And now let me rerun the Import‑Module command. 00:01:21.380 --> 00:01:21.800 Awesome. 00:01:21.950 --> 00:01:25.080 Now that works. In here now, PowerShell is just giving a 00:01:25.080 --> 00:01:27.200 warning about this insecure script. 00:01:27.480 --> 00:01:32.250 But we can accept it by typing R and pressing Enter. And then 00:01:32.400 --> 00:01:34.650 typing R again and pressing Enter again. 00:01:35.690 --> 00:01:36.240 Perfect. 00:01:36.320 --> 00:01:39.950 Now we have the PowerUpSQL ready to use. And to test things out, 00:01:39.960 --> 00:01:45.650 we can use the command Get‑Command ‑Module, 00:01:46.400 --> 00:01:51.100 and then PowerUpSQL, and this will list out the modules 00:01:51.100 --> 00:01:54.020 from the PowerUpSQL tool. As you can see, 00:01:54.030 --> 00:01:57.380 we have a lot of stuff in here and I do recommend you taking 00:01:57.380 --> 00:01:59.550 some time and reviewing the tool documentation. 00:01:59.790 --> 00:02:03.130 So then you can learn about all these features. And if you 00:02:03.130 --> 00:02:05.550 want to get more information about a one specific module, 00:02:05.560 --> 00:02:07.450 we can use this function, Get‑Help, 00:02:08.009 --> 00:02:11.230 and then the name of the module you want to know more about. And 00:02:11.230 --> 00:02:14.260 also, I do recommend using the option ‑full. 00:02:14.610 --> 00:02:16.980 So then you can get all the information about a module. 00:02:18.640 --> 00:02:19.310 As you can see, 00:02:19.400 --> 00:02:23.660 the specific module scans an IP address using UDP to check if 00:02:23.660 --> 00:02:26.550 there's a Microsoft SQL instance active in the server. 00:02:27.540 --> 00:02:35.030 So let's use this function. I'll type Get‑SQLInstanceScanUDP and 00:02:35.030 --> 00:02:39.700 then use the flag ‑ComputerName to specify the IP address that I 00:02:39.700 --> 00:02:41.450 want to scan for SQL instances. 00:02:42.440 --> 00:02:50.100 In my case, my target is 192.168.1.21. Awesome. 00:02:50.110 --> 00:02:54.090 When I press enter this script will try to access the server via UDP 00:02:54.100 --> 00:02:56.390 and then get more information about the database. 00:02:57.000 --> 00:02:57.700 As you can see, 00:02:57.790 --> 00:03:04.060 my target is a Microsoft SQL Express server version 11.0. If 00:03:04.060 --> 00:03:06.160 you're familiar with PowerShell, what these scripts have 00:03:06.160 --> 00:03:08.550 returned is actually an instance object, 00:03:09.080 --> 00:03:12.650 meaning that I can reuse the output of this command into another command. 00:03:13.690 --> 00:03:14.220 For example, 00:03:14.300 --> 00:03:17.150 let's say I have a set of low‑level credentials and I want to get 00:03:17.150 --> 00:03:19.220 more information about this specific server. 00:03:19.840 --> 00:03:21.850 I can type the same comment that I used before, 00:03:22.240 --> 00:03:24.750 but now I can pipe it into another command, 00:03:25.140 --> 00:03:27.540 which is the Get‑SQLServerInfo. 00:03:28.740 --> 00:03:32.150 What happens here is that the first command will create a server instance, 00:03:32.690 --> 00:03:35.480 and then the second command will use this instance to 00:03:35.480 --> 00:03:37.050 get more information about the server. 00:03:37.990 --> 00:03:40.110 This command requires a set of credentials. 00:03:40.310 --> 00:03:45.110 So I use the flag ‑Username to specify the username that I know, and then 00:03:45.220 --> 00:03:50.410 the flag ‑Password to specify the password for the other username. In the 00:03:50.410 --> 00:03:53.640 right to engagement, you might find low‑level credentials like this one by 00:03:53.640 --> 00:03:55.250 brute forcing common credentials. 00:03:55.840 --> 00:03:57.960 Or also, if you compromise the web server, 00:03:58.030 --> 00:04:00.340 you can check the web application source code and 00:04:00.340 --> 00:04:01.950 may find SQL credentials in there. 00:04:03.130 --> 00:04:06.320 Once I press enter it will connect to the SQL server using these 00:04:06.320 --> 00:04:08.800 credentials and get even more information about the server. 00:04:09.820 --> 00:04:10.270 Take a look. 00:04:10.430 --> 00:04:13.650 Now we can see that the server belongs to the domain called GLOBOMANTICS. 00:04:14.200 --> 00:04:18.250 And also, you can see that this test account is not a Sysadmin account. 00:04:19.010 --> 00:04:22.270 So we need to figure out a way to escalate our privilege to Sysadmin. 00:04:23.040 --> 00:04:27.150 The good thing is that PowerUpSQL has tons of features for privilege escalation. 00:04:27.700 --> 00:04:29.630 But as this is not a focus of this course, 00:04:29.690 --> 00:04:32.230 I'll use the most common way of escalating privileges, 00:04:32.300 --> 00:04:36.220 which is weak credentials. Here, since we have a valid set of 00:04:36.220 --> 00:04:39.420 credentials to the database, we can query the database for all 00:04:39.420 --> 00:04:42.220 the usernames. And then we can try to brute force those 00:04:42.220 --> 00:04:44.150 usernames with common passwords. 00:04:45.040 --> 00:04:47.280 And doing this manually would take a lot of effort. 00:04:47.480 --> 00:04:50.950 But thanks to PowerUpSQL, we can do this in just one line. 00:04:51.530 --> 00:04:54.120 Take a look, I started by using the same Get‑SQL instance 00:04:54.120 --> 00:04:56.250 command, so I have an instance object. 00:04:57.040 --> 00:05:02.050 Then I pipe this into a command called Invoke‑SQLAuditWeakLoginPw, 00:05:02.640 --> 00:05:06.240 and this command requires a username and password. So we 00:05:06.240 --> 00:05:07.850 use our low privilege test account. 00:05:09.040 --> 00:05:12.730 Once I press enter this command will retrieve all the users from the database 00:05:12.740 --> 00:05:15.750 and then try to brute force them with common passwords. 00:05:17.740 --> 00:05:20.020 And, as you can see, after a few seconds, 00:05:20.030 --> 00:05:24.250 we can see there is one user called robert that has this password set as robert. 00:05:24.840 --> 00:05:27.870 And the best part is that this user is a Sysadmin user. 00:05:28.680 --> 00:05:29.570 That's pretty cool, right? 00:05:29.860 --> 00:05:33.330 So let's test those credentials. For that, I'll use the same 00:05:33.330 --> 00:05:35.750 Get‑SQLServerInfo command that I used before, 00:05:36.140 --> 00:05:41.810 but now with Robert's credentials. And there we go, we are 00:05:41.810 --> 00:05:46.320 now Sysadmin. And believe it or not, this attack works in a lot of cases. 00:05:46.420 --> 00:05:49.350 It is really common that people set a weak password in databases. 00:05:49.770 --> 00:05:51.300 And if that's not successful for you, 00:05:51.480 --> 00:05:54.600 check out the PowerUpSQL documentation and you find there at 00:05:54.600 --> 00:05:56.790 least a dozen of other privilege collection techniques that 00:05:56.790 --> 00:05:57.750 you may want to try to use.