WEBVTT 00:00:01.740 --> 00:00:03.870 Hey there, welcome back to our lab environment. 00:00:04.170 --> 00:00:05.780 Now that we have a privileged account, 00:00:05.910 --> 00:00:08.550 let's search for sensitive information in your target. 00:00:09.400 --> 00:00:13.250 In a large company, a database server will have tons of database and end tables. 00:00:13.790 --> 00:00:16.360 I've seen databases with more than 500 tables, 00:00:16.490 --> 00:00:19.050 so there's no way to manually check all the data in there. 00:00:19.740 --> 00:00:23.150 Lucky for us, we have the PowerUp tool to help us to find sensitive data. 00:00:23.700 --> 00:00:25.620 So, I'll use this command here. 00:00:25.620 --> 00:00:28.890 Wait, I know, it's a long command and it looks really complicated, 00:00:29.020 --> 00:00:31.450 but let's break it down so you can understand it. 00:00:32.340 --> 00:00:33.730 First, as we've done before, 00:00:33.740 --> 00:00:38.050 we use the Get‑SQLInstance to get an instance object into the server. 00:00:38.570 --> 00:00:41.780 Then, we'll pipe the result of this command to this other command, 00:00:41.980 --> 00:00:45.650 which is Get‑SQLColumnSampleDataThreaded. 00:00:46.440 --> 00:00:46.960 Basically, 00:00:47.070 --> 00:00:51.280 this command will check the name of other columns in our tables to see if 00:00:51.280 --> 00:00:53.850 the name of the column matches what we're looking for. 00:00:54.840 --> 00:00:58.550 Also, it collects a sample of the data so we can see what we were looking for. 00:00:59.140 --> 00:01:00.670 And, this command is threaded, 00:01:00.670 --> 00:01:03.300 meaning that it can open parallel connections to the SQL 00:01:03.300 --> 00:01:05.480 Server so it can find the data way faster. 00:01:06.740 --> 00:01:08.110 Okay, so that's a command. 00:01:08.330 --> 00:01:09.650 Let's take a look at the variables. 00:01:10.440 --> 00:01:15.150 First, I'm enabling the Verbose mode so we can see every step of the script. 00:01:16.140 --> 00:01:18.240 Then, I set the number of Threads to 10, 00:01:18.500 --> 00:01:20.910 which means it will open 10 parallel connections to 00:01:20.910 --> 00:01:22.550 the server to find sensitive data. 00:01:23.770 --> 00:01:25.950 Then, I put that keyword that I'm looking for. 00:01:26.540 --> 00:01:27.280 In my case, 00:01:27.290 --> 00:01:31.270 I'm looking for columns that contain the words credit, of credit cards, 00:01:31.540 --> 00:01:34.950 ssn, from social security numbers, and passwords. 00:01:36.000 --> 00:01:36.700 And with this, 00:01:36.770 --> 00:01:40.380 if any column of the table matches with those values, we'll get something. 00:01:41.880 --> 00:01:44.290 Next, we set the SampleSize to 2 lines, 00:01:44.630 --> 00:01:48.170 and this means that whenever we find a column with those keywords, 00:01:48.280 --> 00:01:50.240 you select two random lines from the table. 00:01:50.430 --> 00:01:52.990 So then, we can take a look at what type of data is in there. 00:01:53.840 --> 00:01:56.440 Then, enable the flag called NoDefaults, 00:01:56.510 --> 00:01:58.960 which means they will not be looking for sensitive data on 00:01:58.960 --> 00:02:01.550 the default tables of Microsoft SQL. 00:02:01.550 --> 00:02:06.120 And last, we provide a username and password to access the database. 00:02:06.940 --> 00:02:09.490 That's a lot, right? But again, it's not that complicated. 00:02:09.699 --> 00:02:12.200 Feel free to pause this video and try to understand the command. 00:02:13.020 --> 00:02:14.330 And once you run this, 00:02:14.450 --> 00:02:17.190 the PowerUp will search for the column names that match 00:02:17.190 --> 00:02:18.890 with those keywords that are specified. 00:02:19.340 --> 00:02:20.070 And if they match, 00:02:20.220 --> 00:02:23.610 then we'll collect two samples from the table so we can analyze the data. 00:02:24.840 --> 00:02:26.250 And here you go. 00:02:26.710 --> 00:02:29.060 There are quite a few matches, and it is a little bit hard 00:02:29.060 --> 00:02:30.680 to see the data in this list format. 00:02:31.030 --> 00:02:33.350 So, let me show you a PowerShell trick here. 00:02:33.970 --> 00:02:38.440 You can run the exact same command, just adding | Format‑Table. From a table, 00:02:38.440 --> 00:02:42.110 and this way the data will be displayed as a table and 00:02:42.110 --> 00:02:43.750 is way easier to see the information. 00:02:44.440 --> 00:02:45.750 So, let's rerun this. 00:02:48.610 --> 00:02:49.390 Then, take a look, 00:02:49.500 --> 00:02:52.450 there are a few columns in the database that match those keywords. 00:02:53.140 --> 00:02:55.290 First, we have the accesslogs table, 00:02:55.300 --> 00:02:58.050 which it has a column called isvalidpassword. 00:02:58.870 --> 00:03:02.010 And this table is in a database called HRGlobomantics, 00:03:02.540 --> 00:03:05.050 and it belongs to the dbo schema. 00:03:05.840 --> 00:03:08.050 And although the column name seems really interesting, 00:03:08.210 --> 00:03:10.690 the data shows that it is just a Boolean variable 00:03:10.700 --> 00:03:12.150 with no sensitive information there. 00:03:12.840 --> 00:03:14.860 But, take a look in the next two tables. 00:03:15.110 --> 00:03:18.070 This purchases table contains a column call creditcard, 00:03:18.230 --> 00:03:19.510 which sounds really promising. 00:03:20.030 --> 00:03:21.900 And if we take a look in the sample data, 00:03:22.080 --> 00:03:23.850 it does look like credit card information. 00:03:24.340 --> 00:03:25.250 That's very cool, right? 00:03:25.810 --> 00:03:28.850 This other table, called users, also sounds promising. 00:03:29.340 --> 00:03:32.680 It has a column called passwords, and by looking at the sample data, 00:03:32.800 --> 00:03:34.380 it does look like user passwords, 00:03:34.700 --> 00:03:36.650 and that can be really interesting in a red team engagement. 00:03:37.640 --> 00:03:40.320 So, let's take notes of those table names so we can 00:03:40.320 --> 00:03:41.750 take a look at them in more detail. 00:03:42.990 --> 00:03:44.270 So, let's clear this screen, 00:03:44.740 --> 00:03:47.510 and now I'll query the database to get all the data 00:03:47.520 --> 00:03:49.150 from those tables that we just saw. 00:03:49.930 --> 00:03:54.450 I'll use this command, Get‑SQLQuery, which executes queries in the server. 00:03:54.940 --> 00:03:57.860 So, I start by using the flag ‑Instance to define the 00:03:57.870 --> 00:03:59.850 IP and port of my target server. 00:04:00.830 --> 00:04:03.650 And then, I define the username and password that I will use. 00:04:06.440 --> 00:04:07.010 Perfect. 00:04:07.090 --> 00:04:08.880 Then, I use the flag ‑Query, 00:04:09.220 --> 00:04:12.240 and I put the query that I want to execute. In my case, 00:04:12.270 --> 00:04:14.180 I want to see all the data in the table, 00:04:14.460 --> 00:04:18.430 so I'll put Select * from HRGlobomantics, 00:04:19.470 --> 00:04:24.760 which is the database name, .dbo, which is the name of the schema, 00:04:24.760 --> 00:04:27.280 .users, which is the name of the table. 00:04:28.540 --> 00:04:31.300 And this command will select all the roles from the users table. 00:04:31.840 --> 00:04:32.580 Pretty easy, right? 00:04:33.140 --> 00:04:34.290 So whenever we press Enter, 00:04:34.290 --> 00:04:37.890 it will query the server and return me everything that is in the users table. 00:04:39.350 --> 00:04:41.270 Take a look, we have passwords for some users. 00:04:41.340 --> 00:04:42.410 That's pretty interesting, right? 00:04:42.700 --> 00:04:43.870 If you're in red team engagement, 00:04:43.920 --> 00:04:46.540 you can reuse those passwords in other systems to try to 00:04:46.540 --> 00:04:47.950 move laterally in the environment. 00:04:48.740 --> 00:04:50.550 So, let's take a look in the other table. 00:04:51.240 --> 00:04:55.150 I'll use the exact same command, but now querying the purchases table. 00:04:57.390 --> 00:04:59.830 Done. The data here is showing a weird format, 00:04:59.830 --> 00:05:01.740 so let me do the same trick I've done before. 00:05:01.870 --> 00:05:03.710 Let me execute the exact same query, 00:05:03.830 --> 00:05:09.060 but now with a | Format‑Table at the end. Perfect, 00:05:09.060 --> 00:05:09.480 take a look. 00:05:09.600 --> 00:05:11.550 This definitely looks like some credit card information. 00:05:12.190 --> 00:05:13.970 As we can see, in just a few minutes, 00:05:14.000 --> 00:05:16.510 we're able to search the whole database and find sensitive 00:05:16.510 --> 00:05:18.540 information that is critical to the client.