WEBVTT

00:00:01.240 --> 00:00:01.690
Awesome!

00:00:01.700 --> 00:00:03.000
I hope you enjoyed the demos.

00:00:03.240 --> 00:00:06.850
What we're learning here, it's just a fraction of the features of PowerUpSQL.

00:00:07.640 --> 00:00:09.650
This framework can be used for a lot of things.

00:00:10.140 --> 00:00:10.790
For example,

00:00:10.830 --> 00:00:14.610
we can use PowerUpSQL for discovery in which you use the

00:00:14.610 --> 00:00:17.700
tool to find Microsoft SQL Servers in the network, so

00:00:17.700 --> 00:00:19.050
then we can attack them later.

00:00:20.140 --> 00:00:20.510
Also,

00:00:20.620 --> 00:00:23.430
we can use this tool to get initial access by scanning

00:00:23.430 --> 00:00:27.040
for known vulnerabilities. Also, once we have initial access,

00:00:27.110 --> 00:00:30.200
we can look for insecure configurations and weak credentials.

00:00:30.940 --> 00:00:31.660
And more than that,

00:00:31.840 --> 00:00:35.450
PowerUpSQL is really famous for its privilege escalation techniques.

00:00:36.010 --> 00:00:38.610
And the interesting thing is that you can even try to get admin

00:00:38.610 --> 00:00:40.850
privileges on the operating system using this tool.

00:00:41.540 --> 00:00:43.200
And once you have access to the database,

00:00:43.340 --> 00:00:47.110
you can use PowerUpSQL to create persistence by creating scheduled

00:00:47.110 --> 00:00:50.940
tasks and triggered procedures. And believe it or not,

00:00:51.050 --> 00:00:53.550
you can even use this tool for data exfiltration.

00:00:54.340 --> 00:00:55.140
And as we can see,

00:00:55.250 --> 00:00:58.610
PowerUpSQL has a lot of features. You can visit the official

00:00:58.610 --> 00:01:01.050
wiki page to get more details on this feature.

00:01:01.940 --> 00:01:03.870
And remember, if you don't want to type this link,

00:01:03.880 --> 00:01:06.630
just go to the slides on the course material and you'll find a

00:01:06.630 --> 00:01:11.180
link in there. Before we go, I want to leave you with some

00:01:11.190 --> 00:01:12.750
actual resources about this tool.

00:01:13.490 --> 00:01:13.960
First,

00:01:14.000 --> 00:01:16.710
you can check the official documentation of the PowerUpSQL

00:01:16.710 --> 00:01:19.550
by going to the wiki on the GitHub page.

00:01:20.390 --> 00:01:23.850
In there, you'll find a detailed description of all the features of this tool.

00:01:25.140 --> 00:01:27.160
Also, if you want to learn more about the tool,

00:01:27.300 --> 00:01:30.150
I do recommend you watching the author talk on the tool.

00:01:30.840 --> 00:01:34.950
This talk was presented at Black Hat 2018 and contains a lot of demos

00:01:35.060 --> 00:01:37.050
showing the most important features of the tool.

00:01:38.630 --> 00:01:40.970
Also, if you're interested in sensitive data collection,

00:01:41.110 --> 00:01:44.360
there's one course here at Pluralsight in which we explore sensitive

00:01:44.360 --> 00:01:47.780
data collection using a really interesting tool called PowerSploit.

00:01:49.150 --> 00:01:51.780
And if you're wondering what it can do to prevent people from

00:01:51.780 --> 00:01:53.900
exploiting your Microsoft SQL Servers,

00:01:54.150 --> 00:01:56.860
there are a few recommendations. First, and the most

00:01:56.860 --> 00:01:59.020
important one, audit your own company,

00:01:59.200 --> 00:02:02.050
and this means try to use the PowerUpSQL against your

00:02:02.060 --> 00:02:03.830
own company to see what you can find.

00:02:04.170 --> 00:02:08.070
You may be surprised to know that someone can easily hack into your database.

00:02:08.070 --> 00:02:13.400
Also, really important, do not reuse service accounts, and this will avoid

00:02:13.400 --> 00:02:15.300
that attacker moving laterally in your government.

00:02:16.140 --> 00:02:19.950
Also, as you may have noticed, using a strong password is really important.

00:02:20.160 --> 00:02:24.690
Weak credentials can be easily cracked or guessed. And also really

00:02:24.690 --> 00:02:28.480
important, ensure that all your database administrators are aware on how to

00:02:28.480 --> 00:02:31.150
configure the Microsoft SQL Server in a secure way.

00:02:33.340 --> 00:02:36.050
So, that's it. That's the end of our PowerUpSQL course.

00:02:36.440 --> 00:02:38.950
I hope you enjoyed this course and that now you have one

00:02:38.950 --> 00:02:41.250
more tool in your cybersecurity toolbox.

00:02:41.880 --> 00:02:43.850
Thank you for watching, and I'll see you later.