In this video, I'm going to go through the MS SQL Server lateral movement exercise.
So I still have Heidi connected to SQL two,
and we also have the, elevated beacon running on SQL two.
So let's see what links that this SQL server has.
Let's select the server name,
the server product,
and whether or not RPC out is enabled on the link.
Okay.
So we can see that SQL two has a link to SQL one, and this
SQL one is in the parent domain.
So this is a an avenue to hop domain and forest
trusts if a link is configured across a trust.
So we can execute a command on the link server using open query.
And the target server name is always in double quotes.
The query itself is in single quotes.
So c for one,
and let's just do select
server name,
and we are at SQL one.
So as before, we can check the status of XP command shell.
So let's select value from sys dot configurations,
where the name
is XP command shell.
But remember that the name has to be in single quotes here,
but we can't have just a single set of single quotes because we
already have an outer set of single quotes.
And so the problem with doing something like this
is that when this gets evaluated,
it would start from here,
and it will terminate at the first single quote.
And then everything after this will get truncated.
So you would see a lot of syntax errors and things like that.
So we have to
escape these quotes by just wrapping them in another set of single quotes.
And then we can execute that,
and we can see the XP command shell is disabled.
Now the syntax to enable XP command shell over a link is
slightly different,
so we have to use exec,
and we're gonna say exec SP configure.
And this will be show advanced options.
And this will be one and reconfigure,
and then close the bracket, and then at,
and then the target SQL server will be SQL one dot cyberbotics
dot I o,
and the same again for
XP command shell.
So let's execute that, and it will return no output.
So we have to repeat our previous, query again,
but we can now see that the value is one.
Now these, exec commands here, they they do require
RPC out to be enabled on the link.
And if RPC out is not enabled, you may be able to enable
it if you have sysadmin privileges on this SQL two server.
So now we want to actually execute a command
on the link server so we can get a beacon back.
And we'll do the same thing as before.
We'll do powershell
w hidden,
an encoded command.
The complication here is that SQL one is in a completely different domain
to all of the beacons that we already have running,
And the firewall rules in between the two domains
prevent SQL one from talking to these workstations.
So if we try to use the same download cradle that we did last time,
it it wouldn't work because SQL one can't talk to workstation two.
Because we have a link between the two SQL servers,
it stands to reason that SQL one
can talk to SQL two.
So if we put a reverse put forward on SQL two instead,
then we have a better chance of it working.
Now, a common mistake that people make is
trying to create a reverse put forward on SQL
two that points to the existing it's actually here.
That points to the existing reverse put forward that we
have on workstation two
and, you know, trying to do, like, this double hop thing.
And that doesn't work with reverse port forwards in cobble
stroke and nor do you need to because
if we create a reverse port forward on SQL two,
the traffic hitting that will automatically propagate down c
two chain back to the team server.
So you don't need to do this, like,
weird, like, multiple hop,
approach.
So we can go back to this beacon here.
We can clean up the reverse port forward by doing reverse
port forward stop eighty eighty.
And then we can go back to this beacon here and just create a
new reverse port forward.
But first, let's
copy the
command for the firewall, though,
because that issue still remains.
Okay.
And then we can just do rest for forward, eighty eighty
local host eighty.
And that's it.
So all we have to do is update the target here to be SQL two.
Now another trap is that if we just do SQL two without
specifying the domain,
because SQL one is in a different domain
to SQL two, if you just put SQL two,
it would try and resolve that to SQL two dot cyberbotic dot I
o, when in fact that we obviously
need it to resolve to the correct domain.
Make sure you're using the,
fully qualified name
to ensure that DNS resolution works properly.
If you're just using an IP address, then it doesn't
matter, but it does if you were using host names.
So that looks correct. The payload is the same.
So let's encode that.
So that will be our command here.
The other thing to know about
XP command shell over open query is that we need to
execute a dummy query first.
So I'll I like to just to do select server name,
and then the XP,
command shell.
Now this has to be in quotes as
well,
so we need another set of double quotes.
K. So I think that should be good.
As before, let's watch the web log
and go.
We do get a hit again, so that's always that's a good sign.
And let's go to the beacon on SQL two, and let's do link
SQL one dot cyberpotic
dot I o and my pipe name,
and there we go.
Now we have a beacon running on SQL one.