Enumeration

Using PowerUpSQL

Look for SPN's related to mssql

Import-Module PowerUpSQL.ps1

powershell Get-SQLInstanceDomain

ComputerName     : sql-2.dev.cyberbotic.io
Instance         : sql-2.dev.cyberbotic.io,1433
DomainAccountSid : 1500000521000672332383313895871914512914091400
DomainAccount    : mssql_svc
DomainAccountCn  : MS SQL Service
Service          : MSSQLSvc
Spn              : MSSQLSvc/sql-2.dev.cyberbotic.io:1433
LastLogon        : 8/15/2022 7:55 PM
Description      :

You may also search the domain for groups that sound like they may have access to database instances (for example, a "SQL Admins" group).

Use native setspn tool:

setspn -T corp1 -Q MSSQLSvc/*

.\GetUserSPNs.ps1

Check if we can connect to database

powershell Get-SQLConnectionTest -Instance "sql-2.dev.cyberbotic.io,1433" | fl

Status       : Accessible
IsSysadmin             : No

Gather more information about the instance

powershell Get-SQLServerInfo -Instance "sql-2.dev.cyberbotic.io,1433"

If there are multiple SQL Servers available, you can chain these commands together to automate the data collection.

Get-SQLInstanceDomain | Get-SQLConnectionTest -TimeOut 2 | ? { $_.Status -eq "Accessible" } | Get-SQLServerInfo

Check which roles we have

SQLRecon.exe -a windows -s sql-2.dev.cyberbotic.io,1433 -m whoami

Finding a user (or group) that does have access can be challenging

powershell Get-DomainGroup -Identity *SQL* | % { Get-DomainGroupMember -Identity $_.distinguishedname | select groupname, membername }

MS SQL Admins jking

SQLRecon.exe -a windows -s sql-2.dev.cyberbotic.io,1433 -m whoami

Another option is to go after the MS SQL service account itself as this is also often given sysadmin privileges.

Query against MS SQL

SQLRecon.exe -a windows -s sql-2.dev.cyberbotic.io,1433 -m query -o "select @@servername"

powershell Get-SQLQuery -Instance "sql-2.dev.cyberbotic.io,1433" -Query "select @@servername"

Non AD linked servers

These have to be checked manually (look for hostnames containing SQL)

Tooling

• https://github.com/NetSPI/PowerUpSQL/blob/master/PowerUpSQL.ps1

• https://github.com/skahwah/SQLRecon