What type of database management system is Microsoft SQL Server?
It is a proprietary relational database management system.
What is one way to enumerate SQL server instances that use Kerberos authentication?
Query for the Service Principal Names (SPNs) associated with the SQL service.
What information can be obtained by enumerating MSSQLSvc SPNs?
The hostname of the SQL servers and the service accounts used to run them.
What is the ldapsearch filter used to find MS SQL Server SPNs?
(&(samAccountType=805306368)(servicePrincipalName=MSSQLSvc*))
If a SQL server isn’t configured for Kerberos, what is an alternative enumeration method?
Scanning for open ports commonly used by MS SQL Server, such as TCP port 1433.
What service, if running, allows for minimal information gathering about a SQL instance without any specific roles?
The SQLBrowser service, which typically runs on port 1434/UDP.
What is the command in the provided material to query the SQLBrowser service?
beacon> sql-1434udp [ip_address]
What is the minimum role a user needs on a SQL instance to perform further interaction beyond basic SQLBrowser enumeration?
The ‘public’ role.
What is the SQL-BOF command to get detailed information about a SQL server instance, like its version, service account, and authentication mode?
beacon> sql-info [hostname]
Which SQL-BOF command is used to query for the current user’s roles and permissions on a SQL instance?
beacon> sql-whoami [hostname]
Name three privileged roles on a SQL instance that are of particular interest to an attacker.
serveradmin, securityadmin, and sysadmin.
What permission does the ‘public’ role grant that is useful for data-hunting?
It grants permission to query the database instance.
What is the SQL-BOF command to execute an arbitrary SQL query?
beacon> sql-query [hostname] “[SQL_QUERY]”
What SQL query can be used to retrieve the name of the current SQL server?
SELECT @@SERVERNAME
What does the sql-databases command do?
It lists the available databases on the SQL instance.
Which command is used to list the tables within a specific database?
The sql-tables command.
In MS SQL exploitation, what is the most common prerequisite role needed to enable code execution techniques?
The ‘sysadmin’ role.
The _____ stored procedure is the most well-known method for executing shell commands via a SQL server.
xp_cmdshell
What SQL query is used to check if xp_cmdshell is enabled?
SELECT name,value FROM sys.configurations WHERE name = ‘xp_cmdshell’
In the configuration table, what value indicates that xp_cmdshell is disabled?
A value of 0.
What SQL-BOF command enables the xp_cmdshell stored procedure?
beacon> sql-enablexp [hostname]
Under what user context are commands executed via xp_cmdshell typically run?
The context of the principal running the sqlservr process, often SYSTEM or a service account.
What is the SQL-BOF command for executing a system command using xp_cmdshell?
beacon> sql-xpcmd [hostname] “[command]”
Which of the code execution techniques discussed (xp_cmdshell, OLE, CLR) is the only one that can return command output directly?
xp_cmdshell
-
Module 144
-
Module 243
-
Module 360
-
Module 466
-
Module 550
-
Module 660
-
Module 762
-
Module 856
-
Module 918
-
Module 1052
-
Module 1153
-
Module 1250
-
Module 1336
-
Module 1441
-
Module 1567
-
Module 1653
-
Module 1728
-
Module 1851
-
Module 1954
-
Module 2022
-
Cobalt Strike User Guide161
-
Cobalt Strike Installation Guide37
