SQLRecon

Description

A C# MS-SQL toolkit designed for offensive reconnaissance and post-exploitation. For detailed usage information on each technique, refer to the wiki.

Usage

You can grab a copy of SQLRecon from the releases page. Alternatively, feel free to compile the solution yourself This should be as straight forward as cloning the repo, double clicking the solution file and building.

Enumeration

SQLRecon supports enumeration of Active Directory for MSSQL SPNs, akin to PowerUpSQL's Get-SQLInstanceDomain.

• -e - Enumeration Type
  • domain -d DOMAIN | (OPTIONAL) Domain FQDN - Use the current users token to enumerate AD for MSSQL SPNs.

Mandatory Arguments

The mandatory arguments consist of an authentication type (either Windows, Local or Azure), connection parameters and a module.

• -a - Authentication Type
  • -a Windows - Use Windows authentication. This uses the current users token.
  • -a Local - Use local authentication. This requires the credentials for a local database user.
  • -a Azure - Use Azure AD domain username and password authentication. This requires the credentials for a domain user.

If the authentication type is Windows, then you will need to supply the following parameters.

• -s SERVERNAME - SQL server hostname
• -d DATABASE - (OPTIONAL) SQL server database name, defaults to 'master'
• -m MODULE - The module you want to use

If the authentication type is Local, then you will need to supply the following parameters.

• -d DATABASE - (OPTIONAL) SQL server database name, defaults to 'master'
• -u USERNAME - Username of local SQL user
• -p PASSWORD - Password of local SQL user
• -m MODULE - The module you want to use

If the authentication type is Azure, then you will need to supply the following parameters.

• -d DATABASE - (OPTIONAL) SQL server database name, defaults to 'master'
• -r DOMAIN.COM - FQDN of Domain
• -u USERNAME - Username of domain user
• -p PASSWORD - Password of domain user
• -m MODULE - The module you want to use

There are cases where a MS SQL Server might not be listening on a standard TCP port. A good example is MS SQL failover clustering. If the authentication type is Windows or Local, you can optionally set a non-standard connection port by supplying the -r PORT flag. By default, SQLRecon will connect to a databases via TCP Port 1433.

Standard Modules

Standard modules are used to interact against a single MS SQL server.

• info - Print information about the SQL Service
• query -o QUERY - Execute an arbitrary SQL query
• whoami - See what user you are logged in as, mapped as and what roles exist
• users - See what user accounts and groups can authenticate against the database
• databases - Show all databases present on the SQL server
• tables -o DATABASE - Show all tables in the database you specify
• search -o KEYWORD - Search column names within tables of the database you are connected to
• smb -o SHARE - Capture NetNTLMv2 hash
  ↓ Command Execution (requires sysadmin role or similar)
• enablexp - Enable xp_cmdshell
• disablexp - Disable xp_cmdshell
• xpcmd -o COMMAND - Execute an arbitrary system command using xp_cmdshell
• enableole - Enable OLE Automation Procedures
• disableole - Disable OLE Automation Procedures
• olecmd -o COMMAND - Execute an arbitrary system command using OLE Automation Procedures
• enableclr - Enable Custom CLR Assemblies
• disableclr - Disable Custom CLR Assemblies
• clr -o DLLPATH -f FUNCTION - Load and execute a .NET assembly within a custom stored procedure
• agentstatus - Check to see if SQL agent is running and obtain jobs
• agentcmd -o COMMAND - Execute an arbitary system command

Impersonation Modules

Impersonation modules are used to interact against a single MS SQL server, under the context of an impersonated SQL user.

• impersonate - Enumerate any user accounts that can be impersonated
• iwhoami -i IMPERSONATEUSER - See what user you are logged in as, mapped as and what roles exist
• iusers -i IMPERSONATEUSER - See what user accounts and groups can authenticate against the database
• iquery -i IMPERSONATEUSER -o QUERY - Execute an arbitrary SQL query as an impersonated user
  ↓ Command Execution (requires sysadmin role or similar)
• ienablexp -i IMPERSONATEUSER - Enable xp_cmdshell
• idisablexp -i IMPERSONATEUSER- Disable xp_cmdshell
• ixpcmd -i IMPERSONATEUSER -o COMMAND - Execute an arbitrary system command using xp_cmdshell
• ienableole -i IMPERSONATEUSER - Enable OLE Automation Procedures
• idisableole -i IMPERSONATEUSER - Disable OLE Automation Procedures
• iolecmd -i IMPERSONATEUSER -o COMMAND - Execute an arbitrary system command using OLE Automation Procedures
• ienableclr - Enable Custom CLR Assemblies
• idisableclr - Disable Custom CLR Assemblies
• iclr -o DLLPATH -f FUNCTION - Load and execute a .NET assembly within a custom stored procedure
• iagentstatus -i IMPERSONATEUSER - Check to see if SQL agent is running and obtain jobs
• iagentcmd -i IMPERSONATEUSER -o COMMAND - Execute an arbitary system command

Linked SQL Server Modules

Linked SQL Server modules are effective when you are able to interact with a linked SQL server via an established connection.

• links - Enumerate any linked SQL servers
• lquery -l LINKEDSERVERNAME -o QUERY - Execute an arbitrary SQL query on the linked SQL server
• lwhoami -l LINKEDSERVERNAME - See what user you are logged in as on the linked SQL server
• lusers -l LINKEDSERVERNAME - See what user accounts and groups can authenticate against the database on the linked SQL server
• ldatabases -l LINKEDSERVERNAME - Show all databases present on the linked SQL server
• ltables -l LINKEDSERVERNAME -o DATABASE - Show all tables in the supplied database on the linked SQL server
• lsmb -l LINKEDSERVERNAME -o SHARE - Capture NetNTLMv2 hash from linked SQL server
  ↓ Command Execution (requires sysadmin role or similar)
• lenablerpc -l LINKEDSERVERNAME - Enable RPC and RPC out on a linked SQL server
• ldisablerpc -l LINKEDSERVERNAME - Disable RPC and RPC out on a linked SQL server
• lenablexp -l LINKEDSERVERNAME - Enable xp_cmdshell on the linked SQL server
• ldisablexp -l LINKEDSERVERNAME - Disable xp_cmdshell on the linked SQL server
• lxpcmd -l LINKEDSERVERNAME -o COMMAND - Execute an arbitrary system command using xp_cmdshell on the linked SQL server
• lenableole -l LINKEDSERVERNAME - Enable OLE Automation Procedures on the linked SQL server
• ldisableole -l LINKEDSERVERNAME - Disable OLE Automation Procedures on the linked SQL server
• lolecmd -l LINKEDSERVERNAME -o COMMAND - Execute an arbitrary system command using OLE Automation Procedures on the linked SQL server
• lenableclr -l LINKEDSERVERNAME - Enable Custom CLR Assemblies on the linked SQL server
• ldisableclr -l LINKEDSERVERNAME - Disable Custom CLR Assemblies on the linked SQL server
• lclr -o DLLPATH -f FUNCTION - Load and execute a .NET assembly within a custom stored procedure on the linked SQL server
• lagentstatus -l LINKEDSERVERNAME - Check to see if SQL agent is running and obtain jobs on the linked SQL server
• lagentcmd -l LINKEDSERVERNAME -o COMMAND - Execute an arbitrary system command on the linked SQL server

Examples

See the wiki. for detailed examples.

Roadmap

The below techniques are on the roadmap for future releases

• Expand enumeration modules

History

v2.2.1

• Added the capability to download .NET assemblies via HTTP/S

v2.2

• Expanded roles which are queried in the roles, iroles and lroles modules
• Created users, iusers and lusers modules
• Fixed hash not being dropped from sp_drop_trusted_assembly in clr and iclr modules
• Created lagentcmd module
• Created lclr module

v2.1.6

• Added 'info' module, '-m info'.
• Corrections in Help.cs.
• Resolved issues with mandatory arguments with Local and Azure authentication.

v2.1.5

• Added option to enumerate domain SPNs (-e domain).

v2.1.4

• Fixed minor string formatting issue.

v2.1.3

• Added '-r' flag into Windows and Local authentication modes so that non-standard TCP ports can be supplied.

v2.1.2

• Improved logic around null connection strings

v2.1.1

• Removed Environment.Exit from TestAuthentication.cs

v2.1

• Created AgentJobs.cs
• Created agentstatus
• Created iagentstatus
• Created lagentstatus
• Created agentcmd
• Created iagentcmd

v2.0

• Created clr
• Created ienableclr
• Created idisbleclr
• Created iclr
• Created iwhoami
• Created imapped
• Created iroles
• Created lenablerpc
• Created ldisablerpc
• Created lwhoai
• Created lenablexp
• Created ldisablexp
• Created lenableole
• Created ldisableole
• Created lenableclr
• Created ldisableclr
• Created lxpcmd
• Created lxpole
• Created Random.cs
• Created EnableDisable.cs
• Implemented randomly generated assembly names for clr
• Implemented randomly generated variable and method names for ole
• Rolled 'mapped' and 'roles' modules into 'whoami'
• Rolled 'lmapped' and 'lroles' modules into 'lwhoami'
• Rolled 'imapped' and 'iroles' modules into 'iwhoami'
• Re-factored complete code base

v1.2

• Created lsmb module
• Created lwhoami module
• Created lroles module

v1.1

• Fixed oldcmd module
• Fixed iolecmd module
• Fixed ldatabases module
• Fixed ltables module
• Cleaned up code base
• Corrected inconsistencies in help menu