Original subtitles

[ELECTRONIC NOISES]

Now we're going to introduce the Microsoft, most common version

of an SQL Server, MSSQL.

In our environment, we've got our IP address.

We run an Nmap scan, and we see we're up against probably

a Microsoft system.

It's also running port 1433.

If we do a service enumeration scan, we get back

the latest version of the software,

Microsoft SQL Server 2019.

We can double down on that and run a script for ms-sql-info.

That'll give us a little more.

We have the service.

We've got the number, the exact version.

And it could tell us the various service pack.

Patches applied, it says false.

If we don't know what that means right now,

we can look it up later.

But currently, we just want to enumerate and pull

as much information as we can.

The next thing we can look into is ntlm-info.

And with this, we need some arguments to tell it

which instance to look at.

We want 1433.

And we got the target name of MSSQL-SERVER, NetBIOS domain

name of MSSQL-SERVER.

We'll store that for later.

Another script we can run is an MSSQL brute force, so brute.

And the arguments for this one are going to be our word lists.

So for our user, userdb=, we have these on our desktop,

wordlist, common_users.

And then the passdb--

very similar.

And we'll run that.

And it will brute force.

Again, the arguments for the different scripts that we run

are going to be based on the script.

Whoever was writing those scripts

determines what the variables are called.

We came back with auditor and jasmine1, dbadmin and bubbles1,

and admin and annamaria.

We'll take advantage of that in just a second.

Let's see if there's any empty passwords.

ms-sql-empty-password and we get one,

username sa with an empty password.

We could enumerate that a little more.

Well, let's take advantage of that Maria password

we came across.

We will run a query, pass in some arguments,

the username of admin.

The password was annamaria--

query.query.

And we will select everything from master..syslogins.

And this one, because it's a weird output

we're going to output it as normal,

oN, and call it output.text.

And I'll show you what that looks like in a second.

Let me correct the syntax near the star.

Let's go with select, not "slect."

It gave us this database output, which is a mess.

What we can do, if we go into root and look at output.txt,

it made this full size.

And we have wordwrap turned off.

We can come in and see it in a little easier-to-read fashion.

It's a database, so there's a lot of columns

and a lot of rows.

It could be even worse potentially.

But some of the logins are these services.

There are nt services, which are more helpful.

That's our machine services.

And then it looks like there are some individual user logins.

There's this BUILTIN user and NT AUTHORITY SYSTEM also accessed.

We can come back to this and see what's useful later.

For now, we're enumerating, so we gather,

gather, gather, gather.

Once you're done gathering, then we

can go back and see what is useful.

Let's dump some hashes.

That's another useful thing to do because dumping hashes

usually gets us--

we can use hashes.

We can pass a hash, which would let

us access other machines without necessarily

having the password.

I mean, we do have passwords here.

But maybe there's stuff that didn't come with a password.

There's more accounts than the few that we had before

and some hashes to go with them.

We saw this MS_PolicyEventProcessingLogin

in that output.

I don't know what we can deal with it right now.

But it's useful to have.

You never want to count things out in your enumeration phase.

Let's see if we can run some actual code.

We need a username.

We will use admin and annamaria again.

And then what do we actually want to ask it to do?

The command, we'll have it run as ipconfig.

We get back the IP address of the machine.

This default gateway could be useful to us.

We might want to be using that later to see

what sort of connections.

But really, what's helpful is we were

able to run a command in a shell on their machine

remotely utilizing SQL.

We saw that before with MySQL.

Now we can do it with MSSQL, which can be quite handy.

In this situation now instead of an ipconfig,

let's have it do type, which is the Windows version of cat

if you're more familiar with Linux than you are Windows.

Let's have it read a file.

So on the C drive, there was a file flag.txt.

And we got the output of that file,

which was a hash in this case.

It's useful to know how to enumerate multiple systems.

If you come across another version of SQL,

we could go into NSE, go on the website for Nmap,

and see what other scripts apply in those situations.

That's how you would do this enumeration thing.

If you see something that isn't covered here,

then you at least have an idea of,

what should we be looking for?

What should we be trying?

That's what we're trying to do here.