darkoperator/Posh-SecMod — pull request #7 by nullbind (2014-04-21 20:27:31+00:00)
Title: Added Get-SQLServerAccess function

This function pulls a list of SQL Server instances from ADS and attempts to connect to each of them. I originally wrote this to take advantage of SQL Servers configured with excessive privileges during penetration tests. However, it can also be used to illustrate how SPNs can be leveraged to quickly audit what SQL Servers standard domain users have access to from a blue team perspective. Hoooray for LDAP!

DESCRIPTION
This module obtains a list of all of the SQL Server instances registered on
the domain by querying a domain controller for MSSQLsvc Service Principle
Names. Then it checks if the current or provided user has access to the SQL
Server instances found. Finally, it queries accessible SQL Server instances
for basic information that could be used to escalate privileges on the server
such as sysadmin privileges, shared service accounts, service
accounts configured with Domain Admin privileges, and database links.
An option has also been added so a custom query can be defined by the user.
The module allows users to authenticate to the SQL Server instances as the
current domain user or a provided SQL user. Alternative domain credentials
can also be used via the Windows RunAs command.

.EXAMPLE
Returns a list of SQL Server instances on the current user's domain that they have
access to. This is the default output.

PS C:\Get-SQLServerAccess
[*] ----------------------------------------------------------------------
[*] Start Time: 04/09/2014 17:02:33
[*] Domain: mydomain.com
[*] DC: dc1.mydomain.com
[*] Getting list of SQL Server instances from DC as mydomain\myuser...
[*] 5 SQL Server instances found in LDAP.
[*] Attempting to login into 5 SQL Server instances as mydomain\myuser...
[*] ----------------------------------------------------------------------
[-] Failed - server1.mydomain.com is not responding to pings
[-] Failed - server2.mydomain.com (192.168.1.102) is up, but authentication/query failed
[+] SUCCESS! - server3.mydomain.com,1433 (192.168.1.103) - Sysadmin: No
[+] SUCCESS! - server3.mydomain.com\SQLEXPRESS (192.168.1.103) - Sysadmin: No
[+] SUCCESS! - server4.mydomain.com\AppData (192.168.1.104) - Sysadmin: Yes
[*] ----------------------------------------------------------------------
[*] 3 of 5 SQL Server instances could be accessed.
[*] End Time: 04/03/2014 10:58:00
[*] Total Time: 00:03:00
[*] ----------------------------------------------------------------------