MS SQL Enumeration
The traditional way to locate instances of SQL servers is through network scans
with tools such as Nmap.
MS SQL commonly operates on TCP port 1433,
so a scan can be relatively quick.
A broader port scan would reveal non-default ports that are in use,
as is the case with named instances of MS SQL.
When a MS SQL server is running
in the context of an Active Directory service account,
it is normally associated with a Service Principal Name.
The SPN is stored in Active Directory
and links the service account to the SQL server
and its associated Windows server.
Therefore, a more discreet way of locating instances
of MS SQL in an Active Directory environment
is to query the domain controller for all registered SPNs related to MS SQL.
If we have compromised a domain-joined workstation
in the context of a domain user,
we can query the domain controller with the native setspn tool.
To simulate this, we log in to the Windows 10 client machine
as the Offsec domain user.
From a command prompt, we invoke setspn,
specifying the domain with -T,
and a wildcard SPN with the -Q flag.
We find two MS SQL instances in the domain
with registered SPNs running on dc01 and appsrv01.
It’s also possible to get the same information through the .NET framework
by using a PowerShell script or C# assembly.
One such public example is the GetUsersSPNs.ps1 PowerShell script,
which is located in the C:\Tools folder on the Windows 10 client machine.
Running the script gives similar output to what we found with setspn.
The output from setspn and GetUserSPNs
provides us with information about the hostname
and TCP port for Kerberos-integrated MS SQL servers across the entire domain.
We also obtain information about the service account context
under which the SQL servers are running.
In this case, both servers execute in the context of the SQLSvc domain account,
which is a member of built-in Administrators group.
This means that the service account is a local administrator
on both of the Windows servers where it’s used.
This information will be useful as we move forward with our attacks.