Follow the Link
When a link from one SQL server to another is created,
the administrator must specify the execution context
that will be used during the connection.
While it is possible to have the context be dynamic
based on the security context of the current login,
some administrators opt to choose a specific SQL login instead.
If the administrator chooses a specific SQL login
and that login has sysadmin role membership,
we would obtain sysadmin privileges on the linked SQL server.
This will be the case even if we only have
low privileged access on the original SQL server.
The first step for this kind of attack is to
enumerate servers linked to the current SQL server.
The sp_linkedservers stored procedure
returns a list of linked servers.
It doesn't require arguments,
but it may return multiple results that we must print to the console.
In this example, we are going to connect to
appsrv01 instead of dc01 and not perform any impersonation,
since sp_linkedserver does not require any privileges to execute.
Once the C# console application has been compiled,
we can enumerate all linked servers from appsrv01.
In the output, we find that there is a linked SQL server called “DC01”.
The next step is to perform a SQL query on a linked server.
First, we need the version of the SQL server instance on dc01.
We can do this with the OPENQUERY keyword as part of the FROM clause.
When implementing this in our C# console application,
we must carefully and correctly escape double quotes.
With the project compiled,
we execute it,
and obtain the version from the linked SQL server.
This example proves that it’s possible to perform SQL queries
across linked servers.
Let’s see which security context we are executing in.
To do this, we'll replace the query for the SQL version to the SQL login
with SYSTEM_USER.
We’ll run this query on appsrv01,
as well as dc01.
Let’s compile and run it.
Our local login is our domain user,
while the linked security context is sa.
Excellent!
We already learned that sa access allows us to gain code execution.
To do this again, we will execute our PowerShell shellcode runner
through a download cradle with the xp_cmdshell stored procedure.
Since we must change advanced options for xp_cmdshell,
and other code execution techniques
we'll update the running configuration with the RECONFIGURE statement.
When this statement is executed against a remote server,
Microsoft SQL uses Remote Procedure Call to do it.
For this to work, the created link must be configured with outbound RPC
through the RPC Out setting.
RPC Out is not enabled by default,
but is commonly set by system administrators.
If RPC Out is not allowed,
it can be enabled with the sp_serveroption stored procedure
if our current user has sysadmin role membership.
Microsoft documentation for OPENQUERY
specifically states that executing stored procedures
is not supported on linked SQL servers.
Instead, we are going to use the AT keyword
to specify which linked SQL server a query should be executed on.
Notice the use of single quotes in our advanced options query.
The SQL escape character for a single quote is a single quote,
which means that we must double them on the inner strings.
Similarly, we can enable xp_cmdshell and invoke it on dc01.
When using the PowerShell download cradle,
we must keep an eye out for string quote issues.
The simplest way to solve this is by Base64 encoding the download cradle
and invoking it with the EncodedCommand parameter
as we did earlier in this module.
In this manner, all string quotes are avoided.
After compiling the C# console application,
ensuring that the PowerShell shellcode runner
is present on our Apache web server,
and confirming our listener is running,
we can trigger the attack.
After a short amount of time, we obtain a reverse shell
on the linked SQL server.
Note that the SQL server process is terminated when the shell exits
unless EXITFUNC is set to thread.
In this section, we have learned how linked SQL servers can be abused
to execute SQL queries on other SQL servers
and even obtain code execution on them.
In the next section, we are going to abuse this even further
to perform privilege escalation.