Come Home To Me
In the previous section, we discovered that if linked SQL servers exist,
it may be possible to exploit them
depending on the security context of the link.
In this section, we're going to learn how this could also be used
for privilege escalation on the local SQL server.
As we learned previously, the SQL server at appsrv01
is linked to the SQL server on dc01.
We can also execute the sp_linkedservers procedure on dc01
to locate any additional links from dc01.
One important thing to keep in mind is that SQL server links are
not bidirectional by default.
The easiest way to locate any links from dc01 is with
the AT syntax.
The SQL server on dc01 has a link to the SQL server on appsrv01.
This means that we could follow the link to dc01 to obtain
the SA login security context,
and then return back over the link to appsrv01.
To determine what privileges that gives us on appsrv01,
we can use the OPENQUERY keyword twice.
First, we’ll use it to execute a query on dc01,
and inside that,
we’ll use it again to execute a query on appsrv01.
We’ll compile this and run it.
We started with the corp1\offsec login
but after following the link to dc01
and then back to appsrv01,
we have obtained execution as sa.
Nice!
Since we now have sysadmin role membership on appsrv01,
we can get code execution through the same technique as in the previous section.
Again, the most direct way is with the AT keyword,
but we have to execute a query on the linked server dc01,
which then executes a query on appsrv01.
This means we need two instances of the AT keyword.
It is also important to notice the use of single quotes in the SQL query.
We have to escape all embedded single quotes with single quotes,
which means the inner string needs four single quotes.
Each time we follow a link, the number of single quotes doubles,
so we need to be careful when crafting queries.
We can modify the remaining SQL queries in the same manner
execute our PowerShell download cradle on appsrv01.
Once the C# console application is executed,
we obtain our reverse Meterpreter shell.
Very Nice!
If no other privilege escalation paths are possible,
we may be able to use a bidirectional link
to elevate privileges on the same SQL server.
In this section, we learned that it’s possible
to enumerate nested linked SQL servers
and even execute queries on them.
In theory, this allows us to follow as many links as we want
and possibly gain code execution from many SQL servers.