Right.
In this video, I'm going to run through the MS SQL command execution exercise.
I've already got a socks four proxy running, and my proxy
fire is configured to use it.
So I'm going to start hide e SQL on my attacker Windows VM,
and I'm gonna use the domain credentials of the MSSQL service account.
The
password is just cyberbotic
with a zero.
K.
So let's add a new connection, and this will be NMS SQL Server
TCPIP connection.
The IP address of the SQL Server is ten ten one two two two five.
And we definitely wanna check the use Windows authentication,
box, and the port is one port three three.
Okay. So now we're connected.
We can go to the query tab, and we can execute some queries.
Let's say select
server name,
and we are SQL two.
So let's check the status of XP command shell.
So we can do select value from sys dot configurations,
but the name
is XP command shell.
Right. So it's currently disabled.
So let's enable it.
We'll do SP
configure.
And first, we need to do show advanced options.
Set that to one.
And then the same again,
but with XP command shell.
And this is sort of the reason why I like Heidi.
Even though using a GUI may not be as convenient as a command
line, you can write your queries in here.
And for me, it's just a little bit more comfortable to do it this way.
And then once I'm comfortable that it's all correct, I can just hit go.
So these give you no output, but we can, copy paste
this command again.
And we can see the value is now one.
So let's execute something.
We can do exec XP command shell,
and then the command, let's just do whoami.
We are the MS SQL service user.
So to get a beacon running, we'll do PowerShell,
hidden and then an encoded command.
Now the encoded command is useful because we don't have to
worry about escaping additional quotations.
So to make the encoded command,
we are going to
start a reverse port forward on workstation two.
So I haven't done that yet, so let's do that.
The first thing to ensure is that the firewall doesn't block the traffic.
So we're gonna create a new firewall rule first, so new
net firewall rule.
The display name can be anything.
Just call it eighty eighty in.
The direction is inbound.
The protocol is TCP.
The action will be to allow, and the actual port itself is eighty eighty.
Now this does need to be run from an elevated session
because you need to be a local admin to add firewall rules.
So with that done, let's start the reverse port forward.
This is incorrect.
I've forgotten the actual file name, so let's just put b.
And I haven't hosted that payload yet,
so let's go to site management host file.
I'm gonna go to my
payloads directory,
and I'm gonna select my sixty four bit SMB payload.
And he will put b.
Now before I execute this, it's good to check on the web log.
So let's go.
K.
We can see that the payload has been downloaded,
and presumably, it the beacon is now running on the SQL
Server, so let's try and link to it.
Yep.
And now we have an elevated beacon running on SQL two.