In this video, I'm going to demonstrate the MS SQL privilege escalation.
So we have this beacon running on SQL one.
If we do get UID, we can see that we are this NT service,
MSSQL server user.
And this is a type of built in service account, and it has a
particular privilege
called s e impersonate privilege.
Now it's a safe assumption that whenever you see this
type of service account that it has this privilege.
We can always sanity check it using seat belt.
So let's do execute assembly, see tools.
C belts.
We're going to run token privileges,
And we can see that s e impersonate privilege
is enabled.
So we can abuse this to elevate the system on the SQL
Server.
One of the tools to do that is sweet potato,
a c sharp tool so we can run it with execute assembly.
The first argument is the process that we want to
execute, So I'm going to give it the
full path to PowerShell.
And the other argument is a set of arguments.
So, of course, this will be w hidden and then another encoded command.
And that's it. That's all you need as a minimum.
I want to use a different type of payload this time because
for privilege escalation, I like to use the TCP ones,
the TCP beacons that bind to the local host.
So let's find
to go my TCP local sixty four bit,
and I'm just gonna call it c because I'm creative like that.
And all we have to do here is change the
encoded command
because this will still pull through the reverse pull
forward that we had from the last video.
Alright. Check the, keep an eye on the web log.
K.
We saw the the tab light up here, and we can see that,
TCP payload was grabbed.
So that's just connect to it.
Connect local host four four four
four, and now we have a system beacon running on SQL one.