MSSQL-Attacks for red teamers (Lab Setup - Part 3)
#MSSQL service #attacks are very common during an #Active-Directory security #assessment . In this series I will be guiding to building and exploiting MSSQL Service within an active directory env.
In this video I added misconfigurations in an SQL instance which could be exploited easily by an attacker. The exploitation part will be the next and final.
================= Commands =================
```
/*Create Login*/
CREATE LOGIN [ROBENSIVE-LABS\sqluser] FROM WINDOWS;
CREATE USER [ROBENSIVE-LABS\sqluser] FOR LOGIN [ROBENSIVE-LABS\sqluser];
GO
CREATE LOGIN [ROBENSIVE-LABS\sqladmin] FROM WINDOWS;
CREATE USER [ROBENSIVE-LABS\sqladmin] FOR LOGIN [ROBENSIVE-LABS\sqladmin];
GO
create database sqluserdb
create database sqladmindb
GO
use sqluserdb
go
grant EXEC,select,insert,update,delete on database::sqluserdb to [ROBENSIVE-LABS\sqluser]
go
use sqladmindb;
go
grant EXEC,select,insert,update,delete on database::sqladmindb to [ROBENSIVE-LABS\sqladmin]
go
/*User Impersonation*/
GRANT IMPERSONATE ON LOGIN::[ROBENSIVE-LABS\sqladmin] TO [ROBENSIVE-LABS\sqluser]
GRANT IMPERSONATE ON LOGIN::[ROBENSIVE-LABS\rob] TO [ROBENSIVE-LABS\sqladmin]
GRANT IMPERSONATE ON LOGIN::[sa] TO [ROBENSIVE-LABS\sqladmin]
go
use msdb
GRANT IMPERSONATE ON USER::dbo TO [ROBENSIVE-LABS\sqluser]
go
/*Linked Servers*/
use master
EXEC sp_addlinkedserver @server='DC01', @srvproduct='SQL Server'
EXEC sp_addlinkedsrvlogin @rmtsrvname=N'DC01', @useself=N'False', @locallogin=NULL, @rmtuser=N'sa', @rmtpassword='Admin@123'
```
================= Chapters =================
00:00 - Intro
00:09 - An Overview
03:15 - Add Domain-users
06:29 - Creating and granting DB
09:28 - User Impersonation
14:59 - DBO Impersonation
18:14 - Setting up Linked Server
21:04 - Validation (Linked Server)
22:36 - Linked Server login
26:58 - Mystikcon 2022