Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dumping Active Directory Domain Info – with PowerUpSQL!

netspi.com | blog | #active-directory | #red-team | #recon | #ldap | #sql-server | #powerupsql | #adsi

Summary

Thomas Elling demonstrates querying Active Directory through SQL Server's OLE DB ADSI provider with OPENQUERY and OPENROWSET, adding new PowerUpSQL functions that automate AD recon from SQL servers.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Establishing Registry Persistence via SQL Server with PowerUpSQL
Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.
blog · netspi.com
Finding Sensitive Data on Domain SQL Servers using PowerUpSQL
Demonstrates using PowerUpSQL to discover accessible domain SQL Servers and rapidly sample databases for sensitive PCI, HIPAA, and other regulated records at scale.
blog · netspi.com
Finding Weak Passwords for Domain SQL Servers on Scale using PowerUpSQL
Shows how PowerUpSQL finds domain SQL Servers, enumerates SQL logins with a standard domain account, and audits them at scale for weak passwords that often enable privilege escalation.
blog · netspi.com
Blindly Discover SQL Server Instances with PowerUpSQL
Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.
blog · netspi.com
Maintaining Persistence via SQL Server – Part 2: Triggers
Shows how DDL, DML, and logon triggers in SQL Server can be abused for persistence, provides a lab and detection guidance, and adds Get-SQLPersistTriggerDDL to PowerUpSQL.
blog · netspi.com
Maintaining Persistence via SQL Server – Part 1: Startup Stored Procedures
Explains why SQL Server is an overlooked persistence layer, covering startup stored procedures that execute at service start, their detection, code review, removal, and PowerUpSQL automation.
back