Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Decrypting MSSQL Database Link Server Passwords

netspi.com | blog | #powershell | #post-exploitation | #database-security | #mssql | #linked-servers | #password-decryption

Summary

MSSQL linked server credentials are reversibly encrypted, letting sysadmin-level attackers recover cleartext passwords via a new PowerShell script. Defensive advice on database links included.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Decrypting MSSQL Credential Passwords
SQL Server stores credential passwords reversibly encrypted in master.sys.sysobjvalues, so sysadmin attackers can decrypt them. NetSPI updates its PowerShell script for post-exploitation recovery.
blog · netspi.com
Identifying Payment Cards at Rest – Going Beyond the Key Word Search
Uses MSSQL's native string functions to rule out tables and columns that cannot hold cardholder data, pairing card-number patterns and Luhn validation to cut the cost of cardholder data discovery.
blog · netspi.com
SQL Server Link Crawling with PowerUpSQL
Introduces Get-SQLServerLinkCrawl, which walks every accessible linked server path from an initial SQL Server foothold, exposing versions, link-user privileges, and query execution across links.
blog · netspi.com
15 Ways to Download a File
A pentest cheat sheet of fifteen file transfer techniques for compromised Windows boxes, from PowerShell and Python to FTP, TFTP, bitsadmin, wget, netcat, and compiled-source tricks.
blog · netspi.com
Using Powershell and Reflection API to invoke methods from .NET Assemblies
PowerShell plus the .NET Reflection API can invoke methods from .NET assemblies without an IDE or recompilation, e.g. to decrypt database passwords whose encryption routine lives in the code.
blog · netspi.com
SQL Server – Link….. Link….. Link….. and Shell: How to Hack Database Links in SQL Server!
Misconfigured SQL Server linked servers let attackers traverse database link networks, access unauthorized data, and deploy shells. The post covers enumerating links via the sysservers table.
back