SQLRecon - a C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation

(545 views)

Description

A C# MS-SQL toolkit designed for offensive reconnaissance and post-exploitation. For detailed usage information on each technique, refer to the wiki.

Usage

You can grab a copy of SQLRecon from the releases page. Alternatively, feel free to compile the solution yourself This should be as straight forward as cloning the repo, double clicking the solution file and building.

Mandatory Arguments

The mandatory arguments consist of an authentication type (either Windows, Local or Azure), connection parameters and a module.

  • -a - Authentication Type
    • -a Windows - Use Windows authentication. This uses the current users token.
    • -a Local - Use local authentication. This requires the credentials for a local database user.
    • -a Azure - Use Azure AD domain username and password authentication. This requires the credentials for a domain user.

If the authentication type is Windows, then you will need to supply the following parameters.

  • -s SERVERNAME - SQL server hostname
  • -d DATABASE - SQL server database name
  • -m MODULE - The module you want to use

If the authentication type is Local, then you will need to supply the following parameters.

  • -d DATABASE - SQL server database name
  • -u USERNAME - Username of local SQL user
  • -p PASSWORD - Password of local SQL user
  • -m MODULE - The module you want to use

If the authentication type is Azure, then you will need to supply the following parameters.

  • -d DATABASE - SQL server database name
  • -r DOMAIN.COM - FQDN of Domain
  • -u USERNAME - Username of domain user
  • -p PASSWORD - Password of domain user
  • -m MODULE - The module you want to use

Standard Modules

Standard modules are used to interact against a single MS SQL server.

  • query -o QUERY - Execute an arbitrary SQL query
  • whoami - See what user you are logged in as
  • mapped - See what user you are mapped to
  • roles - Enumerate if the user has public and/or sysadmin roles mapped
  • databases - Show all databases present on the SQL server
  • tables - Show all tables in the database you are connected to
  • search -o KEYWORD - Search column names within tables of the database you are connected to.
  • smb -o SHARE - Capture NetNTLMv2 hash
  • enablexp - Enable xp_cmdshell (requires sysadmin role or similar)
  • disablexp - Disable xp_cmdshell (requires sysadmin role or similar)
  • xpcmd -o COMMAND - Execute an arbitrary system command (requires sysadmin role or similar)
  • enableole - Enable OLE Automation Procedures (requires sysadmin role or similar)
  • disableole - Disable OLE Automation Procedures (requires sysadmin role or similar)
  • olecmd -o COMMAND - Execute an arbitrary system command (requires sysadmin role or similar)
  • enableclr - Enable Custom CLR Assemblies (requires sysadmin role or similar)
  • disableclr - Disable Custom CLR Assemblies (requires sysadmin role or similar)
  • impersonate - Enumerate any user accounts that can be impersonated
  • links - Enumerate any linked SQL servers

Impersonation Modules

Impersonation modules are used to interact against a single MS SQL server, under the context of an impersonated SQL user.

  • iquery -i IMPERSONATEUSER -o QUERY - Execute an arbitrary SQL query as an impersonated user
  • ienablexp -i IMPERSONATEUSER - Enable xp_cmdshell (requires sysadmin role or similar)
  • idisablexp -i IMPERSONATEUSER- Disable xp_cmdshell (requires sysadmin role or similar)
  • ixpcmd -i IMPERSONATEUSER -o COMMAND - Execute an arbitrary system command (requires sysadmin role or similar)
  • ienableole -i IMPERSONATEUSER - Enable OLE Automation Procedures (requires sysadmin role or similar)
  • idisableole -i IMPERSONATEUSER - Disable OLE Automation Procedures (requires sysadmin role or similar)
  • iolecmd -i IMPERSONATEUSER -o COMMAND - Execute an arbitrary system command (requires sysadmin role or similar)

Linked SQL Server Modules

Linked SQL Server modules are effective when you are able to interact with a linked SQL server via an established connection.

  • ldatabases -l LINKEDSERVERNAME - Show all databases present on the Linked SQL server
  • ltables -l LINKEDSERVERNAME - Show all tables in the database you are connected to on the Linked SQL server
  • lquery -l LINKEDSERVERNAME -o QUERY - Execute an arbitrary SQL query on a linked SQL server

Examples

See the wiki. for detailed examples.

Roadmap

The below techniques are on the roadmap for future releases


Original repository: https://github.com/skahwah/SQLRecon

February 10, 2022
Subscribe
Notify of
guest
2 Comments
Newest
Oldest Most Voted
Inline Feedbacks
View all comments
2 months ago

Have you ever wanted to spy on your spouse’s phone or wanted to monitor their phone? you may want to know what is happening in their life or how they are communicating with someone else. or maybe you want to protect them from ex either way. you can contact ([email protected]), talk about it with kelvin. you want to hack your husband’s whatsapp account text messages on iphone or android phone remotely and provide ways of doing it without installing any software on the target device. you will get complete access to whatsapp, facebook, kik, viber, messenger, text messages and other… Read more »

Lizzy Agnes
8 months ago

A great hacker is really worthy of good recommendation , Henry
really help to get all the evidence i needed against my husband and
and i was able to confront him with this details from this great hacker
to get an amazing service done with the help ,he is good with what he does and the charges are affordable, I think all I owe him is publicity for a great work done via, Henryclarkethicalhacker at gmail com, and you can text, call him on whatsapp him on +12014305865, or +17736092741, 

© HAKIN9 MEDIA SP. Z O.O. SP. K. 2023
What certifications or qualifications do you hold?
Max. file size: 150 MB.
What level of experience should the ideal candidate have?
What certifications or qualifications are preferred?

Download Free eBook

Step 1 of 4

Name(Required)

We’re committed to your privacy. Hakin9 uses the information you provide to us to contact you about our relevant content, products, and services. You may unsubscribe from these communications at any time. For more information, check out our Privacy Policy.