skahwah/sqlreconA C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.
SQLRecon is a Microsoft SQL Server toolkit that is designed for offensive reconnaissance and post-exploitation. For detailed information on how to use each technique, refer to the wiki.
You can download a copy of SQLRecon from the releases page. Alternatively, feel free to compile the solution yourself. This should be as straight forward as cloning the repo, double clicking the solution file and building.
Prevention, detection and mitigation guidance has also been provided for all you defenders out there.
Check out my blog post on the IBM Security Intelligence website. If you prefer videos, then check out my presentation at Black Hat.
Enumeration Modules do not require an authentication provider to be supplied. These modules must be passed into the enumeration module flag (/e:, /enum:). The wiki has details on using enumeration modules.
Info - Show information about the SQL server.
/h:, /host -> SQL server hostname or IP. Multiple hosts supported.
/port: -> (OPTIONAL) Defaults to 1434 (UDP).
/t:, timeout: -> (OPTIONAL) Defaults to 3s.
SqlSpns - Use the current user token to enumerate the AD domain for MSSQL SPNs.
/d:, /domain: -> (OPTIONAL) NETBIOS name or FQDN of domain.
SQLRecon supports a diverse set of authentication providers (/a:, /auth:) to enable interacting with a Microsoft SQL Server.
WinToken - Use the current users token to authenticate against the SQL database
/h:, /host: -> SQL server hostname or IP
WinDomain - Use AD credentials to authenticate against the SQL database
/h:, /host: -> SQL server hostname or IP. Multiple hosts supported.
/d:, /domain: -> NETBIOS name or FQDN of domain.
/u:, /username: -> Username for domain user.
/p:, /password: -> Password for domain user.
Local - Use local SQL credentials to authenticate against the SQL database
/h:, /host: -> SQL server hostname or IP. Multiple hosts supported.
/u:, /username: -> Username for local SQL user.
/p:, /password: -> Password for local SQL user.
EntraID - Use Azure EntraID credentials to authenticate against the Azure SQL database
/h:, /host: -> SQL server hostname or IP. Multiple hosts supported.
/d:, /domain: -> FQDN of domain (DOMAIN.COM).
/u:, /username: -> Username for domain user.
/p:, /password: -> Password for domain user.
AzureLocal - Use local SQL credentials to authenticate against the Azure SQL database
/h:, /host: -> SQL server hostname or IP. Multiple hosts supported.
/u:, /username: -> Username for local SQL user.
/p:, /password: -> Password for local SQL user.
Pth - Authenticate using an NT hash (pass-the-hash) over raw TDS/NTLM. Elevated privileges or SeImpersonate is not required.
/h:, /host: -> SQL server hostname or IP. Multiple hosts supported.
/d:, /domain: -> NETBIOS domain name.
/u:, /username: -> Domain username.
/hash: -> NT hash (32 hex chars, 8846f7eaee8fb117ad06bdd830b7586c) or LM:NT format.
/h:, host:) is required and allows one or more SQL servers. If you want to execute a module against multiple SQL servers, separate the hosts with a comma, for example /h:SQL01,10.10.10.2,SQL03.master database by default, however, this can be optionally changed by supplying a custom database name via the database (/database:) flag./debug flag is optional and displays all SQL queries that are executed by a module, without actually executing them on the remote host(s). An example of this can be found in the wiki.1433 by default, however, this can be optionally changed using the /port: flag.3 seconds, however, this value can be optionally changed by supplying a timeout value (/t:, /timeout:) which corresponds to the number of seconds before terminating the connection attempt.Please note that the EntraID authentication provider requires that the Azure Active Directory Authentication Library (ADAL) or Microsoft Authentication Library (MSAL) exists on the system SQLRecon is executed from. This is for Azure EntraID authentication and authorization functionality.
SQL modules are executed against one or more instance of Microsoft SQL server. These modules must be passed into the module flag (/m:, /module:).
The host flag (/h:, host:) is required and allows one or more SQL servers. If you want to execute a module against multiple SQL servers, separate the hosts with a comma, for example /h:SQL01,10.10.10.2,SQL03.
The wiki has details on using each module which supports execution on one or more instance of SQL Server.
Impersonation modules are executed against one or more instances of Microsoft SQL server, under the context of an impersonated SQL user. All impersonation modules have the following minimum requirements:
/i:, /iuser:)./m:, /module:).The wiki has details on using each module which supports execution using Impersonation.
Linked modules are executed on one or more instances of a linked Microsoft SQL server. All linked modules have the following minimum requirements:
/l:, /link:). The link flag allows one or more linked SQL servers. For example, if SQL01 has a link to SQL02, and SQL01 has a link to DB04, you can separate the linked hosts with a comma, and a module will be executed on each linked SQL server, for example /l:SQL02,DB04./m:, /module:).The wiki has details on using each module which supports execution on one or more instance of a Linked SQL Server.
Linked chain modules are executed on the final Microsoft SQL server in a linked server chain. All linked chain modules have the following minimum requirements:
/l:, /link: flag. If SQL01 has a link to SQL02, and SQL02 has a link to PAYMENTS01, and you want to execute a module on PAYMENTS01, then the argument would be /l:SQL02,PAYMENTS01./chain flag must be included to execute the module against the final SQL server in the supplied linked chain./m:, /module:).The wiki has details on using each module which supports execution on the final SQL server supplied in a Linked SQL Server Chain.
SQLRecon has several modules that can assist with enumerating and attacking Microsoft System Center Configuration Manager (SCCM) and Microsoft Endpoint Configuration Manager (ECM). The SCCM or ECM server will need to have a Microsoft SQL database exposed either locally or remotely.
SCCM modules must be passed into the SCCM module flag (/s:, /sccm:).
Most of the SCCM modules can be executed under the context of an impersonated SQL user (/i:, /iuser:).
The wiki has details on using each module against an SCCM/ECM database.
Users module lists all users in the RBAC_Admins table. These are all users configured for some level of access to SCCM.Sites module lists all other sites with data stored in the SCCM databases' DPInfo table. This can provide additional attack avenues as different sites can be configured in different (insecure) ways.Logons module queries the Computer_System_DATA table to retrieve all associated SCCM clients along with the user that last logged into them. NOTE: This only updates once a week by default and will not be 100% up to date. Use /option: as an optional (not required) argument to filter SCCM clients.TaskList module provides a list of all task sequences stored in the SCCM database, but does not access the actual task data contents.TaskData module recovers all task sequences stored in the SCCM database and decrypts them to plaintext. Task sequences can contain credentials for joining systems to domains, mapping shares, running commands, etc.Credentials module lists credentials vaulted by SCCM for use in various functions. These credentials can not be remotely decrypted as the key is stored on the SCCM server. However, this module provides intel on if it makes sense to attempt to obtain the key.If you are interested in extending SQLRecon, please refer to the contributing and extending section in the wiki.
I encourage you to open an issue if you have any suggestions or ideas.
The goal is to continuously improve SQLRecon. Listed below are some planned research areas:
The following people have contributed either directly or indirectly to various aspects of SQLRecon.
/auth:pth). Implements raw TDS/NTLM authentication via PTHTdsConnection, NtlmHelper, and PthState so that all modules work without plaintext credentials or elevated privileges. Key fixes include post-login ANSI session options, multi-packet TDS splitting, TCP flow deadlock handling for concurrent CLR connections, and OPENQUERY bracket notation compatibility._linkedChainRpcQuerySystem.Byte[] was never properly converted and printed to console.credentialobjectss and proxies modules (jakxx).agentcmd (jakxx).role enumeration not working properly over linked chain (passthehashbrowns).impersonate module not working properly over linked chain (passthehashbrowns).EnableRpc/DisableRpc not being available over linked chains (passthehashbrowns).XpCmd module not working over linked chains, also supports output now (passthehashbrowns).EXEC AT queries unless they are surrounded by brackets, this causes problems if the linked server name is an IP address or an FQDN (passthehashbrowns).LinkedChainQuery function creates a new array with a "0" at the front and then calls the existing logic in a separate function, now called LinkedChainQueryRecurse (passthehashbrowns).impersonate module to handle sysadmin cases correctly (n3rada).scriptdata and cidata (G0ldenGunSec).auditstatus module to check if SQL auditing is in place (chryzsh).whoami module (JBalanza).adsi module where the LDAP server does not need to be added to the msdb database, also the created function is now dropped properly.SQL01 has a link to SQL02, and SQL02, has a link to SQL03, and SQL03, has a link to PAYMENTS01. It is now possible to execute commands from SQL01 on PAYMENTS01 using the linked server chain (/link:SQL02,SQL03,PAYMENTS01 /chain). Credit to Azaël Martin (n3rada).l' and 'i' modules, and introduced context logic so module names can be the same across standard, impersonation, linked and chained execution./debug), which will display various debugging information and all SQL queries that will be executed by a module, without executing them./host or /h flag is now supported using comma separated values./link or /l flag is now supported using comma separated values./lhost to /link.s' modules and created the /s, /sccm switch for SCCM modules.DecryptCredentials./enum) module called info which is able to used an unauthenticated context to obtain SQL server information, including instance name and TCP port using the UDP protocol.adsi execution was not removing the LDAP server.adsi, in favor of openquery/rpc./lhost to /adsi in in adsi module./rhost to /unc in smb module.CaptureHash.cs and simplified logic.SetEnumerationType.cs and simplified logic.Impersonation.cs to Impersonate.cs.OleCmdExec.cs to OleAutomation.cs.smb module.info module.info module.rows, iRows and lRows modules.sLogons to include an optional filter.xp_cmdshell modules were not printing command output to console.SetEnumerationType.cs.domain to SqlSpns.SetAuthenticationType.cs constructor to a new method called EvaluateAuthenticationType.CreateSqlConnectionObject in SetAuthenticationType.cs which extends SQLRecon to support multiple simultaneous SQL connection objects.ADSI.cs, which incorporates ADSI credential attacks as described here.adsi, iAdsi, and lAdsi modules.lLinks and iLinks modules.ExecuteImpersonationQuery and ExecuteImpersonationCustomQuery.Impersonate.cscheckRpc module.iCheckRpc module.lCheckRpc module.EnableDisable.cs to ConfigureOptions.csExecuteLinkedCustomQueryRpcExec is called. PrintUtils.cs, which implements a print class for standardized output.TablePrinter from Help.cs to PrintUtils.cs.PrintUtils class.querysearchtableslColumnslQuerylSearchlTablesiColumnsAzure authentication to AzureAD.AzureLocal authentication.disableRpc module.enableRpc module.iEnableRpc module.iDisableRpc module.lEnableRpc module.lDisbleRpc module.lAgentCmd bug fixes.clr, iClr and lClr stability by using SqlCommand.ExecuteNonQuery when creating the stored procedure.lClr bug where it was not removing created assemblies or stored procedures.columns module.iColumns module.iDatabases module.iSearch module.iTables module.lColumns module.lSearch module.ExecuteLinkedCustomQueryRpcExec.x.Random.cs into utilities directory.Windows authentication to WinToken.WinDomain authentication, which uses AD domain username and password for authentication via impersonation. Check out Impersonation.cs.ArgumentLogic.cs, SQLAuthentication.cs and ModuleHandler.cs.ModuleHandler.cs no longer uses a massive if/else if/else statement to execute modules. Instead, reflection is now used to call methods matching command modules names.commands directory, which has global variables that are used throughout the program.SQLAuthentication.cs.Program.cs to ArgumentLogic.cs.sccm command.roles, iRoles and lRoles modules.users, iUsers and lUsers modules.sp_drop_trusted_assembly in clr and iClr modules.lAgentCmd module.lClr module.info module.Local and Azure authentication.-e domain).-r flag into Windows and Local authentication modes so that non-standard TCP ports can be supplied.Environment.Exit from TestAuthentication.cs.AgentJobs.cs.agentStatus.iAgentStatus.lAgentStatus.agentCmd.iAgentCmd.clr.iEnableClr.iDisbleClr.iClr.iWhoami.iMapped.iRoles.lEnableRpc.lDisableRpc.lWhoai.lEnableXp.lDisableXp.lEnableOle.lDisableOle.lSmb module.lWhoami module.lRoles module.oldCmd module.iOleCmd module.lDatabases module.lTables module./v, /verbose flag is optional and displays all SQL queries that are executed by a module before executing them on the remote host(s). An example of this can be found in the wiki.| Module Name | Description | Impersonation | Linked Execution | Linked Chain Execution | Requires Privileged Context |
|---|
AuditStatus | Check if SQL auditing is in place. | ✅ | ✅ | ✅ | ❎ |
CheckRpc | Obtain a list of linked servers and their RPC status. | ✅ | ✅ | ✅ | ❎ |
Databases | Display all databases. | ✅ | ✅ | ✅ | ❎ |
Impersonate | Enumerate user accounts that can be impersonated. | ✅ | ✅ | ✅ | ❎ |
Info | Show information about the SQL server. | ✅ | ✅ | ✅ | ❎ |
Links | Enumerate linked SQL servers. | ✅ | ✅ | ✅ | ❎ |
Users | Display what user accounts and groups can authenticate against the database. | ✅ | ✅ | ✅ | ❎ |
Whoami | Display your privileges. | ✅ | ✅ | ✅ | ❎ |
Query /c:QUERY | Execute a SQL query. | ✅ | ✅ | ✅ | ❎ |
Smb /unc:UNC_PATH | Capture NetNTLMv2 hash. | ✅ | ✅ | ✅ | ❎ |
Columns /db:DATABASE /table:TABLE | Display all columns in the supplied database and table. | ✅ | ✅ | ✅ | ❎ |
Rows /db:DATABASE /table:TABLE | Display the number of rows in the supplied database table. | ✅ | ✅ | ✅ | ❎ |
Search /keyword:KEYWORD | Search column names in the supplied table of the database you are connected to. | ✅ | ✅ | ✅ | ❎ |
Tables /db:DATABASE | Display all tables in the supplied database. | ✅ | ✅ | ✅ | ❎ |
EnableRpc /rhost:LINKED_HOST | Enable RPC and RPC out on a linked server. | ✅ | ❌ | ❌ | ✔️ |
EnableClr | Enable CLR integration. | ✅ | ✅ | ✅ | ✔️ |
EnableOle | Enable OLE automation procedures. | ✅ | ✅ | ✅ | ✔️ |
EnableXp | Enable xp_cmdshell. | ✅ | ✅ | ✅ | ✔️ |
DisableRpc /rhost:LINKED_HOST | Disable RPC and RPC out on a linked server. | ✅ | ❌ | ❌ | ✔️ |
DisableClr | Disable CLR integration. | ✅ | ✅ | ✅ | ✔️ |
DisableOle | Disable OLE automation procedures. | ✅ | ✅ | ✅ | ✔️ |
DisableXp | Disable xp_cmdshell. | ✅ | ✅ | ✅ | ✔️ |
AgentStatus | Display if SQL agent is running and obtain agent jobs. | ✅ | ✅ | ✅ | ✔️ |
AgentCmd /c:COMMAND /subsystem:(OPTIONAL) /proxy:(OPTIONAL) | Execute a system command using agent jobs. Optionally specify a subsystem with /subsystem:, this defaults to 'PowerShell'. Optionally specify a SQL Agent proxy account with /proxy:. | ✅ | ✅ | ✅ | ✔️ |
Adsi /adsi:SERVER_NAME /lport:LOCAL_PORT | Obtain cleartext ADSI credentials from a linked ADSI server. | ✅ | ✅ | ✅ | ✔️ |
Clr /dll:DLL /function:FUNCTION | Load and execute a .NET assembly in a custom stored procedure. | ✅ | ✅ | ✅ | ✔️ |
CredentialObjects | Obtain credential objects from sys.credentials. | ✅ | ✅ | ✅ | ✔️ |
OleCmd /c:COMMAND /subsystem:(OPTIONAL) | Execute a system command using OLE automation procedures. | ✅ | ✅ | ✅ | ✔️ |
Proxies | Obtain SQL agent proxy information. | ✅ | ✅ | ✅ | ✔️ |
XpCmd /c:COMMAND | Execute a system command using xp_cmdshell. | ✅ | ✅ | ✅ | ✔️ |
| Module Name | Description | Impersonation | Requires Privileged Context |
|---|
Users | Display all SCCM users. | ✅ | ❎ |
Sites | Display all other sites with data stored. | ✅ | ❎ |
Logons | Display all associated SCCM clients and the last logged in user. | ✅ | ❎ |
Credentials | Display encrypted credentials vaulted by SCCM. | ✅ | ❎ |
TaskList | Display all task sequences, but do not access the task data contents. | ✅ | ❎ |
TaskData | Decrypt all task sequences to plaintext. | ✅ | ❎ |
DecryptCredentials | Decrypt an SCCM credential blob. Must execute in a high-integrity or SYSTEM process on the SCCM server. | ❌ | ✔️ |
AddAdmin /user:DOMAIN\USERNAME /sid:SID | Elevate a supplied account to a 'Full Administrator' in SCCM. | ✅ | ✔️ |
RemoveAdmin /user:ADMIN_ID /remove:STRING | Removes privileges of a user, or remove a user entirely from the SCCM database. | ✅ | ✔️ |
ScriptData | Returns all scripts configured to run in SCCM. | ✅ | ✔️ |
CIData | Returns all CIs configured to run scripts in SCCM. | ✅ | ✔️ |
DecryptCredentials module attempts to decrypt recovered SCCM credential blobs. This module must be ran in a high-integrty or SYSTEM process on an SCCM server.AddAdmin module elevates the specified account to a 'Full Administrator' within SCCM. If target user is already an SCCM user, this module will instead add necessary privileges to elevate. Provide two arguments, either /user:current /sid:current if seeking to add the user currently executing the SQLRecon process as a 'Full Administrator' in SCCM. If seeking to add another user as a 'Full Administrator' in SCCM, specify their domain user name and full SID /user:DOMAIN\USERNAME /sid:S-1-5-.... This module require sysadmin or similar privileges as writing to SCCM database tables is required.RemoveAdmin module removes the privileges of a user by removing a newly added user entirely from the SCCM database. If the user already existed in some capacity this module just removes the three roles that were added to the account via writes to the permission table. Use the arguments provided by output of the sAddAdmin command to run this command. This module require sysadmin or similar privileges as writing to SCCM database tables is required./verbose, /v), which will display all SQL queries that will be executed during module execution./timeout, /t), which takes an integer value for SQL server database connection timeout.links module to include detailed information. Credit to Azaël Martin (n3rada).whoami module to include Windows principals and database users. Credit to Azaël Martin (n3rada).impersonation module to include Windows principals and database users. Credit to Azaël Martin (n3rada).sqlspns enumeration module. Credit to Azaël Martin (n3rada)./enum:info module./subsystem argument to the olecmdexec module, which accepts execution using the CmdExec or PowerShell OLE automation subsystems.AzureAD authentication to EntraID.ModuleHandler.csQueries.cs.EnumerationModules.cs.FormatQuery.cs.SccmModules.cs.ModuleHandler.cs to SqlModules.cs.PrintUtils.cs to Print.cs.SQLServerInfo.cs to Info.cs.iQueryiSearchauthentication directory.Help.cs from a method into a constructor.CaptureHash.cs from a method into a constructor.Impersonate.cs from a method into a constructor.lEnableClr.lDisableClr.lXpCmd.lXpOle.Random.cs.EnableDisable.cs.clr.ole.mapped and roles modules into whoami.lMapped and lRoles modules into lWhoami.iMapped and iRoles modules into iWhoami.