search

NetSPI / PowerUpSQL

PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server
Other
2.47k stars 462 forks source link

Adding the ability to execute python commands with the database parameter #57

Closed vsamiamv closed 4 years ago

vsamiamv commented 4 years ago

Adding the ability to execute python commands with the database parameter

Updated the Invoke-SQLOSCmdPython to allow for the database parameter. ran into a couple of instances where the user had execute right on the DB however was not a sysadmin. just added some if statements and the database parameter and kept all the check in place.

HTB example

PS C:\tools> Invoke-SQLOSCmdPython -Username 'REDACTED' -Password 'REDACTED' -Database "POO_PUBLIC" -Instance COMPATIBILITY -Command 'whoami' -Verbose VERBOSE: Creating runspace pool and session states VERBOSE: COMPATIBILITY : Connection Success. VERBOSE: COMPATIBILITY : Executing on POO_PUBLIC VERBOSE: COMPATIBILITY : Show Advanced Options is already enabled. VERBOSE: COMPATIBILITY : External scripts are already enabled. VERBOSE: COMPATIBILITY : The 'external scripts enabled' setting is enabled in runtime.' VERBOSE: COMPATIBILITY : Executing command: whoami VERBOSE: Closing the runspace pool

ComputerName Instance CommandResults

COMPATIBILITY COMPATIBILITY compatibility\poo_public01

nullbind commented 4 years ago

I see what you're saying and that makes a lot of sense. I'll try to test this one out later this week and get it rolled in. Thanks for taking the time to put this together! I appreciate it!

vsamiamv commented 4 years ago

Awesome Thanks!

NotoriousRebel commented 4 years ago

Any updates on this?

nullbind commented 4 years ago

Hey @NotoriousRebel,

Sorry for the delayed response. Merging now, thanks again for the help! :)