NetSPI / PowerUpSQL

PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server
Other
2.44k stars 460 forks source link

Add param (QueryTarget) to Get-SQLServerLinkCrawl #59

Closed 0xe7 closed 4 years ago

0xe7 commented 4 years ago

The param QueryTarget added to both Get-SQLServerLinkCrawl and Get-SQLServerLinkData so that it's possible to run a query on 1 instance in the link chain rather than every one. QueryTarget expects the same value stored within $Server.Instance as the check is done against this value.

Example:

PS C:\tools\powershell> Get-SQLServerLinkCrawl -instance ic1sql1.child1.internal.zeroday.lab -Query "select * from master.sys.configurations" -QueryTarget ESQL1\SQLEXPRESS

Version     : SQL Server 2014
Instance    : IC1SQL1
CustomQuery :
Sysadmin    : 1
Path        : {IC1SQL1}
User        : ICHILD1\child.admin
Links       : {ISQL1, Access12}

Version     : SQL Server 2014
Instance    : ISQL1
CustomQuery :
Sysadmin    : 0
Path        : {IC1SQL1, ISQL1}
User        : devuser
Links       : {Access_12_Local, ESQL1.external.zeroday.lab}

Version     :
Instance    : Broken Link
CustomQuery :
Sysadmin    :
Path        : {IC1SQL1, Access12}
User        :
Links       : {}

Version     :
Instance    : Broken Link
CustomQuery :
Sysadmin    :
Path        : {IC1SQL1, ISQL1, Access_12_Local}
User        :
Links       : {}

Version     : SQL Server 2014
Instance    : ESQL1\SQLEXPRESS
CustomQuery : {recovery interval (min), allow updates, user connections, locks...}
Sysadmin    : 1
Path        : {IC1SQL1, ISQL1, ESQL1.external.zeroday.lab}
User        : sa
Links       :
nullbind commented 4 years ago

Looks good, thanks man!