DerbyCon2016 - SQL Server Discovery Demo

DerbyCon2016 - SQL Server Discovery Demo

# Import the module
Import-Module C:\PowerUpSQL-master\PowerUpSQL.psd1

# Discover local SQL Server instances
Get-SQLInstanceLocal -Verbose

# Discover SQL Server instances on the domain
Get-SQLInstanceDomain -Verbose | Format-Table -AutoSize

# Discover shared SQL Server service accounts 
# This information is handy when targeting servers for smbrelay attacks
Get-SQLInstanceDomain -Verbose | Group-Object DomainAccount 

# Discover SQL Server instances on the domain running with a specific service account
Get-SQLInstanceDomain -Verbose -DomainAccount sqlsvc

# Determine which SQL Server instances on the domain the current Windows account can log into
Get-SQLInstanceDomain -Verbose | 
Get-SQLConnectionTestThreaded -Verbose -Threads 10 |
Select-Object Instance,Status

# Determine which SQL Server instances on the domain the current Windows account can log into
# This time we store the discovery information as a variable so we can execute attacks against 
# accessible SQL Servers without having to go through discovery against
$Targets = Get-SQLInstanceDomain -Verbose | 
Get-SQLConnectionTestThreaded -Verbose -Threads 10 | 
Where-Object {$_.Status -like "Accessible"}

# Examples of how the variable containing accessible targets can be piped into other 
# PowerUpSQL functions
$Targets 
$Targets | Get-SQLServerInfo -Verbose
$Targets | Get-SQLDatabase