PowerUpSQL
PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server
Link: https://github.com/NetSPI/PowerUpSQL
Example:
Or load into memory
Commands:
Find information on local server
PS C:>Get-SQLInstanceLocal | Get-SQLServerInfo
Test Connection to a server
Get-SQLInstanceDomain –Verbose | Get-SQLConnectionTestThreaded –Verbose –Threads 1
0
Search data in SQL instance:
Cheatsheet
SQL Server Discovery Cheats
SQL Server Authentication Cheats
All PowerUpSQL functions support authenticating directly to a known SQL Server instance without having to perform discovery first. You can authenticate using the current domain user credentials or provide an SQL Server login. All PowerUpSQL functions will attempt to authenticate to the provided instance as the current domain user if the username/password parameters are not provided. This also applies if you're running PowerShell through runas /netonly.
Below are some basic examples using the "Get-SQLQuery" function.
SQL Server Login Test Cheats
SQL Server Authenticated Information Gathering Cheats
SQL Server Privilege Escalation Cheats
SQL Server Data Targeting Cheats
Miscellaneous Post Exploitation Cheats
Last updated