Skip to content

Commit 7c8fb84

Browse files
nullbindnullbind
committed
Add Get-SQLDomainOu
Add Get-SQLDomainOu
1 parent 82fbf35 commit 7c8fb84

2 files changed

Lines changed: 141 additions & 2 deletions

File tree

‎PowerUpSQL.ps1‎

Lines changed: 139 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
File: PowerUpSQL.ps1
44
Author: Scott Sutherland (@_nullbind), NetSPI - 2016
55
Major Contributors: Antti Rantasaari and Eric Gruber
6-
Version: 1.89.113
6+
Version: 1.90.113
77
Description: PowerUpSQL is a PowerShell toolkit for attacking SQL Server.
88
License: BSD 3-Clause
99
Required Dependencies: PowerShell v.2
@@ -7363,6 +7363,8 @@ Function Get-SQLDomainUser
73637363
}
73647364

73657365

7366+
7367+
73667368
# ----------------------------------
73677369
# Get-SQLDomainComputer
73687370
# ----------------------------------
@@ -7499,6 +7501,142 @@ Function Get-SQLDomainComputer
74997501
}
75007502
}
75017503

7504+
# ----------------------------------
7505+
# Get-SQLDomainOu
7506+
# ----------------------------------
7507+
# Author: Scott Sutherland
7508+
Function Get-SQLDomainOu
7509+
{
7510+
<#
7511+
.SYNOPSIS
7512+
Using the OLE DB ADSI provider, query Active Directory for a list of domain organization units (ou)
7513+
via the domain logon server associated with the SQL Server. This can be
7514+
done using a SQL Server link (OpenQuery) or AdHoc query (OpenRowset). Use the -UseAdHoc
7515+
flag to switch between modes.
7516+
.PARAMETER Username
7517+
SQL Server or domain account to authenticate with.
7518+
.PARAMETER Password
7519+
SQL Server or domain account password to authenticate with.
7520+
.PARAMETER LinkUsername
7521+
Domain account used to authenticate to LDAP through SQL Server ADSI link.
7522+
.PARAMETER LinkPassword
7523+
Domain account password used to authenticate to LDAP through SQL Server ADSI link.
7524+
.PARAMETER UseAdHoc
7525+
Use adhoc connection for executing the query instead of a server link. The link option (default) will create an ADSI server link and use OpenQuery. The AdHoc option will enable adhoc queries, and use OpenRowSet.
7526+
.PARAMETER Credential
7527+
SQL Server credential.
7528+
.PARAMETER Instance
7529+
SQL Server instance to connection to.
7530+
.PARAMETER Threads
7531+
Number of concurrent host threads.
7532+
.EXAMPLE
7533+
PS C:\> Get-SQLDomainOu -Instance SQLServer1\STANDARDDEV2014 -Verbose -UseAdHoc
7534+
.EXAMPLE
7535+
PS C:\> GGet-SQLDomainOu -Instance SQLServer1\STANDARDDEV2014 -Verbose -UseAdHoc -LinkUsername 'domain\user' -LinkPassword 'Password123!'
7536+
.EXAMPLE
7537+
PS C:\> Get-SQLDomainOu -Instance SQLServer1\STANDARDDEV2014 -Verbose
7538+
.EXAMPLE
7539+
PS C:\> Get-SQLDomainOu -Instance SQLServer1\STANDARDDEV2014 -Verbose -LinkUsername 'domain\user' -LinkPassword 'Password123!'
7540+
.EXAMPLE
7541+
PS C:\> Get-SQLInstanceLocal | Get-SQLDomainOu -Verbose
7542+
#>
7543+
[CmdletBinding()]
7544+
Param(
7545+
[Parameter(Mandatory = $false,
7546+
HelpMessage = 'SQL Server or domain account to authenticate to SQL Server.')]
7547+
[string]$Username,
7548+
7549+
[Parameter(Mandatory = $false,
7550+
HelpMessage = 'SQL Server or domain account password to authenticate to SQL Server.')]
7551+
[string]$Password,
7552+
7553+
[Parameter(Mandatory = $false,
7554+
HelpMessage = 'Domain account used to authenticate to LDAP through SQL Server ADSI link.')]
7555+
[string]$LinkUsername,
7556+
7557+
[Parameter(Mandatory = $false,
7558+
HelpMessage = 'Domain account password used to authenticate to LDAP through SQL Server ADSI link.')]
7559+
[string]$LinkPassword,
7560+
7561+
[Parameter(Mandatory = $false,
7562+
HelpMessage = 'Windows credentials.')]
7563+
[System.Management.Automation.PSCredential]
7564+
[System.Management.Automation.Credential()]$Credential = [System.Management.Automation.PSCredential]::Empty,
7565+
7566+
[Parameter(Mandatory = $false,
7567+
ValueFromPipelineByPropertyName = $true,
7568+
HelpMessage = 'SQL Server instance to connection to.')]
7569+
[string]$Instance,
7570+
7571+
[Parameter(Mandatory = $false,
7572+
HelpMessage = 'Use adhoc connection for executing the query instead of a server link. The link option (default) will create an ADSI server link and use OpenQuery. The AdHoc option will enable adhoc queries, and use OpenRowSet.')]
7573+
[Switch]$UseAdHoc,
7574+
7575+
[Parameter(Mandatory = $false,
7576+
HelpMessage = 'Number of threads. This is the number of instance to process at a time')]
7577+
[int]$Threads = 2,
7578+
7579+
[Parameter(Mandatory = $false,
7580+
HelpMessage = 'Suppress verbose errors. Used when function is wrapped.')]
7581+
[switch]$SuppressVerbose
7582+
)
7583+
7584+
Begin
7585+
{
7586+
# Create data tables for output
7587+
$TblResults = New-Object -TypeName System.Data.DataTable
7588+
7589+
# Setup data table for pipeline threading
7590+
$PipelineItems = New-Object -TypeName System.Data.DataTable
7591+
7592+
# set instance to local host by default
7593+
if(-not $Instance)
7594+
{
7595+
$Instance = $env:COMPUTERNAME
7596+
}
7597+
7598+
# Ensure provided instance is processed
7599+
if($Instance)
7600+
{
7601+
$ProvideInstance = New-Object -TypeName PSObject -Property @{
7602+
Instance = $Instance
7603+
}
7604+
}
7605+
7606+
# Add instance to instance list
7607+
$PipelineItems = $PipelineItems + $ProvideInstance
7608+
}
7609+
7610+
Process
7611+
{
7612+
# Create list of pipeline items
7613+
$PipelineItems = $PipelineItems + $_
7614+
}
7615+
7616+
End
7617+
{
7618+
# Define code to be multi-threaded
7619+
$MyScriptBlock = {
7620+
7621+
# Set instance
7622+
$Instance = $_.Instance
7623+
7624+
# Parse computer name from the instance
7625+
$ComputerName = Get-ComputerNameFromInstance -Instance $Instance
7626+
7627+
# Call Get-SQLDomainObject
7628+
if($UseAdHoc){
7629+
Get-SQLDomainObject -Verbose -Instance $Instance -Username $Username -Password $Password -LinkUsername $LinkUsername -LinkPassword $LinkPassword -LdapFilter '(objectCategory=organizationalUnit)' -LdapFields 'name,distinguishedname,adspath,instancetype,whencreated,whenchanged' -UseAdHoc
7630+
}else{
7631+
Get-SQLDomainObject -Verbose -Instance $Instance -Username $Username -Password $Password -LinkUsername $LinkUsername -LinkPassword $LinkPassword -LdapFilter '(objectCategory=organizationalUnit)' -LdapFields 'name,distinguishedname,adspath,instancetype,whencreated,whenchanged'
7632+
}
7633+
}
7634+
7635+
# Run scriptblock using multi-threading
7636+
$PipelineItems | Invoke-Parallel -ScriptBlock $MyScriptBlock -ImportSessionFunctions -ImportVariables -Throttle $Threads -RunspaceTimeout 2 -Quiet -ErrorAction SilentlyContinue
7637+
}
7638+
}
7639+
75027640

75037641
# ----------------------------------
75047642
# Get-SQLDomainGroup

‎PowerUpSQL.psd1‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#requires -Version 1
22
@{
33
ModuleToProcess = 'PowerUpSQL.psm1'
4-
ModuleVersion = '1.89.113'
4+
ModuleVersion = '1.90.113'
55
GUID = 'dd1fe106-2226-4869-9363-44469e930a4a'
66
Author = 'Scott Sutherland'
77
Copyright = 'BSD 3-Clause'
@@ -30,6 +30,7 @@
3030
'Get-SQLDomainComputer',
3131
'Get-SQLDomainUser',
3232
'Get-SQLDomainGroup',
33+
'Get-SQLDomainOu',
3334
'Get-SQLFuzzDatabaseName',
3435
'Get-SQLFuzzDomainAccount',
3536
'Get-SQLFuzzObjectName',

0 commit comments

Comments
 (0)