Skip to content

Commit 0928f9f

Browse files
nullbindnullbind
committed
Add Get-SQLDomainAccountPolicy
Add Get-SQLDomainAccountPolicy
1 parent 7c8fb84 commit 0928f9f

2 files changed

Lines changed: 141 additions & 3 deletions

File tree

‎PowerUpSQL.ps1‎

Lines changed: 139 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
File: PowerUpSQL.ps1
44
Author: Scott Sutherland (@_nullbind), NetSPI - 2016
55
Major Contributors: Antti Rantasaari and Eric Gruber
6-
Version: 1.90.113
6+
Version: 1.91.113
77
Description: PowerUpSQL is a PowerShell toolkit for attacking SQL Server.
88
License: BSD 3-Clause
99
Required Dependencies: PowerShell v.2
@@ -7532,7 +7532,7 @@ Function Get-SQLDomainOu
75327532
.EXAMPLE
75337533
PS C:\> Get-SQLDomainOu -Instance SQLServer1\STANDARDDEV2014 -Verbose -UseAdHoc
75347534
.EXAMPLE
7535-
PS C:\> GGet-SQLDomainOu -Instance SQLServer1\STANDARDDEV2014 -Verbose -UseAdHoc -LinkUsername 'domain\user' -LinkPassword 'Password123!'
7535+
PS C:\> Get-SQLDomainOu -Instance SQLServer1\STANDARDDEV2014 -Verbose -UseAdHoc -LinkUsername 'domain\user' -LinkPassword 'Password123!'
75367536
.EXAMPLE
75377537
PS C:\> Get-SQLDomainOu -Instance SQLServer1\STANDARDDEV2014 -Verbose
75387538
.EXAMPLE
@@ -7638,6 +7638,143 @@ Function Get-SQLDomainOu
76387638
}
76397639

76407640

7641+
# ----------------------------------
7642+
# Get-SQLDomainAccountPolicy
7643+
# ----------------------------------
7644+
# Author: Scott Sutherland
7645+
Function Get-SQLDomainAccountPolicy
7646+
{
7647+
<#
7648+
.SYNOPSIS
7649+
Using the OLE DB ADSI provider, query Active Directory for a list of domain account policy
7650+
via the domain logon server associated with the SQL Server. This can be
7651+
done using a SQL Server link (OpenQuery) or AdHoc query (OpenRowset). Use the -UseAdHoc
7652+
flag to switch between modes.
7653+
.PARAMETER Username
7654+
SQL Server or domain account to authenticate with.
7655+
.PARAMETER Password
7656+
SQL Server or domain account password to authenticate with.
7657+
.PARAMETER LinkUsername
7658+
Domain account used to authenticate to LDAP through SQL Server ADSI link.
7659+
.PARAMETER LinkPassword
7660+
Domain account password used to authenticate to LDAP through SQL Server ADSI link.
7661+
.PARAMETER UseAdHoc
7662+
Use adhoc connection for executing the query instead of a server link. The link option (default) will create an ADSI server link and use OpenQuery. The AdHoc option will enable adhoc queries, and use OpenRowSet.
7663+
.PARAMETER Credential
7664+
SQL Server credential.
7665+
.PARAMETER Instance
7666+
SQL Server instance to connection to.
7667+
.PARAMETER Threads
7668+
Number of concurrent host threads.
7669+
.EXAMPLE
7670+
PS C:\> Get-SQLDomainAccountPolicy -Instance SQLServer1\STANDARDDEV2014 -Verbose -UseAdHoc
7671+
.EXAMPLE
7672+
PS C:\> Get-SQLDomainAccountPolicy -Instance SQLServer1\STANDARDDEV2014 -Verbose -UseAdHoc -LinkUsername 'domain\user' -LinkPassword 'Password123!'
7673+
.EXAMPLE
7674+
PS C:\> Get-SQLDomainAccountPolicy -Instance SQLServer1\STANDARDDEV2014 -Verbose
7675+
.EXAMPLE
7676+
PS C:\> Get-SQLDomainAccountPolicy -Instance SQLServer1\STANDARDDEV2014 -Verbose -LinkUsername 'domain\user' -LinkPassword 'Password123!'
7677+
.EXAMPLE
7678+
PS C:\> Get-SQLInstanceLocal | Get-SQLDomainAccountPolicy -Verbose
7679+
#>
7680+
[CmdletBinding()]
7681+
Param(
7682+
[Parameter(Mandatory = $false,
7683+
HelpMessage = 'SQL Server or domain account to authenticate to SQL Server.')]
7684+
[string]$Username,
7685+
7686+
[Parameter(Mandatory = $false,
7687+
HelpMessage = 'SQL Server or domain account password to authenticate to SQL Server.')]
7688+
[string]$Password,
7689+
7690+
[Parameter(Mandatory = $false,
7691+
HelpMessage = 'Domain account used to authenticate to LDAP through SQL Server ADSI link.')]
7692+
[string]$LinkUsername,
7693+
7694+
[Parameter(Mandatory = $false,
7695+
HelpMessage = 'Domain account password used to authenticate to LDAP through SQL Server ADSI link.')]
7696+
[string]$LinkPassword,
7697+
7698+
[Parameter(Mandatory = $false,
7699+
HelpMessage = 'Windows credentials.')]
7700+
[System.Management.Automation.PSCredential]
7701+
[System.Management.Automation.Credential()]$Credential = [System.Management.Automation.PSCredential]::Empty,
7702+
7703+
[Parameter(Mandatory = $false,
7704+
ValueFromPipelineByPropertyName = $true,
7705+
HelpMessage = 'SQL Server instance to connection to.')]
7706+
[string]$Instance,
7707+
7708+
[Parameter(Mandatory = $false,
7709+
HelpMessage = 'Use adhoc connection for executing the query instead of a server link. The link option (default) will create an ADSI server link and use OpenQuery. The AdHoc option will enable adhoc queries, and use OpenRowSet.')]
7710+
[Switch]$UseAdHoc,
7711+
7712+
[Parameter(Mandatory = $false,
7713+
HelpMessage = 'Number of threads. This is the number of instance to process at a time')]
7714+
[int]$Threads = 2,
7715+
7716+
[Parameter(Mandatory = $false,
7717+
HelpMessage = 'Suppress verbose errors. Used when function is wrapped.')]
7718+
[switch]$SuppressVerbose
7719+
)
7720+
7721+
Begin
7722+
{
7723+
# Create data tables for output
7724+
$TblResults = New-Object -TypeName System.Data.DataTable
7725+
7726+
# Setup data table for pipeline threading
7727+
$PipelineItems = New-Object -TypeName System.Data.DataTable
7728+
7729+
# set instance to local host by default
7730+
if(-not $Instance)
7731+
{
7732+
$Instance = $env:COMPUTERNAME
7733+
}
7734+
7735+
# Ensure provided instance is processed
7736+
if($Instance)
7737+
{
7738+
$ProvideInstance = New-Object -TypeName PSObject -Property @{
7739+
Instance = $Instance
7740+
}
7741+
}
7742+
7743+
# Add instance to instance list
7744+
$PipelineItems = $PipelineItems + $ProvideInstance
7745+
}
7746+
7747+
Process
7748+
{
7749+
# Create list of pipeline items
7750+
$PipelineItems = $PipelineItems + $_
7751+
}
7752+
7753+
End
7754+
{
7755+
# Define code to be multi-threaded
7756+
$MyScriptBlock = {
7757+
7758+
# Set instance
7759+
$Instance = $_.Instance
7760+
7761+
# Parse computer name from the instance
7762+
$ComputerName = Get-ComputerNameFromInstance -Instance $Instance
7763+
7764+
# Call Get-SQLDomainObject
7765+
if($UseAdHoc){
7766+
Get-SQLDomainObject -Verbose -Instance $Instance -Username $Username -Password $Password -LinkUsername $LinkUsername -LinkPassword $LinkPassword -LdapFilter '(objectClass=domainDNS)' -LdapFields 'pwdhistorylength,lockoutthreshold,lockoutduration,lockoutobservationwindow,minpwdlength,minpwdage,pwdproperties,whenchanged,gplink' -UseAdHoc
7767+
}else{
7768+
Get-SQLDomainObject -Verbose -Instance $Instance -Username $Username -Password $Password -LinkUsername $LinkUsername -LinkPassword $LinkPassword -LdapFilter '(objectClass=domainDNS)' -LdapFields 'pwdhistorylength,lockoutthreshold,lockoutduration,lockoutobservationwindow,minpwdlength,minpwdage,pwdproperties,whenchanged,gplink'
7769+
}
7770+
}
7771+
7772+
# Run scriptblock using multi-threading
7773+
$PipelineItems | Invoke-Parallel -ScriptBlock $MyScriptBlock -ImportSessionFunctions -ImportVariables -Throttle $Threads -RunspaceTimeout 2 -Quiet -ErrorAction SilentlyContinue
7774+
}
7775+
}
7776+
7777+
76417778
# ----------------------------------
76427779
# Get-SQLDomainGroup
76437780
# ----------------------------------

‎PowerUpSQL.psd1‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#requires -Version 1
22
@{
33
ModuleToProcess = 'PowerUpSQL.psm1'
4-
ModuleVersion = '1.90.113'
4+
ModuleVersion = '1.91.113'
55
GUID = 'dd1fe106-2226-4869-9363-44469e930a4a'
66
Author = 'Scott Sutherland'
77
Copyright = 'BSD 3-Clause'
@@ -31,6 +31,7 @@
3131
'Get-SQLDomainUser',
3232
'Get-SQLDomainGroup',
3333
'Get-SQLDomainOu',
34+
'Get-SQLDomainAccountPolicy',
3435
'Get-SQLFuzzDatabaseName',
3536
'Get-SQLFuzzDomainAccount',
3637
'Get-SQLFuzzObjectName',

0 commit comments

Comments
 (0)