Beyond xp_cmdshell

Presented at DerbyCon 7.0 Legacy (2017), Sept. 22, 2017, 1 p.m. (25 minutes).

Alexander Leary, Scott Sutherland - Beyond xp_cmdshell: Owning the Empire through SQL Server "During this presentation, we’ll cover interesting techniques for executing operating system commands through SQL Server that can be used to avoid detection and maintain persistence during red team engagements. We’ll also talk about automating attacks through PowerShell Empire and PowerUpSQL. This will include a review of command execution through custom extended stored procedures, CLR assemblies, WMI providers, R scripts, python scripts, agent jobs, and custom ole objects. We’ll also dig into some new integrations with PowerShell Empire. All code and slide decks will be released during the presentation. This should be interesting to blue teamers looking for a faster way to test their detective control capabilities and red teamers looking for a practical way to avoid detection while trying to maintain access to their target environments." Alexander Leary and Scott Sutherland conduct penetration testing, red team, and purple team engagements through NetSPI. Scott is the author of PowerUpSQL and Alexander has contributed code to PowerUPSQL and PowerShell Empire. Alexander Leary @0xbadjuju Scott Sutherland @_nullbind

Presenters:

• Alexander Leary
• Scott Sutherland / nullbind   as Scott Sutherland

Links:

• https://www.derbycon.com/friday-schedule/#event-72

Similar Presentations:

• DEF CON 30 (2022) / Empire 4.0 and Beyond Demo
• DerbyCon 6.0 Recharge (2016) / A Year in the Empire
• DEF CON 32 (2024) / Long Live Empire: A C2 Workshop for Modern Red Teaming Workshop