Skip to content

1. Enumeration

Jump to bottom
Sanjiv Kawa edited this page Aug 7, 2023 · 2 revisions

Enumeration modules do not require authentication.

SqlSpns

SqlSpns - Enumerate current domain for MS SQL SPNs

SQLRecon.exe /enum:sqlspns

Expected Output:

[*] Looking for MSSQL SPNs ...
[*] 3 found.

 |-> ComputerName:  SCCM01.kawalabs.local
 |-> Instance:      SCCM01.kawalabs.local:1433
 |-> AccountSid:    S-1-5-21-3113994310-608060616-2731373765-11604
 |-> AccountName:   mssccm_svc
 |-> AccountCn:     Microsoft SCCM Service
 |-> Service:       MSSQLSvc
 |-> SPN:           MSSQLSvc/SCCM01.kawalabs.local:1433
 |-> LastLogon:     6/15/0423 12:46:25 PM

 |-> ComputerName:  SCCM01.kawalabs.local
 |-> Instance:      SCCM01.kawalabs.local
 |-> AccountSid:    S-1-5-21-3113994310-608060616-2731373765-11604
 |-> AccountName:   mssccm_svc
 |-> AccountCn:     Microsoft SCCM Service
 |-> Service:       MSSQLSvc
 |-> SPN:           MSSQLSvc/SCCM01.kawalabs.local
 |-> LastLogon:     6/15/0423 12:46:25 PM

 |-> ComputerName:  sql02.kawalabs.local
 |-> Instance:      sql02.kawalabs.local:1433
 |-> AccountSid:    S-1-5-21-3113994310-608060616-2731373765-11320
 |-> AccountName:   mssql_svc
 |-> AccountCn:     Microsoft SQL Service
 |-> Service:       MSSQLSvc
 |-> SPN:           MSSQLSvc/sql02.kawalabs.local:1433
 |-> LastLogon:     6/15/0423 12:23:18 PM

SqlSpns - Enumerate another domain for MS SQL SPNs

SQLRecon.exe /enum:sqlspns /domain:kawalabs.local

Expected Output:

[*] 3 found.

 |-> ComputerName:  SCCM01.kawalabs.local
 |-> Instance:      SCCM01.kawalabs.local:1433
 |-> AccountSid:    S-1-5-21-3113994310-608060616-2731373765-11604
 |-> AccountName:   mssccm_svc
 |-> AccountCn:     Microsoft SCCM Service
 |-> Service:       MSSQLSvc
 |-> SPN:           MSSQLSvc/SCCM01.kawalabs.local:1433
 |-> LastLogon:     6/15/0423 12:46:25 PM

 |-> ComputerName:  SCCM01.kawalabs.local
 |-> Instance:      SCCM01.kawalabs.local
 |-> AccountSid:    S-1-5-21-3113994310-608060616-2731373765-11604
 |-> AccountName:   mssccm_svc
 |-> AccountCn:     Microsoft SCCM Service
 |-> Service:       MSSQLSvc
 |-> SPN:           MSSQLSvc/SCCM01.kawalabs.local
 |-> LastLogon:     6/15/0423 12:46:25 PM

 |-> ComputerName:  sql02.kawalabs.local
 |-> Instance:      sql02.kawalabs.local:1433
 |-> AccountSid:    S-1-5-21-3113994310-608060616-2731373765-11320
 |-> AccountName:   mssql_svc
 |-> AccountCn:     Microsoft SQL Service
 |-> Service:       MSSQLSvc
 |-> SPN:           MSSQLSvc/sql02.kawalabs.local:1433
 |-> LastLogon:     6/15/0423 12:23:18 PM
Clone this wiki locally