Utility Functions

These are essentially helper functions. Some of them are used by other PowerUpSQL functions, but all of them can be run independently.

Function Name	Description
Get-SQLConnectionObject	Creates a object for connecting to SQL Server.
Get-SQLFuzzObjectName	Enumerates objects based on object id using OBJECT_NAME() and only the Public role.
Get-SQLFuzzDatabaseName	Enumerates databases based on database id using DB_NAME() and only the Public role.
Get-SQLFuzzServerLogin	Enumerates SQL Server Logins based on login id using SUSER_NAME() and only the Public role.
Get-SQLFuzzDomainAccount	Enumerates domain groups, computer accounts, and user accounts based on domain RID using SUSER_SNAME() and only the Public role. Note: In a typical domain 10000 or more is recommended for the EndId.
Get-ComputerNameFromInstance	Parses computer name from a provided instance.
Get-SQLServiceLocal	Returns local SQL Server services.
Create-SQLFileXpDll	Used to create CPP DLLs with exported functions that can be imported as extended stored procedures in SQL Server. Supports arbitrary command execution.
Get-DomainSpn	Returns a list of SPNs for the target domain. Supports authentication from non domain systems.
Get-DomainObject	Used to query domain controllers via LDAP. Supports alternative credentials from non-domain system.
Get-SQLStoredProcedureSQLi	Returns stored procedures using dynamic SQL and the "WITH EXECUTE AS OWNER" clause. If the stored procedure is vulnerable to SQLi it may be possible to impersonate the procedure owner.
Get-SQLServerLoginDefaultPw	Based on the instance name, test if SQL Server is configured with default passwords.
Create-SQLFileXpDll	Used to generate DLLs that can be imported to create a custom stored procedure that executes OS commands
Create-SQLFileCLRDll	Used to generate DLLs that can be imported to create a CLR stored procedure that executes OS commands. It also generates a file containing TSQL code for creating the procedure without the DLL.
Get-SQLAssemblyFile	Returns imported assembly file information for each database. It can also be used to export existing CLR assembly file imports back to a DLL file.
Get-SQLDomainUser	Use OLE DB ADSI connections to grab a list of domain users via SQL Server links (OpenQuery) and adhoc queries (OpenRowSet).
Get-SQLDomainObject	Use OLE DB ADSI connections to grab a list of domain objects via SQL Server links (OpenQuery) and adhoc queries (OpenRowSet).

Examples:

Get-SQLFuzzServerLogin -Verbose -Instance "SQLSVR1\Instance1"
Get-SQLAssemblyFile -Verbose -Instance SQLServer1\Instance1 -ExportFolder c:\temp

Roadmap:

Get-SQLFuzzDatabase
Get-SQLFuzzSchema
Get-SQLDatabaseOrphanUser Get-SQLDatabaseUser - add fuzzing option
Get-SQLStoredProcedureEncrypted Get-SQLDecryptedStoreProcedure Get-SQLDownloadFile Get-SQLDownloadFileAdHocQuery Get-SQLDownloadFileAssembly Get-SQLDownloadFileBulkInsert Get-SQLDownloadFileServerLine Get-SQLDownloadFileXpCmdshell Get-SQLInstalledSoftware Get-SQLServerLogin - add fuzzing option Get-SQLUploadFile Get-SQLUploadFileAdHocQuery Get-SQLUploadFileAgent Get-SQLUploadFileAssembly Get-SQLUploadFileServerLink Get-SQLUploadFileXpCmdshell Invoke-SqlOSCmdServerLinkMd Invoke-SqlOSCmdAdHoQueryMd Invoke-SqlOSCmdAgentAnalysis Invoke-SqlOSCmdAgentOther Invoke-SqlOSCmdAgentSsisExecuteProcessTask Enable-FullRegRead
Disable-FullRegRead