Abusing SQL Server CLR to obtain a Reverse Shell

Sometimes you need to write a SQL query that you know is going to be really ugly, or you may need to do something that SQL doesn’t support natively. Common Language Runtime (CLR) functions can help in these types of situations.

Last week at work we experienced a major performance hit in one of our (SaaS) applications. We use New Relic’s Application Performance Monitoring (APM) software package which flagged SQL as the culprit. One of our clients had started a training class with ~30 people…something we should normally never notice. We’ve onboarded tens of thousands of new users without batting an eye. Something was definitely sideways, and it was time to dig into SQL to find out.

So, SQL Server Express Edition doesn’t have the Maintenance Plan function - if you want to backup your databases, you have to do it manually. Here’s an easy way to do this: Create a “Backup All Databases” stored procedure. (I ripped the query off of some site) USE master GO CREATE PROCEDURE dbo.BACKUP_ALL_DB AS DECLARE @name VARCHAR(50) DECLARE @path VARCHAR(256) DECLARE @fileName VARCHAR(256) DECLARE @fileDate VARCHAR(20) SET @path = 'C:\Program Files\Microsoft SQL Server\MSSQL13.

If you get an error in the log that looks like this: Exception thrown storing stream in new SqlRemoteBlob: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> Microsoft.Data.SqlRemoteBlobs.BlobStoreException: There was a generic database error. For more information, see the included exception. ---> System.Data.SqlClient.SqlException: Invalid format specification: '%hs does not exist.)' while attempting 'NtCreateFile' on 'D:\\SQLRBSWSS\_Content13bc3f57-1564-4b1d-98db-dc6008bd7d2366c4d9d9-94d2-4e91-9495-4ac5d4898801000031a-000018f4-0012 Check to make sure the destination folders exist. Mine did not.