Abusing SQL Server CLR to obtain a Reverse Shell

Sometimes you need to write a SQL query that you know is going to be really ugly, or you may need to do something that SQL doesn’t support natively. Common Language Runtime (CLR) functions can help in these types of situations.

Last week at work we experienced a major performance hit in one of our (SaaS) applications. We use New Relic’s Application Performance Monitoring (APM) software package which flagged SQL as the culprit. One of our clients had started a training class with ~30 people…something we should normally never notice. We’ve onboarded tens of thousands of new users without batting an eye. Something was definitely sideways, and it was time to dig into SQL to find out.

SQL Server Express Edition doesn’t have the Maintenance Plan function. If you want to backup your databases, you have to do it manually.

If you get an error in the log that looks like this: “Exception thrown storing stream in new SqlRemoteBlob”, read on…