Ms-sql-s Exploit Metasploit

0 views

Skip to first unread message

Rebbeca Schulke

unread,

Aug 3, 2024, 2:04:56 PM8/3/24

to arethatre

This page contains detailed information about how to use the exploit/windows/mssql/mssql_payload metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

This module executes an arbitrary payload on a Microsoft SQLServer by using the "xp_cmdshell" stored procedure.Currently, three delivery methods are supported. First, theoriginal method uses Windows 'debug.com'. File sizerestrictions are avoided by incorporating the debug bypassmethod presented by SecureStat at Defcon 17. Since thismethod invokes ntvdm, it is not available on x64 systems. Asecond method takes advantage of the Command Stagersubsystem. This allows using various techniques, such asusing a TFTP server, to send the executable. By default theCommand Stager uses 'wcsript.exe' to generate the executableon the target. Finally, ReL1K's latest method utilizesPowerShell to transmit and recreate the payload on thetarget. NOTE: This module will leave a payload executable onthe target system when the attack is finished.

The assessment in question concerns a network of three boxes, two of which can only be accessed from within the internal network, and one of which has itself (mostly) exposed to the outside world. I'll be exploiting flaws on the exposed box to then access the other two boxes within the internal network

The current operating system of the exposed box is Windows 2008 R2 Enterprise, however you'll notice on port 22, an OpenSSH instance to an linux box. Appears to be another box on the internal network exposed, however without credentials or even valid usernames, bruteforce is useless.

Script scan results on SMB aka Server Message Block reveals authentication is required, so share enumeration is impossible. An exposed MSSQL server could come in use later and perhaps brute force could be done on it with the default sa username however, I'll go after the IIS (Internet Information Service) HTTP daemon web server.

We'll craft a POST request like so that should allow us to interact with the service from the information garnered in the output. I'll be using SearchContact as my operation, and will attempt to perform SQL injection.

The default john-the-ripper from your GNU/Linux distributions will not work with this, as it does not have the source patches to support mssql12 hashes, but Jumbo john contains support for such hash types.

According to the module, schelevator should work. However, the current build of the system is 7601, so this is not the case. I'll attempt to do this manually instead. A useful tool for sucha task is Windows Exploit Suggester

One useful exploit that seems to work best through experience is MS16-032. The metasploit module also seems to break occasionally for me in other cases, so ill refrain from using it and opt for the Powershell version.
Found here courtesy of FuzzySec.

As we have already mentioned SQL servers are running by default on port 1433.However in some cases they can be found on a different port.So how can we identify the existence of an SQL server on a system?The answer is through the SQL server browser service which runs on UDP port 1434.This service can provide us with the instance name,the version number and the exact port that the database is running.A UDP Nmap scan must be performed in order to discover these information as it can be seen from the next image:

Another tool that can help us to discover SQL servers on remote hosts is the metasploit module mssql_ping.The information that we can obtain from this module is actually the same as the Nmap UDP scan that we executed before but it will also returns and the pipe name.

This is the most important part as if we manage to obtain somehow valid credentials we can connect directly through the database and we can start to extract data.Some common locations that we can discover database credentials are the following:

Now that we have the credentials we can use a variety of other metasploit modules that will allow us to discover more information about the database.The first module is the mssql_enum which it will perform multiple security checks against the SQL Server.These checks can assist us to conduct further post exploitation activities against the database.The next three images are showing what kind of information we can harvest from this module:

The fact that the xp_cmdshell is enabled means that we can execute commands on the remote system through the SQL Server.Of course the first thing that comes to our minds is to add another account and to put it on the local administrator group in order to have permanent access to the box.Metasploit framework has an appropriate module for this work.Below is a sample of the usage of this module.

The purpose of this article is to provide an overview to the penetration tester about common tools and methods when he has to assess Microsoft SQL servers.It is also very important to know the structure of an SQL server and what we have to look for as a penetration tester so it is recommended to create our own SQL database in our lab in order to understand better how it works and what these modules are doing exactly when interacting with the database.