Skip to content

Commit 2c307f1

Browse files
zgoldman-r7zgoldman-r7
committed
Adds session documentation
add more console output, add to pentesting side split out session, help, query, query_interactive sections add multiline examples update mysql, smb
1 parent 923f4c9 commit 2c307f1

File tree

9 files changed

+1209
-8
lines changed

9 files changed

+1209
-8
lines changed

‎docs/metasploit-framework.wiki/Metasploit-Guide-MSSQL.md

Lines changed: 170 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Microsoft SQL Server (MSSQL) is a relational database management system. Commonly used in conjunction with web applications
44
and other software that need to persist data. MSSQL is a useful target for data extraction and code execution.
55

6-
MySQL is frequently found on port on the following ports:
6+
MSSQL is frequently found on port on the following ports:
77

88
- 1433/TCP
99
- 1434/UDP
@@ -26,6 +26,175 @@ use auxiliary/admin/mssql/mssql_sql
2626
run rhost=192.168.123.13 username=administrator password=p4$$w0rd sql='select auth_scheme from sys.dm_exec_connections where session_id=@@spid'
2727
```
2828

29+
### Logging in and obtaining a session
30+
To log in or obtain an interactive session on an MSSQL instance running on the target, use mssql_login
31+
32+
```msf
33+
use auxiliary/scanner/mssql_login
34+
run CreateSession=true RPORT=1433 RHOSTS=192.168.2.242 USERNAME=user PASSWORD=password
35+
```
36+
37+
The CreateSession option, when set to true, will result in returning an interactive MSSQL session with the target machine
38+
on a successful login:
39+
40+
```msf
41+
[*] 192.168.2.242:1433 - 192.168.2.242:1433 - MSSQL - Starting authentication scanner.
42+
[!] 192.168.2.242:1433 - No active DB -- Credential data will not be saved!
43+
[+] 192.168.2.242:1433 - 192.168.2.242:1433 - Login Successful: WORKSTATION\user:password
44+
[*] MSSQL session 1 opened (192.168.2.1:60963 -> 192.168.2.242:1433) at 2024-03-15 13:41:31 -0500
45+
[*] 192.168.2.242:1433 - Scanned 1 of 1 hosts (100% complete)
46+
[*] Auxiliary module execution completed
47+
```
48+
49+
Which you can interact with using `sessions -i <session id>` or `sessions -1` to interact with the most recently opened session.
50+
51+
```msf
52+
msf6 auxiliary(scanner/mssql/mssql_login) > sessions
53+
54+
Active sessions
55+
===============
56+
57+
Id Name Type Information Connection
58+
-- ---- ---- ----------- ----------
59+
1 mssql MSSQL test @ 192.168.2.242:143 192.168.2.1:60963 -> 192.168.2
60+
3 .242:1433 (192.168.2.242)
61+
62+
msf6 auxiliary(scanner/mssql/mssql_login) > sessions -i 1
63+
[*] Starting interaction with 1...
64+
65+
mssql @ 192.168.2.242:1433 (master) > query 'select @@version;'
66+
Response
67+
========
68+
69+
# NULL
70+
- ----
71+
0 Microsoft SQL Server 2022 (RTM) - 16.0.1000.6 (X64)
72+
Oct 8 2022 05:58:25
73+
Copyright (C) 2022 Microsoft Corporation
74+
Developer Edition (64-bit) on Windows Server 2022 Stand
75+
ard 10.0 <X64> (Build 20348: ) (Hypervisor)
76+
```
77+
78+
When interacting with a session, the help command can be useful:
79+
80+
```msf
81+
mssql @ 192.168.2.242:1433 (master) > help
82+
83+
Core Commands
84+
=============
85+
86+
Command Description
87+
------- -----------
88+
? Help menu
89+
background Backgrounds the current session
90+
bg Alias for background
91+
exit Terminate the PostgreSQL session
92+
help Help menu
93+
irb Open an interactive Ruby shell on the current session
94+
pry Open the Pry debugger on the current session
95+
sessions Quickly switch to another session
96+
97+
98+
MSSQL Client Commands
99+
=====================
100+
101+
Command Description
102+
------- -----------
103+
query Run a single SQL query
104+
query_interactive Enter an interactive prompt for running multiple SQL queri
105+
es
106+
107+
108+
Local File System Commands
109+
==========================
110+
111+
Command Description
112+
------- -----------
113+
getlwd Print local working directory (alias for lpwd)
114+
lcat Read the contents of a local file to the screen
115+
lcd Change local working directory
116+
ldir List local files (alias for lls)
117+
lls List local files
118+
lmkdir Create new directory on local machine
119+
lpwd Print local working directory
120+
121+
This session also works with the following modules:
122+
123+
auxiliary/admin/mssql/mssql_enum
124+
auxiliary/admin/mssql/mssql_escalate_dbowner
125+
auxiliary/admin/mssql/mssql_escalate_execute_as
126+
auxiliary/admin/mssql/mssql_exec
127+
auxiliary/admin/mssql/mssql_findandsampledata
128+
auxiliary/admin/mssql/mssql_idf
129+
auxiliary/admin/mssql/mssql_sql
130+
auxiliary/admin/mssql/mssql_sql_file
131+
auxiliary/scanner/mssql/mssql_hashdump
132+
auxiliary/scanner/mssql/mssql_schemadump
133+
exploit/windows/mssql/mssql_payload
134+
```
135+
136+
To interact directly with the session as if in a SQL prompt, you can use the `query` command.
137+
138+
```msf
139+
msf6 auxiliary(scanner/mssql/mssql_login) > sessions -i -1
140+
[*] Starting interaction with 2...
141+
142+
mssql @ 192.168.2.242:1433 (master) > query -h
143+
Usage: query
144+
145+
Run a single SQL query on the target.
146+
147+
OPTIONS:
148+
149+
-h, --help Help menu.
150+
-i, --interact Enter an interactive prompt for running multiple SQL queries
151+
152+
Examples:
153+
154+
query select @@version;
155+
query select user_name();
156+
query select name from master.dbo.sysdatabases;
157+
158+
mssql @ 192.168.2.242:1433 (master) > query 'select @@version;'
159+
Response
160+
========
161+
162+
# NULL
163+
- ----
164+
0 Microsoft SQL Server 2022 (RTM) - 16.0.1000.6 (X64)
165+
Oct 8 2022 05:58:25
166+
Copyright (C) 2022 Microsoft Corporation
167+
Developer Edition (64-bit) on Windows Server 2022 Standard 10.0 <X64> (B
168+
uild 20348: ) (Hypervisor)
169+
```
170+
171+
Alternatively you can enter a SQL prompt via the `query_interactive` command which supports multiline commands:
172+
173+
```msf
174+
mssql @ 192.168.2.242:1433 (master) > query_interactive -h
175+
Usage: query_interactive
176+
177+
Go into an interactive SQL shell where SQL queries can be executed.
178+
To exit, type 'exit', 'quit', 'end' or 'stop'.
179+
180+
mssql @ 192.168.2.242:1433 (master) > query_interactive
181+
[*] Starting interactive SQL shell for mssql @ 192.168.2.242:1433 (master)
182+
[*] SQL commands ending with ; will be executed on the remote server. Use the exit command to exit.
183+
184+
SQL >> select top 2 table_catalog, table_schema
185+
SQL *> from information_schema.tables;
186+
[*] Executing query: select top 2 table_catalog, table_schema from information_schema.tables;
187+
Response
188+
========
189+
190+
# table_catalog table_schema
191+
- ------------- ------------
192+
0 master dbo
193+
1 master dbo
194+
195+
SQL >>
196+
```
197+
29198
### Link crawling
30199

31200
Identify if the SQL server has been configured with trusted links, which allows running queries on other MSSQL instances:

‎docs/metasploit-framework.wiki/Metasploit-Guide-MySQL.md

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,157 @@ run cidr:/24:mysql://user:[email protected] threads=50
7979
run cidr:/24:mysql://[email protected] threads=50 pass_file=./wordlist.txt
8080
```
8181

82+
### Obtaining an Interactive Session on the Target
83+
84+
The CreateSession option in `scanner/mysql/msql_login` allows you to obtain an interactive session
85+
for the MySQL client you're connecting to. The run command with CreateSession
86+
set to true should give you an interactive session:
87+
88+
```msf
89+
run rhost=127.0.0.1 rport=4306 username=root password=password createsession=true
90+
91+
[+] 127.0.0.1:4306 - 127.0.0.1:4306 - Found remote MySQL version 11.2.2
92+
[+] 127.0.0.1:4306 - 127.0.0.1:4306 - Success: 'root:password'
93+
[*] MySQL session 1 opened (127.0.0.1:53241 -> 127.0.0.1:4306) at 2024-03-12 12:40:46 -0500
94+
[*] 127.0.0.1:4306 - Scanned 1 of 1 hosts (100% complete)
95+
[*] Auxiliary module execution completed
96+
msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i -1
97+
[*] Starting interaction with 1...
98+
99+
mysql @ 127.0.0.1:4306 >
100+
```
101+
102+
You can interact with your new session using `sessions -i -1` or `sessions <session id>`.
103+
You can also use `help` to get more information about how to use your session.
104+
105+
```msf
106+
msf6 auxiliary(scanner/mysql/mysql_login) > sessions
107+
108+
Active sessions
109+
===============
110+
111+
Id Name Type Information Connection
112+
-- ---- ---- ----------- ----------
113+
2 mssql MSSQL test @ 192.168.2.242:1433 192.168.2.1:61428 -> 192.168.2.242:1433 (192.168.2.242)
114+
3 mysql MySQL root @ 127.0.0.1:4306 127.0.0.1:61450 -> 127.0.0.1:4306 (127.0.0.1)
115+
116+
msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i 3
117+
[*] Starting interaction with 3...
118+
```
119+
120+
When interacting with a session, the help command can be useful:
121+
122+
```msf
123+
mysql @ 127.0.0.1:4306 > help
124+
125+
Core Commands
126+
=============
127+
128+
Command Description
129+
------- -----------
130+
? Help menu
131+
background Backgrounds the current session
132+
bg Alias for background
133+
exit Terminate the PostgreSQL session
134+
help Help menu
135+
irb Open an interactive Ruby shell on the current session
136+
pry Open the Pry debugger on the current session
137+
sessions Quickly switch to another session
138+
139+
140+
MySQL Client Commands
141+
=====================
142+
143+
Command Description
144+
------- -----------
145+
query Run a single SQL query
146+
query_interactive Enter an interactive prompt for running multiple SQL queries
147+
148+
149+
Local File System Commands
150+
==========================
151+
152+
Command Description
153+
------- -----------
154+
getlwd Print local working directory (alias for lpwd)
155+
lcat Read the contents of a local file to the screen
156+
lcd Change local working directory
157+
ldir List local files (alias for lls)
158+
lls List local files
159+
lmkdir Create new directory on local machine
160+
lpwd Print local working directory
161+
162+
This session also works with the following modules:
163+
164+
auxiliary/admin/mysql/mysql_enum
165+
auxiliary/admin/mysql/mysql_sql
166+
auxiliary/scanner/mysql/mysql_file_enum
167+
auxiliary/scanner/mysql/mysql_hashdump
168+
auxiliary/scanner/mysql/mysql_schemadump
169+
auxiliary/scanner/mysql/mysql_version
170+
auxiliary/scanner/mysql/mysql_writable_dirs
171+
exploit/multi/mysql/mysql_udf_payload
172+
exploit/windows/mysql/mysql_mof
173+
exploit/windows/mysql/mysql_start_up
174+
```
175+
176+
Once you've done that, you can run any MySQL query against the target using the `query` command.
177+
178+
```msf
179+
mysql @ 127.0.0.1:4306 > query -h
180+
Usage: query
181+
182+
Run a single SQL query on the target.
183+
184+
OPTIONS:
185+
186+
-h, --help Help menu.
187+
-i, --interact Enter an interactive prompt for running multiple SQL queries
188+
189+
Examples:
190+
191+
query SHOW DATABASES;
192+
query USE information_schema;
193+
query SELECT * FROM SQL_FUNCTIONS;
194+
query SELECT version();
195+
196+
mysql @ 127.0.0.1:4306 > query 'SELECT version();'
197+
Response
198+
========
199+
200+
# version()
201+
- ---------
202+
0 11.2.2-MariaDB-1:11.2.2+maria~ubu2204
203+
```
204+
205+
Alternatively you can enter a SQL prompt via the `query_interactive` command which supports multiline commands:
206+
207+
```msf
208+
mysql @ 127.0.0.1:4306 () > query_interactive -h
209+
Usage: query_interactive
210+
211+
Go into an interactive SQL shell where SQL queries can be executed.
212+
To exit, type 'exit', 'quit', 'end' or 'stop'.
213+
214+
mysql @ 127.0.0.1:4306 () > query_interactive
215+
[*] Starting interactive SQL shell for mysql @ 127.0.0.1:4306 ()
216+
[*] SQL commands ending with ; will be executed on the remote server. Use the exit command to exit.
217+
218+
SQL >> SELECT table_name
219+
SQL *> FROM information_schema.tables
220+
SQL *> LIMIT 2;
221+
[*] Executing query: SELECT table_name FROM information_schema.tables LIMIT 2;
222+
Response
223+
========
224+
225+
# table_name
226+
- ----------
227+
0 ALL_PLUGINS
228+
1 APPLICABLE_ROLES
229+
230+
SQL >>
231+
```
232+
82233
### MySQL Dumping
83234

84235
User and hash dump:

0 commit comments

Comments
 (0)