Skip to content

Commit 9b4114e

Browse files
cgranleese-r7cgranleese-r7
authored
Land rapid7#18961, Adds session documentation
2 parents 685a2e9 + decba43 commit 9b4114e

File tree

10 files changed

+1243
-11
lines changed

10 files changed

+1243
-11
lines changed

‎docs/metasploit-framework.wiki/Metasploit-Guide-MSSQL.md

Lines changed: 183 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,23 @@
33
Microsoft SQL Server (MSSQL) is a relational database management system. Commonly used in conjunction with web applications
44
and other software that need to persist data. MSSQL is a useful target for data extraction and code execution.
55

6-
MySQL is frequently found on port on the following ports:
6+
MSSQL is frequently found on port on the following ports:
77

88
- 1433/TCP
99
- 1434/UDP
1010

11+
For a full list of MSSQL modules run the `search` command within msfconsole:
12+
13+
```msf
14+
msf6 > search mssql
15+
```
16+
17+
Or to search for modules that work with a specific session type:
18+
19+
```msf
20+
msf6 > search session_type:mssql
21+
```
22+
1123
### Lab Environment
1224

1325
Environment setup:
@@ -26,6 +38,176 @@ use auxiliary/admin/mssql/mssql_sql
2638
run rhost=192.168.123.13 username=administrator password=p4$$w0rd sql='select auth_scheme from sys.dm_exec_connections where session_id=@@spid'
2739
```
2840

41+
### Logging in and obtaining a session
42+
To log in or obtain an interactive session on an MSSQL instance running on the target, use mssql_login
43+
44+
```msf
45+
use auxiliary/scanner/mssql_login
46+
run CreateSession=true RPORT=1433 RHOSTS=192.168.2.242 USERNAME=user PASSWORD=password
47+
```
48+
49+
The CreateSession option, when set to true, will result in returning an interactive MSSQL session with the target machine
50+
on a successful login:
51+
52+
```msf
53+
[*] 192.168.2.242:1433 - 192.168.2.242:1433 - MSSQL - Starting authentication scanner.
54+
[!] 192.168.2.242:1433 - No active DB -- Credential data will not be saved!
55+
[+] 192.168.2.242:1433 - 192.168.2.242:1433 - Login Successful: WORKSTATION\user:password
56+
[*] MSSQL session 1 opened (192.168.2.1:60963 -> 192.168.2.242:1433) at 2024-03-15 13:41:31 -0500
57+
[*] 192.168.2.242:1433 - Scanned 1 of 1 hosts (100% complete)
58+
[*] Auxiliary module execution completed
59+
```
60+
61+
Which you can interact with using `sessions -i <session id>` or `sessions -i -1` to interact with the most recently opened session.
62+
63+
```msf
64+
msf6 auxiliary(scanner/mssql/mssql_login) > sessions
65+
66+
Active sessions
67+
===============
68+
69+
Id Name Type Information Connection
70+
-- ---- ---- ----------- ----------
71+
1 mssql MSSQL test @ 192.168.2.242:1433 192.168.2.1:60963 -> 192.168.23.242:1433 (192.168.2.242)
72+
73+
msf6 auxiliary(scanner/mssql/mssql_login) > sessions -i 1
74+
[*] Starting interaction with 1...
75+
76+
mssql @ 192.168.2.242:1433 (master) > query 'select @@version;'
77+
Response
78+
========
79+
80+
# NULL
81+
- ----
82+
0 Microsoft SQL Server 2022 (RTM) - 16.0.1000.6 (X64)
83+
Oct 8 2022 05:58:25
84+
Copyright (C) 2022 Microsoft Corporation
85+
Developer Edition (64-bit) on Windows Server 2022 Stand
86+
ard 10.0 <X64> (Build 20348: ) (Hypervisor)
87+
```
88+
89+
When interacting with a session, the help command can be useful:
90+
91+
```msf
92+
mssql @ 192.168.2.242:1433 (master) > help
93+
94+
Core Commands
95+
=============
96+
97+
Command Description
98+
------- -----------
99+
? Help menu
100+
background Backgrounds the current session
101+
bg Alias for background
102+
exit Terminate the PostgreSQL session
103+
help Help menu
104+
irb Open an interactive Ruby shell on the current session
105+
pry Open the Pry debugger on the current session
106+
sessions Quickly switch to another session
107+
108+
109+
MSSQL Client Commands
110+
=====================
111+
112+
Command Description
113+
------- -----------
114+
query Run a single SQL query
115+
query_interactive Enter an interactive prompt for running multiple SQL queries
116+
117+
118+
Local File System Commands
119+
==========================
120+
121+
Command Description
122+
------- -----------
123+
getlwd Print local working directory (alias for lpwd)
124+
lcat Read the contents of a local file to the screen
125+
lcd Change local working directory
126+
ldir List local files (alias for lls)
127+
lls List local files
128+
lmkdir Create new directory on local machine
129+
lpwd Print local working directory
130+
131+
This session also works with the following modules:
132+
133+
auxiliary/admin/mssql/mssql_enum
134+
auxiliary/admin/mssql/mssql_escalate_dbowner
135+
auxiliary/admin/mssql/mssql_escalate_execute_as
136+
auxiliary/admin/mssql/mssql_exec
137+
auxiliary/admin/mssql/mssql_findandsampledata
138+
auxiliary/admin/mssql/mssql_idf
139+
auxiliary/admin/mssql/mssql_sql
140+
auxiliary/admin/mssql/mssql_sql_file
141+
auxiliary/scanner/mssql/mssql_hashdump
142+
auxiliary/scanner/mssql/mssql_schemadump
143+
exploit/windows/mssql/mssql_payload
144+
```
145+
146+
To interact directly with the session as if in a SQL prompt, you can use the `query` command.
147+
148+
```msf
149+
msf6 auxiliary(scanner/mssql/mssql_login) > sessions -i -1
150+
[*] Starting interaction with 2...
151+
152+
mssql @ 192.168.2.242:1433 (master) > query -h
153+
Usage: query
154+
155+
Run a single SQL query on the target.
156+
157+
OPTIONS:
158+
159+
-h, --help Help menu.
160+
-i, --interact Enter an interactive prompt for running multiple SQL queries
161+
162+
Examples:
163+
164+
query select @@version;
165+
query select user_name();
166+
query select name from master.dbo.sysdatabases;
167+
168+
mssql @ 192.168.2.242:1433 (master) > query 'select @@version;'
169+
Response
170+
========
171+
172+
# NULL
173+
- ----
174+
0 Microsoft SQL Server 2022 (RTM) - 16.0.1000.6 (X64)
175+
Oct 8 2022 05:58:25
176+
Copyright (C) 2022 Microsoft Corporation
177+
Developer Edition (64-bit) on Windows Server 2022 Standard 10.0 <X64> (B
178+
uild 20348: ) (Hypervisor)
179+
```
180+
181+
Alternatively you can enter a SQL prompt via the `query_interactive` command which supports multiline commands:
182+
183+
```msf
184+
mssql @ 192.168.2.242:1433 (master) > query_interactive -h
185+
Usage: query_interactive
186+
187+
Go into an interactive SQL shell where SQL queries can be executed.
188+
To exit, type 'exit', 'quit', 'end' or 'stop'.
189+
190+
mssql @ 192.168.2.242:1433 (master) > query_interactive
191+
[*] Starting interactive SQL shell for mssql @ 192.168.2.242:1433 (master)
192+
[*] SQL commands ending with ; will be executed on the remote server. Use the exit command to exit.
193+
194+
SQL >> select *
195+
SQL *> from information_schema.tables
196+
SQL *> where table_type = 'BASE TABLE';
197+
[*] Executing query: select * from information_schema.tables where table_type = 'BASE TABLE';
198+
Response
199+
========
200+
# TABLE_CATALOG TABLE_SCHEMA TABLE_NAME TABLE_TYPE
201+
- ------------- ------------ ---------- ----------
202+
0 master dbo spt_fallback_db BASE TABLE
203+
1 master dbo spt_fallback_dev BASE TABLE
204+
2 master dbo spt_fallback_usg BASE TABLE
205+
4 master dbo Users BASE TABLE
206+
5 master dbo spt_monitor BASE TABLE
207+
6 master dbo MSreplication_options BASE TABLE
208+
SQL >>
209+
```
210+
29211
### Link crawling
30212

31213
Identify if the SQL server has been configured with trusted links, which allows running queries on other MSSQL instances:

‎docs/metasploit-framework.wiki/Metasploit-Guide-MySQL.md

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,12 @@ There are more modules than listed here, for the full list of modules run the `s
1717
msf6 > search mysql
1818
```
1919

20+
Or to search for modules that work with a specific session type:
21+
22+
```msf
23+
msf6 > search session_type:mysql
24+
```
25+
2026
### Lab Environment
2127

2228
When testing in a lab environment MySQL can either be installed on the host machine or within Docker:
@@ -79,6 +85,158 @@ run cidr:/24:mysql://user:[email protected] threads=50
7985
run cidr:/24:mysql://[email protected] threads=50 pass_file=./wordlist.txt
8086
```
8187

88+
### Obtaining an Interactive Session on the Target
89+
90+
The CreateSession option in `auxiliary/scanner/mysql/msql_login` allows you to obtain an interactive session
91+
for the MySQL client you're connecting to. The run command with CreateSession
92+
set to true should give you an interactive session:
93+
94+
```msf
95+
msf6 > use scanner/mysql/mysql_login
96+
msf6 auxiliary(scanner/mysql/mysql_login) > run rhost=127.0.0.1 rport=4306 username=root password=password createsession=true
97+
98+
[+] 127.0.0.1:4306 - 127.0.0.1:4306 - Found remote MySQL version 11.2.2
99+
[+] 127.0.0.1:4306 - 127.0.0.1:4306 - Success: 'root:password'
100+
[*] MySQL session 1 opened (127.0.0.1:53241 -> 127.0.0.1:4306) at 2024-03-12 12:40:46 -0500
101+
[*] 127.0.0.1:4306 - Scanned 1 of 1 hosts (100% complete)
102+
[*] Auxiliary module execution completed
103+
msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i -1
104+
[*] Starting interaction with 1...
105+
106+
mysql @ 127.0.0.1:4306 >
107+
```
108+
109+
You can interact with your new session using `sessions -i -1` or `sessions <session id>`.
110+
You can also use `help` to get more information about how to use your session.
111+
112+
```msf
113+
msf6 auxiliary(scanner/mysql/mysql_login) > sessions
114+
115+
Active sessions
116+
===============
117+
118+
Id Name Type Information Connection
119+
-- ---- ---- ----------- ----------
120+
2 mssql MSSQL test @ 192.168.2.242:1433 192.168.2.1:61428 -> 192.168.2.242:1433 (192.168.2.242)
121+
3 mysql MySQL root @ 127.0.0.1:4306 127.0.0.1:61450 -> 127.0.0.1:4306 (127.0.0.1)
122+
123+
msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i 3
124+
[*] Starting interaction with 3...
125+
```
126+
127+
When interacting with a session, the help command can be useful:
128+
129+
```msf
130+
mysql @ 127.0.0.1:4306 > help
131+
132+
Core Commands
133+
=============
134+
135+
Command Description
136+
------- -----------
137+
? Help menu
138+
background Backgrounds the current session
139+
bg Alias for background
140+
exit Terminate the PostgreSQL session
141+
help Help menu
142+
irb Open an interactive Ruby shell on the current session
143+
pry Open the Pry debugger on the current session
144+
sessions Quickly switch to another session
145+
146+
147+
MySQL Client Commands
148+
=====================
149+
150+
Command Description
151+
------- -----------
152+
query Run a single SQL query
153+
query_interactive Enter an interactive prompt for running multiple SQL queries
154+
155+
156+
Local File System Commands
157+
==========================
158+
159+
Command Description
160+
------- -----------
161+
getlwd Print local working directory (alias for lpwd)
162+
lcat Read the contents of a local file to the screen
163+
lcd Change local working directory
164+
ldir List local files (alias for lls)
165+
lls List local files
166+
lmkdir Create new directory on local machine
167+
lpwd Print local working directory
168+
169+
This session also works with the following modules:
170+
171+
auxiliary/admin/mysql/mysql_enum
172+
auxiliary/admin/mysql/mysql_sql
173+
auxiliary/scanner/mysql/mysql_file_enum
174+
auxiliary/scanner/mysql/mysql_hashdump
175+
auxiliary/scanner/mysql/mysql_schemadump
176+
auxiliary/scanner/mysql/mysql_version
177+
auxiliary/scanner/mysql/mysql_writable_dirs
178+
exploit/multi/mysql/mysql_udf_payload
179+
exploit/windows/mysql/mysql_mof
180+
exploit/windows/mysql/mysql_start_up
181+
```
182+
183+
Once you've done that, you can run any MySQL query against the target using the `query` command:
184+
185+
```msf
186+
mysql @ 127.0.0.1:4306 > query -h
187+
Usage: query
188+
189+
Run a single SQL query on the target.
190+
191+
OPTIONS:
192+
193+
-h, --help Help menu.
194+
-i, --interact Enter an interactive prompt for running multiple SQL queries
195+
196+
Examples:
197+
198+
query SHOW DATABASES;
199+
query USE information_schema;
200+
query SELECT * FROM SQL_FUNCTIONS;
201+
query SELECT version();
202+
203+
mysql @ 127.0.0.1:4306 > query 'SELECT version();'
204+
Response
205+
========
206+
207+
# version()
208+
- ---------
209+
0 11.2.2-MariaDB-1:11.2.2+maria~ubu2204
210+
```
211+
212+
Alternatively you can enter a SQL prompt via the `query_interactive` command which supports multiline commands:
213+
214+
```msf
215+
mysql @ 127.0.0.1:4306 () > query_interactive -h
216+
Usage: query_interactive
217+
218+
Go into an interactive SQL shell where SQL queries can be executed.
219+
To exit, type 'exit', 'quit', 'end' or 'stop'.
220+
221+
mysql @ 127.0.0.1:4306 () > query_interactive
222+
[*] Starting interactive SQL shell for mysql @ 127.0.0.1:4306 ()
223+
[*] SQL commands ending with ; will be executed on the remote server. Use the exit command to exit.
224+
225+
SQL >> SELECT table_name
226+
SQL *> FROM information_schema.tables
227+
SQL *> LIMIT 2;
228+
[*] Executing query: SELECT table_name FROM information_schema.tables LIMIT 2;
229+
Response
230+
========
231+
232+
# table_name
233+
- ----------
234+
0 ALL_PLUGINS
235+
1 APPLICABLE_ROLES
236+
237+
SQL >>
238+
```
239+
82240
### MySQL Dumping
83241

84242
User and hash dump:

0 commit comments

Comments
 (0)