Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MSSQL] Add module/option for testing *xp_cmdshell* & *xp_dirtree* #261

Open
clem9669 opened this issue Apr 17, 2024 · 0 comments
Open

[MSSQL] Add module/option for testing *xp_cmdshell* & *xp_dirtree* #261

clem9669 opened this issue Apr 17, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@clem9669
Copy link

Hi 馃憢

It would be very nice to have a module or an option for testing if:

  • xp_cmdshell is enabled or the current have sufficient privileges
  • xp_dirtree can be use to grab NetNTLM authentication
$ netexec mssql -u 'MSSQLSERVER' -p 'X' -d certified.htb 10.129.236.111 -L              
LOW PRIVILEGE MODULES
[*] mssql_priv                Enumerate and exploit MSSQL privileges

HIGH PRIVILEGE MODULES (requires admin privs)
[*] empire_exec               Uses Empire's RESTful API to generate a launcher for the specified listener and executes it
[*] met_inject                Downloads the Meterpreter stager and injects it into memory
[*] nanodump                  Get lsass dump using nanodump and parse the result with pypykatz
[*] test_connection           Pings a host
[*] web_delivery              Kicks off a Metasploit Payload using the exploit/multi/script/web_delivery module

$ mssqlclient.py MSSQLSERVER:X@certified.htb -windows-auth                                       

[*] ACK: Result: 1 - Microsoft SQL Server (160 3232)
[!] Press help for extra shell commands
SQL (CERTIFIEDDC\MSSQLSERVER  guest@master)> help

    enable_xp_cmdshell         - you know what it means
    disable_xp_cmdshell         - you know what it means
    xp_cmdshell {cmd}           - executes cmd using xp_cmdshell
    xp_dirtree {path}            - executes xp_dirtree on the path

Cheers 馃殌

@NeffIsBack NeffIsBack added the enhancement New feature or request label Apr 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants