Class: Metasploit::Framework::LoginScanner::MSSQL

Inherits:
Object
  • Object
show all
Includes:
Base, NTLM, RexSocket
Defined in:
lib/metasploit/framework/login_scanner/mssql.rb

Overview

This is the LoginScanner class for dealing with Microsoft SQL Servers. It is responsible for taking a single target, and a list of credentials and attempting them. It then saves the results

Constant Summary collapse

DEFAULT_PORT = 
1433
DEFAULT_REALM = 
'WORKSTATION'
LIKELY_PORTS =

Lifted from lib/msf/core/exploit/mssql.rb

[ 1433, 1434, 1435, 14330, 2533, 9152, 2638 ]
LIKELY_SERVICE_NAMES =

Lifted from lib/msf/core/exploit/mssql.rb

[ 'ms-sql-s', 'ms-sql2000', 'sybase', 'mssql' ]
PRIVATE_TYPES = 
[ :password, :ntlm_hash ]
REALM_KEY = 
Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN

Instance Attribute Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#auth ⇒ Array<String>

Returns Auth The Authentication mechanism to use.

Returns:

  • (Array<String>) —

    Auth The Authentication mechanism to use

See Also:

[View on GitHub]

30
31
32
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 30

def auth
  @auth
end

#domain_controller_rhost ⇒ String

Returns Auth The mssql hostname, required for Kerberos Authentication.

Returns:

  • (String) —

    Auth The mssql hostname, required for Kerberos Authentication

[View on GitHub]

40
41
42
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 40

def domain_controller_rhost
  @domain_controller_rhost
end

#hostname ⇒ Object

Returns the value of attribute hostname.

[View on GitHub]

44
45
46
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 44

def hostname
  @hostname
end

#max_send_size ⇒ Integer

Returns The max size of the data to encapsulate in a single packet.

Returns:

  • (Integer) —

    The max size of the data to encapsulate in a single packet

[View on GitHub]

56
57
58
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 56

def max_send_size
  @max_send_size
end

#send_delay ⇒ Integer

Returns The delay between sending packets.

Returns:

  • (Integer) —

    The delay between sending packets

[View on GitHub]

60
61
62
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 60

def send_delay
  @send_delay
end

#tdsencryption ⇒ Object

Returns the value of attribute tdsencryption.

[View on GitHub]

65
66
67
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 65

def tdsencryption
  @tdsencryption
end

#use_client_as_proof ⇒ Boolean

Returns If a login is successful and this attribute is true - an MSSQL::Client instance is used as proof.

Returns:

  • (Boolean) —

    If a login is successful and this attribute is true - an MSSQL::Client instance is used as proof

[View on GitHub]

52
53
54
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 52

def use_client_as_proof
  @use_client_as_proof
end

#windows_authentication ⇒ Boolean

Returns Whether to use Windows Authentication instead of SQL Server Auth.

Returns:

  • (Boolean) —

    Whether to use Windows Authentication instead of SQL Server Auth.

[View on GitHub]

48
49
50
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 48

def windows_authentication
  @windows_authentication
end

Instance Method Details

#attempt_login(credential) ⇒ Object

[View source] [View on GitHub]

70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 70

def (credential)
  result_options = {
      credential: credential,
      host: host,
      port: port,
      protocol: 'tcp',
      service_name: 'mssql'
  }

  begin
    client = Rex::Proto::MSSQL::Client.new(framework_module, framework, host, port, proxies)
    if client.(credential.public, credential.private, '', credential.realm)
      result_options[:status] = Metasploit::Model::Login::Status::SUCCESSFUL
      if use_client_as_proof
        result_options[:proof] = client
        result_options[:connection] = client.sock
      else
        client.disconnect
      end
    else
      result_options[:status] = Metasploit::Model::Login::Status::INCORRECT
    end
  rescue ::Rex::ConnectionError => e
    result_options[:status] = Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
    result_options[:proof] = e
  rescue => e
    elog(e)
    result_options[:status] = Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
    result_options[:proof] = e
  end

  ::Metasploit::Framework::LoginScanner::Result.new(result_options)
end