Class: Metasploit::Framework::LoginScanner::MSSQL

Inherits:
Object
  • Object
show all
Includes:
Base, NTLM, RexSocket, MSSQL::Client
Defined in:
lib/metasploit/framework/login_scanner/mssql.rb

Overview

This is the LoginScanner class for dealing with Microsoft SQL Servers. It is responsible for taking a single target, and a list of credentials and attempting them. It then saves the results

Constant Summary collapse

DEFAULT_PORT = 
1433
DEFAULT_REALM = 
'WORKSTATION'
LIKELY_PORTS =

Lifted from lib/msf/core/exploit/mssql.rb

[ 1433, 1434, 1435, 14330, 2533, 9152, 2638 ]
LIKELY_SERVICE_NAMES =

Lifted from lib/msf/core/exploit/mssql.rb

[ 'ms-sql-s', 'ms-sql2000', 'sybase', 'mssql' ]
PRIVATE_TYPES = 
[ :password, :ntlm_hash ]
REALM_KEY = 
Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN

Constants included from MSSQL::Base

MSSQL::Base::ENCRYPT_NOT_SUP, MSSQL::Base::ENCRYPT_OFF, MSSQL::Base::ENCRYPT_ON, MSSQL::Base::ENCRYPT_REQ, MSSQL::Base::STATUS_END_OF_MESSAGE, MSSQL::Base::STATUS_IGNORE_EVENT, MSSQL::Base::STATUS_NORMAL, MSSQL::Base::STATUS_RESETCONNECTION, MSSQL::Base::STATUS_RESETCONNECTIONSKIPTRAN, MSSQL::Base::TYPE_ATTENTION_SIGNAL, MSSQL::Base::TYPE_BULK_LOAD, MSSQL::Base::TYPE_PRE_LOGIN_MESSAGE, MSSQL::Base::TYPE_PRE_TDS7_LOGIN, MSSQL::Base::TYPE_RPC, MSSQL::Base::TYPE_SQL_BATCH, MSSQL::Base::TYPE_SSPI_MESSAGE, MSSQL::Base::TYPE_TABLE_RESPONSE, MSSQL::Base::TYPE_TDS7_LOGIN, MSSQL::Base::TYPE_TRANSACTION_MANAGER_REQUEST

Instance Attribute Summary collapse

Attributes included from Tcp::Client

#max_send_size, #send_delay, #sock

Instance Method Summary collapse

Methods included from MSSQL::Client

#mssql_login, #mssql_prelogin, #mssql_ssl_send_recv, #send_lm, #send_ntlm, #send_spn, #use_ntlm2_session, #use_ntlmv2

Methods included from MSSQL::Base

#mssql_parse_done, #mssql_parse_env, #mssql_parse_error, #mssql_parse_info, #mssql_parse_login_ack, #mssql_parse_reply, #mssql_parse_ret, #mssql_parse_tds_reply, #mssql_parse_tds_row, #mssql_send_recv, #mssql_tds_encrypt

Methods included from Tcp::Client

#chost, #connect, #cport, #disconnect, #proxies, #rhost, #rport, #set_tcp_evasions, #ssl, #ssl_version

Instance Attribute Details

#tdsencryption ⇒ Object

Returns the value of attribute tdsencryption.



35
36
37
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 35

def tdsencryption
  @tdsencryption
end

#windows_authentication ⇒ Boolean

Returns Whether to use Windows Authentication instead of SQL Server Auth.

Returns:

  • (Boolean) —

    Whether to use Windows Authentication instead of SQL Server Auth.



30
31
32
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 30

def windows_authentication
  @windows_authentication
end

Instance Method Details

#attempt_login(credential) ⇒ Object 



40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
 
# File 'lib/metasploit/framework/login_scanner/mssql.rb', line 40

def (credential)
  result_options = {
      credential: credential,
      host: host,
      port: port,
      protocol: 'tcp',
      service_name: 'mssql'
  }

  begin
    if (credential.public, credential.private, '', credential.realm)
      result_options[:status] = Metasploit::Model::Login::Status::SUCCESSFUL
    else
      result_options[:status] = Metasploit::Model::Login::Status::INCORRECT
    end
  rescue ::Rex::ConnectionError => e
    result_options[:status] = Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
    result_options[:proof] = e
  rescue => e
    elog(e)
    result_options[:status] = Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
    result_options[:proof] = e
  end

  ::Metasploit::Framework::LoginScanner::Result.new(result_options)
end