All language subtitles for 3. MSSQL Nmap Scripts

[ELECTRONIC NOISES]

Now we're going to introduce the
Microsoft, most common version

of an SQL Server, MSSQL.

In our environment,
we've got our IP address.

We run an Nmap scan, and we
see we're up against probably

a Microsoft system.

It's also running port 1433.

If we do a service
enumeration scan, we get back

the latest version
of the software,

Microsoft SQL Server 2019.

We can double down on that and
run a script for ms-sql-info.

That'll give us a little more.

We have the service.

We've got the number,
the exact version.

And it could tell us the
various service pack.

Patches applied, it says false.

If we don't know what
that means right now,

we can look it up later.

But currently, we just
want to enumerate and pull

as much information as we can.

The next thing we can
look into is ntlm-info.

And with this, we need
some arguments to tell it

which instance to look at.

We want 1433.

And we got the target name of
MSSQL-SERVER, NetBIOS domain

name of MSSQL-SERVER.

We'll store that for later.

Another script we can run is
an MSSQL brute force, so brute.

And the arguments for this one
are going to be our word lists.

So for our user, userdb=, we
have these on our desktop,

wordlist, common_users.

And then the passdb--

very similar.

And we'll run that.

And it will brute force.

Again, the arguments for the
different scripts that we run

are going to be
based on the script.

Whoever was writing
those scripts

determines what the
variables are called.

We came back with auditor and
jasmine1, dbadmin and bubbles1,

and admin and annamaria.

We'll take advantage of
that in just a second.

Let's see if there's
any empty passwords.

ms-sql-empty-password
and we get one,

username sa with
an empty password.

We could enumerate
that a little more.

Well, let's take advantage
of that Maria password

we came across.

We will run a query,
pass in some arguments,

the username of admin.

The password was annamaria--

query.query.

And we will select everything
from master..syslogins.

And this one, because
it's a weird output

we're going to
output it as normal,

oN, and call it output.text.

And I'll show you what that
looks like in a second.

Let me correct the
syntax near the star.

Let's go with
select, not "slect."

It gave us this database
output, which is a mess.

What we can do, if we go into
root and look at output.txt,

it made this full size.

And we have wordwrap turned off.

We can come in and see it in a
little easier-to-read fashion.

It's a database, so
there's a lot of columns

and a lot of rows.

It could be even
worse potentially.

But some of the logins
are these services.

There are nt services,
which are more helpful.

That's our machine services.

And then it looks like there
are some individual user logins.

There's this BUILTIN user and NT
AUTHORITY SYSTEM also accessed.

We can come back to this
and see what's useful later.

For now, we're
enumerating, so we gather,

gather, gather, gather.

Once you're done
gathering, then we

can go back and
see what is useful.

Let's dump some hashes.

That's another useful thing
to do because dumping hashes

usually gets us--

we can use hashes.

We can pass a hash,
which would let

us access other machines
without necessarily

having the password.

I mean, we do have
passwords here.

But maybe there's stuff that
didn't come with a password.

There's more accounts than
the few that we had before

and some hashes to go with them.

We saw this
MS_PolicyEventProcessingLogin

in that output.

I don't know what we can
deal with it right now.

But it's useful to have.

You never want to count things
out in your enumeration phase.

Let's see if we can
run some actual code.

We need a username.

We will use admin
and annamaria again.

And then what do we actually
want to ask it to do?

The command, we'll have
it run as ipconfig.

We get back the IP
address of the machine.

This default gateway
could be useful to us.

We might want to be
using that later to see

what sort of connections.

But really, what's
helpful is we were

able to run a command in
a shell on their machine

remotely utilizing SQL.

We saw that before with MySQL.

Now we can do it with MSSQL,
which can be quite handy.

In this situation now
instead of an ipconfig,

let's have it do type, which
is the Windows version of cat

if you're more familiar with
Linux than you are Windows.

Let's have it read a file.

So on the C drive, there
was a file flag.txt.

And we got the
output of that file,

which was a hash in this case.

It's useful to know how to
enumerate multiple systems.

If you come across
another version of SQL,

we could go into NSE, go
on the website for Nmap,

and see what other scripts
apply in those situations.

That's how you would do
this enumeration thing.

If you see something
that isn't covered here,

then you at least
have an idea of,

what should we be looking for?

What should we be trying?

That's what we're
trying to do here.