All language subtitles for 4. MSSQL Metasploit

[ELECTRONIC NOISES]

Now that we've looked at how
to enumerate MSSQL with Nmap,

let's dig in and see how
we do it with Metasploit.

We have our IP address.

We do a simple Nmap scan,
and we get 1433 along

with a lot of other services
running, but focusing on MSSQL

right now.

We can run that same skin.

Looking at 1433, we'll do
service as well as a script

for MSSQL info.

It's a script we've run before.

And our service
enumeration came back

with Microsoft SQL Server 2019.

We have the same
information from our script.

That is good to double check.

We load up msfconsole.

We did a brute force
using Nmap last time.

This time, we'll use Metasploit
to brute force our way

into user log on and password.

It is an auxiliary
scanner for mssql_login.

We'll set rhosts.

And let's setg rhosts.

That way, it stays
persistent throughout all

of the tools we use.

We'll set user_file
to me this wordlist

from the Desktop, common_users.

I'll set the pass_file to be
the 100 most common passwords.

These wordlists
exist for a reason.

They are the most
common passwords.

I'll set verbose to false.

I'll double check options.

Everything is filled
in that's required,

and we can run that module.

We come up with sa and no
password, which is useful.

And that was quite useful.

The next one, we came
up with database admin

as anamaria and
auditor as nikita.

We'll write all those down, and
we can come back to them later.

The next scanner we're going
to look at is going to be enum.

We've already set our
rhosts because we set it

as a global variable for this
whole Metasploit session.

So you can just run.

It'll try those log-ins.

We're still running the log-in.

It did not load the module.

Let's try that again--

mssql, ping, schemadump,
login, hashdump.

Ah, auxiliary admin
mssql_enum and let's run that.

And it came back with
a lot of information.

And we could dig
through here, see

what audits have been set up.

Some of our database information
that we found last time

using some Nmap scripts,
Metasploit came up with them

with this.

So we'll admin enum script--

module, rather.

If we were to continue with
the auxiliary admin tools,

there is enum and
then sql_logins.

We can run that.

We see that sa is a sysadmin.

That's useful.

Some more log-ins, we'll
write all those down.

We can come back
and use those later.

The last thing we
would want to check

is if we can run commands.

So it's going to be
another auxiliary admin.

And this one instead of
enum is exec for execute.

And we'll set the
command to be whoami.

Let's look at those options.

It'll connect, ask it.

If we can execute whoami,
let's see what it looks like.

And it came back as net
service/mssql/$sqlexpress,

which is what we would
expect the SQL service to be

identified as.

Let's enumerate some
domain accounts.

And to switch it
up, use exploit.

You can use exploit or run.

They both do the same thing.

And it's pulling
some domain accounts.

And it should be quite a list.

We got alice and bob.

You might recognize them from
discussions of encryption.

Again, with enumeration
everything that we find,

we're going to write down.

And we can determine
whether it's useful later.

But during enumeration,
it's all about

gathering, gather, gather,
gather as much as you can.

And that completed.

With that, that's the end
of our SQL enumeration.

And hopefully, you got
something to take with you

for all of your
enumerations here on out.