How To Gain Access MsSQL using Metasploit

Nowadays companies runs more SQL Server databases inhouse than any other database platform, according to Embarcadero Technologies’ Database Survey Report, 83 percent of respondents are running SQL Server in their database environment. Database administrators use simple passwords to facilitate their access to databases. In these two cases, many companies are endangered.

 

DB Usage of World

You can gain access the server systems of many enterprise companies using only the Metasploit Framework and a simple password list. Today I will show you how to get MSSQL passwords and what you can do with this valuable information.

We use the “MsSQL Login Module” to detect MsSQL passwords. You can use the following command to select the module.

Syntax example:

use auxiliary/scanner/mssql/mssql_login

We can list the parameters with “options” command.

MsSQL Login Module Options

All required parameters must be set before the “Mssql Login Module” is run. To start the module, there are 3 parameters that you need to specify.

Important Parameters : 

The PASSWORD parameter (Optional) : Specifies which password to authenticate with
The PASS_FILE parameter (Optional) : Specifies which file containing passwords to authenticate with

The RHOSTS parameter : Specifies the target address range 
The RPORT parameter : Specifies the target port
The USERNAME parameter (Optional) : Specifies which username to authenticate as
The USER_FILE parameter (Optional) : Specifies which file containing usernames to authenticate as

Setting up Parameters of MsSQL Login

After setting parameters, we are ready to exploit our module by sending “exploit” command.

Exploiting of MsSQL Login Module

As you see, there are 2 different response;

[-]  means the password we tried is incorrect

[+] means the password we tried is correct

Now we knows the password of MsSQL SA account and we can use another module of Metasploit which named “Mssql Exec” to gain access to the command line of target. To select “Mssql Exec”, we can use following command.

Syntax example:

use auxiliary/admin/mssql/mssql_exec

MsSQL Exec Module Options

All required parameters must be set before the “Mssql Exec Module” is run as it was in the previous module. To start the module, there are 4 parameters that you need to specify

Important Parameters : 

The CMD parameter (Optional) : Specifies which command to execute

The PASSWORD parameter (Optional) : Specifies which password to authenticate with

The RHOST parameter : Specifies the target address 

The RPORT parameter : Specifies the target port

The USERNAME parameter (Optional) : Specifies which username to authenticate as

Setting up Parameters of MsSQL Exec

After setting parameters, we are ready to exploit our module by sending “exploit” command.

"whoami" Command Output

As you see, we have system privileges. For example, running the "ipconfig" command is below.

"ipconfig" Command Output

BONUS : If you are interested in gaining access, I suggest you look at the content below.