Add local database hash dump for mssql#1257
Conversation
|
Sweeet, what's the hash type? Can you also add a wiki page that documents how you can crack it (preferebly even with the hashcat command so you can just copy&paste)? |
|
There are three type of hashes which are 0000 0100 0200 (the 4 first characters of the hash dump). |
|
|
||
| @requires_admin | ||
| def db_hash(self): | ||
| self.logger.info("Dumping local database users' hashes") |
There was a problem hiding this comment.
We should probably use display instead of info, just like in list_databases()
| @requires_admin | ||
| def db_hash(self): | ||
| self.logger.info("Dumping local database users' hashes") | ||
| query = """ |
There was a problem hiding this comment.
sql_query should be inside a try/except block, just as list_databases() is (here)
There was a problem hiding this comment.
Not necessary but i'll add the lastError block.
| AND sp.name NOT LIKE '##%' | ||
| ORDER BY login_type, sp.name; | ||
| """ | ||
| rows = self.conn.sql_query(query) or [] |
There was a problem hiding this comment.
Please check self.conn.lastError after the query
| """ | ||
| rows = self.conn.sql_query(query) or [] | ||
| if not rows: | ||
| self.logger.display("No databases returned") |
There was a problem hiding this comment.
Should this be No logins returned instead of No databases returned?
There was a problem hiding this comment.
Imo this should also be a .fail() message (applies to all recent PR) to immediately make visible that we failed to retrieve any hashes.
There was a problem hiding this comment.
It doesn't mean we failed retrieving them, it means that there are no hashes to diaply. If there is any error, it should be notified in self.conn.lastError
There was a problem hiding this comment.
Yeah I know. I mean not in the sense of an error, but imo we should use .fail() cause it correctly displays the negative event that we did not retrieve any hashes. E.g.:
Line 74 in d6b3285
NetExec/nxc/modules/badsuccessor.py
Line 190 in d6b3285
etc.
| CASE sp.type_desc | ||
| WHEN 'SQL_LOGIN' THEN 'SQL User' | ||
| ELSE sp.type_desc | ||
| END as login_type, |
There was a problem hiding this comment.
login_type is selected but never displayed, imo it should either be removed if it's not needed or displayed.
|
Latest commit adds the hash algorithm for easier post exploit: 
|
3 participants
Description
This PR adds the --db-hash core option that can be used to dump database users' hashes:
Type of change
Insert an "x" inside the brackets for relevant items (do not delete options)
Setup guide for the review
Run the following command:
Screenshots (if appropriate):
Checklist:
Insert an "x" inside the brackets for completed and relevant items (do not delete options)
poetry run ruff check ., use--fixto automatically fix what it can)tests/e2e_commands.txtfile if necessary (new modules or features are required to be added to the e2e tests)