Add mssql_syscredentials module

[Dfte]

Description

Multiple MSSQL functionnalities rely on syscredentials which are identities (username and passwords) stored in a encrypted way, inside specific MSSQL databases. These identities are used for example, both for linked servers usage, agent jobs or proxy accounts.

These credentials are stored in two places:

• For jobs, proxy accounts etc inside sys.credential ;
• For linked servers inside master.sys.syslnklgns.

Both these databases cannot be queried unless relying on a DAC (Dedicated Admin Connection) access which, by default, can only be used locally (hence the need of eploying a PowerShell script).

These credentials are ciphered, so it's possible for us to retrieve the credentials allowing for lateral movement, privesc and so on:

All of that is described in two blogpostsfrom:
Antti Rantasaari: https://www.netspi.com/blog/technical-blog/adversary-simulation/decrypting-mssql-credential-passwords/
Scott Sutherland: https://www.netspi.com/blog/technical-blog/network-pentesting/hijacking-sql-server-credentials-with-agent-jobs-for-domain-privilege-escalation/

And the following PowerShell scripts made by the same persons:
https://github.com/NetSPI/Powershell-Modules

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Deprecation of feature or functionality
• This change requires a documentation update
• This requires a third party update (such as Impacket, Dploot, lsassy, etc)
• This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

A simple MSSQL database is required. Linked servers logins can be created using the following SQL queries:

EXEC sp_addlinkedserver
    @server = N'DC22',
    @srvproduct = N'',
    @provider = N'SQLNCLI',
    @datasrc = N'192.168.1.70';

EXEC sp_addlinkedsrvlogin
    @rmtsrvname = N'DC22',
    @useself = N'false',
    @locallogin = N'WHITEFLAG\Administrator',
    @rmtuser = N'WHITEFLAG\Administrator',
    @rmtpassword = N'DasPasswort@WF';

As for proxy account, jobs etc relying on syscredentials, the following query can populate the appropriate DB:

CREATE CREDENTIAL [WHITEFLAG]
WITH 
    IDENTITY = 'WHITEFLAG\test',
    SECRET = N'DasPasswort@WF';
GO

For SMTP sender accounts, use the following:

EXEC dbo.sysmail_add_account_sp
    @account_name = 'SMTP',
    @description = 'SMTP',
    @email_address = 'defte@whiteflag.local',
    @display_name = 'SQL Server',
    @mailserver_name = 'doesntmatter@domain.com',
    @port = 587,
    @enable_ssl = 1,
    @username = 'test@test.com',
    @password = 'MotDePasse';
GO

Screenshots (if appropriate):

Sucessful retrieval of credentials:

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

• I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
• I have performed a self-review of my own code (not an AI review)
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

Important

This module will have to be adapted once #1268 is merged because of the MSSQLEXEC class not having the get_file/put_file functions anymore.

[azoxlpf]

Thanks for the PR!

[NeffIsBack]

Yep definitely looks pretty cool! Ima have to read into that stuff!