add mssql_version module #18907

zgoldman-r7 · 2024-03-01T04:22:30Z

Resolves #18684
mssql_ping relies on the SQL Server Browser UDP service at 1434 to be running, so we want another way to get some information on the server. This adds the mssql_version module which attempts to connect directly to mssql and retrieve some information surrounding the version number and whether encryption is supported.

Verification

List the steps needed to make sure this thing works

Start msfconsole
Start a sql server instance
use mssql_version
run rhosts=YOUR_RHOST_HERE

msf6 auxiliary(scanner/mssql/mssql_version) > run rhosts=192.168.2.230

[*] 192.168.2.230:1433    - SQL Server for 192.168.2.230:
[+] 192.168.2.230:1433    - Version: 16.0.1000
[+] 192.168.2.230:1433    - Encryption is unsupported
[*] 192.168.2.230:1433    - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

This also works with a session instead of rhost

run sessions=-1
[*] Using existing session 1
[*] SQL Server for 192.168.2.233:
[+] Version: 16.0.1000
[+] Encryption is unsupported
[*] Auxiliary module execution completed

modules/auxiliary/scanner/mssql/mssql_version.rb

adfoster-r7 · 2024-03-01T10:17:12Z

modules/auxiliary/scanner/mssql/mssql_version.rb

+  end
+
+  def run_host(ip)
+    version = mssql_get_version


Was it not possible to use mssql_prelogin directly without copy/pasting 👀

It looks like no methods currently make use out of the mssql_prelogin result - so updating it to return a hash of metadata doesn't sound too bad to me

Sure, that seems a lot dryer -
Just curious, what do you think about, instead of using all of mssql_prelogin, I factor out the code of each method into a make_prelogin_packet helper?

Splitting out the functionality of mssql_prelogin into smaller reusable blocks also works for me

adfoster-r7 · 2024-03-01T11:12:44Z

modules/auxiliary/scanner/mssql/mssql_version.rb

+    version = mssql_get_version
+    if version && !version.empty?
+      print_status("SQL Server for #{ip}:")
+      print_good("Version: #{version}")


I assume we'll want to report this information into the database similar to the mssql_ping module

metasploit-framework/modules/auxiliary/scanner/mssql/mssql_ping.rb

Lines 57 to 80 in 401cdca

def report_mssql_service(ip,info)

mssql_info = "Version: %s, ServerName: %s, InstanceName: %s, Clustered: %s" % [

info['Version'],

info['ServerName'],

info['InstanceName'],

info['IsClustered']

]

report_service(

:host => ip,

:port => 1434,

:name => "mssql-m",

:proto => "udp",

:info => "TCP: #{info['tcp']}, Servername: #{info['ServerName']}"

)

mssql_tcp_state = (test_connection(ip,info['tcp']) == :up ? "open" : "closed")

report_service(

:host => ip,

:port => info['tcp'],

:name => "mssql",

:info => mssql_info,

:state => mssql_tcp_state

)

end

adfoster-r7 · 2024-03-01T11:13:11Z

modules/auxiliary/scanner/mssql/mssql_version.rb

+  end
+
+  def run_host(ip)
+    version = mssql_get_version


Tracking if the server supports encryption or not may be useful too.

adfoster-r7 · 2024-03-04T22:48:50Z

lib/rex/proto/mssql/client_mixin.rb

+    pkt
+  end
+
+  def mssql_get_version


Instead of this specific mssql_get_version method; it might be a better long-term implementation to just have this method return a hash of the parsed values that the server has returned

i.e. the version number, and whether encryption is supported - and maybe in the future it would have more details

Potentially it could return all of this parsed-metadata for the client to decide what they want to extract

Looks like we had the same thought, I included this in the last commit

adfoster-r7 · 2024-03-04T23:55:58Z

lib/rex/proto/mssql/client.rb

-          pkt_hdr[2] = pkt_data.length + 8
-
-          pkt = pkt_hdr.pack("CCnnCC") + pkt_data
+          pkt = mssql_prelogin_packet

          resp = mssql_send_recv(pkt)


I think if we renamed mssql_get_version and changed it to just handle parsing, we'd be able to reuse it here below and avoid more of the copy/pasta:

def parse_pre_login_response(data)

It would also be unit-testable which would be nice

I like the idea, but can you explain what you're envisioning? Where would we reuse it, and what are you suggesting we restrict from the method?

We can get rid of the first block of copy/pasta on lines

metasploit-framework/lib/rex/proto/mssql/client.rb

Lines 491 to 507 in 95283f7

while resp && resp[0, 1] != "\xff" && resp.length > 5

token = resp.slice!(0, 5)

token = token.unpack("Cnn")

idx -= 5

if token[0] == 0x01

idx += token[1]

break

end

end

if idx > 0

encryption_mode = resp[idx, 1].unpack("C")[0]

else

framework_module.print_error("Unable to parse encryption req " \

"during pre-login, this may not be a MSSQL server")

encryption_mode = ENCRYPT_NOT_SUP

end

and

metasploit-framework/lib/rex/proto/mssql/client.rb

Lines 538 to 555 in 95283f7

idx = 0

while resp && resp[0, 1] != "\xff" && resp.length > 5

token = resp.slice!(0, 5)

token = token.unpack("Cnn")

idx -= 5

if token[0] == 0x01

idx += token[1]

break

end

end

if idx > 0

encryption_mode = resp[idx, 1].unpack("C")[0]

else

framework_module.print_error("Unable to parse encryption req " \

"during pre-login, this may not be a MSSQL server")

encryption_mode = ENCRYPT_NOT_SUP

end

adfoster-r7 · 2024-03-05T00:00:13Z

modules/auxiliary/scanner/mssql/mssql_version.rb

+    ]
+    report_service(
+      host: ip,
+      port: 1433,


Suggested change

port: 1433,

port: rport,

Or if it's not accessible, datastore['RPORT']

modules/auxiliary/scanner/mssql/mssql_version.rb

adfoster-r7 · 2024-03-05T00:00:57Z

modules/auxiliary/scanner/mssql/mssql_version.rb

+    super(
+      'Name' => 'MSSQL Version Utility',
+      'Description' => 'This module simply queries the MSSQL instance for version information.',
+      'Author' => 'MC',


I assume this needs to be updated, unless it's a hacker handle

adfoster-r7 · 2024-03-05T00:02:04Z

modules/auxiliary/scanner/mssql/mssql_version.rb

+  def initialize
+    super(
+      'Name' => 'MSSQL Version Utility',
+      'Description' => 'This module simply queries the MSSQL instance for version information.',


Suggested change

'Description' => 'This module simply queries the MSSQL instance for version information.',

'Description' => 'Executes a TDS7 pre-login request against the MSSQL instance to query for version information.',

adfoster-r7 · 2024-03-05T15:37:14Z

lib/msf/core/exploit/remote/mssql.rb

@@ -53,6 +53,10 @@ def set_session(client)
    @mssql_client = client
  end

+  def mssql_get_version


I wasn't sure if we needed this method or not, since we already have a mssql_prelogin method available - which if we changed it to return a hash, would contain all of the information we need for finger printing the remote mssql instance already

adfoster-r7 · 2024-03-05T15:38:22Z

lib/msf/core/exploit/remote/mssql.rb

@@ -53,6 +53,10 @@ def set_session(client)
    @mssql_client = client
  end

+  def mssql_get_version
+    @mssql_client ||= Rex::Proto::MSSQL::Client.new(self, framework, datastore['RHOST'], datastore['RPORT'])


Maybe we just need a standalone method for creating the mssql client instance here - since the only way to get access to one is via mssql_login - which we don't have creds for

adfoster-r7 · 2024-03-05T15:43:37Z

lib/rex/proto/mssql/client_mixin.rb

+    disconnect if self.sock
+    connect


I think we if we just update the remote/mssql.rb file to allow instantiating a client without needing to perform a login with real creds - we'll be able to get rid of these lines here

But we can still keep a renamed version of this method that focuses on just parsing the pre-login response to return a hash object that the existing code can make use of

adfoster-r7 · 2024-03-05T15:47:30Z

lib/rex/proto/mssql/client_mixin.rb

+    return unless resp
+
+    data = {}
+    while resp


This parsing logic looks like it could be very brittle, if we're targeting other systems the results may not always be in the order we expect it to be

adfoster-r7 · 2024-03-05T15:50:57Z

lib/rex/proto/mssql/client_mixin.rb

+    data = {}
+    while resp
+      token = resp.slice!(0, 1)
+      if token.unpack('C')[0] == 255


We could circle back to this to use bindata, but let's skip that requirement for now - we can just get this PR passing with a unit test that tests this function in isolation i.e. expect(subject.parse_prelogin_packet(buf)).to eq({ version: '...', encryption: false }) and in the future we could swap it out for bindata

adfoster-r7 · 2024-03-05T15:52:34Z

modules/auxiliary/scanner/mssql/mssql_version.rb

+
+  def run
+    if session
+      set_session(session.client)


Not a blocker; we'll still want to rename this on our side - i.e. set_mssql_session or such

adfoster-r7 · 2024-03-05T15:57:52Z

modules/auxiliary/scanner/mssql/mssql_version.rb

+      set_session(session.client)
+    end
+
+    data = mssql_get_version


def create_mssql_client @mssql_client ||= Rex::Proto::MSSQL::Client.new(self, framework, datastore['RHOST'], datastore['RPORT']) end

Suggested change

data = mssql_get_version

def

if session

set_session(session.client)

else

mssql_client = create_mssql_client

mssql_client.connect

end

# ...

begin

# WIll be a hash

response = client.mssql_prelogin

ensure

# Ensure there's cleanup of the socket

client.close unless session

end

# ... log to database etc ...

end

adfoster-r7 · 2024-03-05T19:53:24Z

lib/rex/proto/mssql/client_mixin.rb

+    pkt
+  end
+
+  def parse_prelogin_response(resp)


It'd be great to add tests for this as part of this PR so we can circle back to swapping this out with alternative implementations in the future 👍

Already working on it, just pushed this in the meantime 👍

adfoster-r7 · 2024-03-05T19:53:58Z

lib/rex/proto/mssql/client_mixin.rb

+    end
+
+    if major && minor && build
+      data['Version'] = "#{major}.#{minor}.#{build}"


Suggested change

data['Version'] = "#{major}.#{minor}.#{build}"

data[:version] = "#{major}.#{minor}.#{build}"

Using snake case symbol keys is more idiomatic for modern ruby

adfoster-r7 · 2024-03-05T19:54:10Z

lib/rex/proto/mssql/client_mixin.rb

+      build = resp.slice(version_index+2, 2).unpack('n')[0]
+
+      enc_index = resp.slice(6, 2).unpack('n')[0]
+      data['Encryption'] = resp.slice(enc_index, 1).unpack('C')[0]


Suggested change

data['Encryption'] = resp.slice(enc_index, 1).unpack('C')[0]

data[:encryption] = resp.slice(enc_index, 1).unpack('C')[0]

adfoster-r7 · 2024-03-05T19:54:36Z

lib/rex/proto/mssql/client_mixin.rb

+    end
+
+
+    data['Status'] = 'open' if data['Version'] || data['Encryption']


Suggested change

data['Status'] = 'open' if data['Version'] || data['Encryption']

This seems like a concern that isn't relevant to parsing prelogin response packets 👀

Maybe it's something you want to add to your module, but not here - which offers generic and reusable library code 🤔

adfoster-r7 · 2024-03-05T23:15:06Z

spec/lib/rex/proto/mssql/client_spec.rb

+    before do
+      allow(client).to receive(:parse_prelogin_response).and_call_original
+    end
+


I don't think this is needed?

Suggested change

before do

allow(client).to receive(:parse_prelogin_response).and_call_original

end

adfoster-r7 · 2024-03-05T23:19:48Z

modules/auxiliary/scanner/mssql/mssql_version.rb

+
+  def run
+    if session
+      set_mssql_session(session.client)


Now that I think about it - the version metadata might be cached already on the session object, so we wouldn't need to resend a prelogin request 🤔

modules/auxiliary/scanner/mssql/mssql_version.rb

adfoster-r7 · 2024-04-22T12:21:48Z

modules/auxiliary/scanner/mssql/mssql_version.rb

+    end
+
+    report_mssql_service(mssql_client.address, data)
+    mssql_client.disconnect


The PR needs rebased; and I think this will be brought up as a bug in the new integration tests

…cific

Co-authored-by: jheysel-r7 <[email protected]>

adfoster-r7 · 2024-05-02T15:35:38Z

spec/acceptance/mssql_spec.rb

+                "Version: ",
+                "Encryption is "


Could we throw regexes here, similar to some of the other snippets you've got:

Suggested change

"Version: ",

"Encryption is "

/Version: Microsoft SQL Server \d+.\d+/,

/Encryption: (?:on|off|or whatever)/

adfoster-r7 · 2024-05-02T15:36:02Z

modules/auxiliary/scanner/mssql/mssql_version.rb

+      else
+        data[:encryption] = 'unknown'
+      end
+      print_good("Encryption is #{data[:encryption]}")


Suggested change

print_good("Encryption is #{data[:encryption]}")

print_good("Encryption: #{data[:encryption]}")

adfoster-r7 · 2024-05-03T11:49:33Z

@msjenkins-r7 retest this please

adfoster-r7 · 2024-05-03T13:34:07Z

Release Notes

Adds a new auxiliary/scanner/mssql/mssql_version module for fingerprinting Microsoft SQL Server targets

zgoldman-r7 force-pushed the mssql_version_module branch from 415ebb7 to 95671b9 Compare March 1, 2024 04:25

cgranleese-r7 reviewed Mar 1, 2024

View reviewed changes

modules/auxiliary/scanner/mssql/mssql_version.rb Outdated Show resolved Hide resolved

adfoster-r7 reviewed Mar 1, 2024

View reviewed changes

adfoster-r7 reviewed Mar 4, 2024

View reviewed changes

zgoldman-r7 force-pushed the mssql_version_module branch 2 times, most recently from d3b9d34 to d06df0e Compare March 4, 2024 23:53

adfoster-r7 reviewed Mar 4, 2024

View reviewed changes

adfoster-r7 reviewed Mar 5, 2024

View reviewed changes

modules/auxiliary/scanner/mssql/mssql_version.rb Show resolved Hide resolved

adfoster-r7 reviewed Mar 5, 2024

View reviewed changes

zgoldman-r7 force-pushed the mssql_version_module branch from d06df0e to 93e8f87 Compare March 5, 2024 00:23

adfoster-r7 reviewed Mar 5, 2024

View reviewed changes

zgoldman-r7 force-pushed the mssql_version_module branch 2 times, most recently from c1e87d4 to 669488e Compare March 5, 2024 19:32

adfoster-r7 reviewed Mar 5, 2024

View reviewed changes

zgoldman-r7 force-pushed the mssql_version_module branch 3 times, most recently from 20a6c88 to 16b7cc3 Compare March 5, 2024 20:16

adfoster-r7 reviewed Mar 5, 2024

View reviewed changes

zgoldman-r7 force-pushed the mssql_version_module branch 4 times, most recently from bf79f5e to fb72fd8 Compare March 6, 2024 00:28

jheysel-r7 reviewed Mar 7, 2024

View reviewed changes

modules/auxiliary/scanner/mssql/mssql_version.rb Outdated Show resolved Hide resolved

adfoster-r7 reviewed Apr 22, 2024

View reviewed changes

zgoldman-r7 force-pushed the mssql_version_module branch from 2490915 to f9cb898 Compare April 23, 2024 17:22

zgoldman-r7 and others added 6 commits April 24, 2024 15:06

add mssql_version module

3897b49

add session support, dry out code, update descriptions to be more spe…

6fd8c8b

…cific

add encryption detection, reporting to mssql_version

ae091bf

refactor packet parsing code

d0a714d

add unit test, clean up data hash

d8c7a26

Update modules/auxiliary/scanner/mssql/mssql_version.rb

04c5d8b

Co-authored-by: jheysel-r7 <[email protected]>

zgoldman-r7 force-pushed the mssql_version_module branch from f9cb898 to c990542 Compare April 24, 2024 19:06

zgoldman-r7 force-pushed the mssql_version_module branch from c990542 to 95ca80b Compare May 2, 2024 15:19

adfoster-r7 reviewed May 2, 2024

View reviewed changes

cache prelogin packet

c382066

zgoldman-r7 force-pushed the mssql_version_module branch from 95ca80b to c382066 Compare May 2, 2024 17:51

adfoster-r7 merged commit 4c84f88 into rapid7:master May 3, 2024
63 checks passed

cgranleese-r7 added module rn-modules release notes for new or majorly enhanced modules labels May 9, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add mssql_version module #18907

add mssql_version module #18907

zgoldman-r7 commented Mar 1, 2024 •

edited by cgranleese-r7

Loading

adfoster-r7 Mar 1, 2024

zgoldman-r7 Mar 1, 2024

adfoster-r7 Mar 1, 2024

adfoster-r7 Mar 1, 2024

adfoster-r7 Mar 1, 2024

adfoster-r7 Mar 4, 2024 •

edited

Loading

adfoster-r7 Mar 4, 2024

zgoldman-r7 Mar 4, 2024

adfoster-r7 Mar 4, 2024

zgoldman-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024 •

edited

Loading

adfoster-r7 Mar 5, 2024

zgoldman-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024 •

edited

Loading

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024 •

edited

Loading

adfoster-r7 Mar 5, 2024

adfoster-r7 Mar 5, 2024

adfoster-r7 Apr 22, 2024

adfoster-r7 May 2, 2024

adfoster-r7 May 2, 2024

adfoster-r7 commented May 3, 2024

adfoster-r7 commented May 3, 2024

	def report_mssql_service(ip,info)
	mssql_info = "Version: %s, ServerName: %s, InstanceName: %s, Clustered: %s" % [
	info['Version'],
	info['ServerName'],
	info['InstanceName'],
	info['IsClustered']
	]
	report_service(
	:host => ip,
	:port => 1434,
	:name => "mssql-m",
	:proto => "udp",
	:info => "TCP: #{info['tcp']}, Servername: #{info['ServerName']}"
	)
	mssql_tcp_state = (test_connection(ip,info['tcp']) == :up ? "open" : "closed")
	report_service(
	:host => ip,
	:port => info['tcp'],
	:name => "mssql",
	:info => mssql_info,
	:state => mssql_tcp_state
	)

	end

	while resp && resp[0, 1] != "\xff" && resp.length > 5
	token = resp.slice!(0, 5)
	token = token.unpack("Cnn")
	idx -= 5
	if token[0] == 0x01

	idx += token[1]
	break
	end
	end
	if idx > 0
	encryption_mode = resp[idx, 1].unpack("C")[0]
	else
	framework_module.print_error("Unable to parse encryption req " \
	"during pre-login, this may not be a MSSQL server")
	encryption_mode = ENCRYPT_NOT_SUP
	end

	idx = 0

	while resp && resp[0, 1] != "\xff" && resp.length > 5
	token = resp.slice!(0, 5)
	token = token.unpack("Cnn")
	idx -= 5
	if token[0] == 0x01
	idx += token[1]
	break
	end
	end
	if idx > 0
	encryption_mode = resp[idx, 1].unpack("C")[0]
	else
	framework_module.print_error("Unable to parse encryption req " \
	"during pre-login, this may not be a MSSQL server")
	encryption_mode = ENCRYPT_NOT_SUP
	end

	'Description' => 'This module simply queries the MSSQL instance for version information.',
	'Description' => 'Executes a TDS7 pre-login request against the MSSQL instance to query for version information.',

-    data = mssql_get_version
+def
+    if session
+      set_session(session.client)
+    else
+       mssql_client = create_mssql_client
+       mssql_client.connect
+    end
+    # ...
+    begin
+      # WIll be a hash
+      response = client.mssql_prelogin
+     ensure
+      # Ensure there's cleanup of the socket
+      client.close unless session
+     end
+    # ... log to database etc ...
+end

	data['Version'] = "#{major}.#{minor}.#{build}"
	data[:version] = "#{major}.#{minor}.#{build}"

	data['Encryption'] = resp.slice(enc_index, 1).unpack('C')[0]
	data[:encryption] = resp.slice(enc_index, 1).unpack('C')[0]

		end


		data['Status'] = 'open' if data['Version'] \|\| data['Encryption']

	before do
	allow(client).to receive(:parse_prelogin_response).and_call_original
	end

	print_good("Encryption is #{data[:encryption]}")
	print_good("Encryption: #{data[:encryption]}")

add mssql_version module #18907

add mssql_version module #18907

Conversation

zgoldman-r7 commented Mar 1, 2024 • edited by cgranleese-r7 Loading

Verification

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

adfoster-r7 Mar 4, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

adfoster-r7 Mar 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

adfoster-r7 Mar 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

adfoster-r7 Mar 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

adfoster-r7 commented May 3, 2024

adfoster-r7 commented May 3, 2024

Release Notes

zgoldman-r7 commented Mar 1, 2024 •

edited by cgranleese-r7

Loading

adfoster-r7 Mar 4, 2024 •

edited

Loading

adfoster-r7 Mar 5, 2024 •

edited

Loading

adfoster-r7 Mar 5, 2024 •

edited

Loading

adfoster-r7 Mar 5, 2024 •

edited

Loading