Original subtitles

[ELECTRONIC NOISES]

Now that we've looked at how to enumerate MSSQL with Nmap,

let's dig in and see how we do it with Metasploit.

We have our IP address.

We do a simple Nmap scan, and we get 1433 along

with a lot of other services running, but focusing on MSSQL

right now.

We can run that same skin.

Looking at 1433, we'll do service as well as a script

for MSSQL info.

It's a script we've run before.

And our service enumeration came back

with Microsoft SQL Server 2019.

We have the same information from our script.

That is good to double check.

We load up msfconsole.

We did a brute force using Nmap last time.

This time, we'll use Metasploit to brute force our way

into user log on and password.

It is an auxiliary scanner for mssql_login.

We'll set rhosts.

And let's setg rhosts.

That way, it stays persistent throughout all

of the tools we use.

We'll set user_file to me this wordlist

from the Desktop, common_users.

I'll set the pass_file to be the 100 most common passwords.

These wordlists exist for a reason.

They are the most common passwords.

I'll set verbose to false.

I'll double check options.

Everything is filled in that's required,

and we can run that module.

We come up with sa and no password, which is useful.

And that was quite useful.

The next one, we came up with database admin

as anamaria and auditor as nikita.

We'll write all those down, and we can come back to them later.

The next scanner we're going to look at is going to be enum.

We've already set our rhosts because we set it

as a global variable for this whole Metasploit session.

So you can just run.

It'll try those log-ins.

We're still running the log-in.

It did not load the module.

Let's try that again--

mssql, ping, schemadump, login, hashdump.

Ah, auxiliary admin mssql_enum and let's run that.

And it came back with a lot of information.

And we could dig through here, see

what audits have been set up.

Some of our database information that we found last time

using some Nmap scripts, Metasploit came up with them

with this.

So we'll admin enum script--

module, rather.

If we were to continue with the auxiliary admin tools,

there is enum and then sql_logins.

We can run that.

We see that sa is a sysadmin.

That's useful.

Some more log-ins, we'll write all those down.

We can come back and use those later.

The last thing we would want to check

is if we can run commands.

So it's going to be another auxiliary admin.

And this one instead of enum is exec for execute.

And we'll set the command to be whoami.

Let's look at those options.

It'll connect, ask it.

If we can execute whoami, let's see what it looks like.

And it came back as net service/mssql/$sqlexpress,

which is what we would expect the SQL service to be

identified as.

Let's enumerate some domain accounts.

And to switch it up, use exploit.

You can use exploit or run.

They both do the same thing.

And it's pulling some domain accounts.

And it should be quite a list.

We got alice and bob.

You might recognize them from discussions of encryption.

Again, with enumeration everything that we find,

we're going to write down.

And we can determine whether it's useful later.

But during enumeration, it's all about

gathering, gather, gather, gather as much as you can.

And that completed.

With that, that's the end of our SQL enumeration.

And hopefully, you got something to take with you

for all of your enumerations here on out.