mirror of
https://github.com/nmap/nmap.git
synced 2025-12-07 21:21:31 +00:00
o [NSE] Merged the ms-sql branch with several improvements and changes to the
ms-sql scripts and library: - Improved version detection - Improved server discovery - Add support for named pipes - Add support for integrated authentication - Add support for connecting to instances by name or port - Improved script and library stability - Improved script and library documentation [Patrik Karlsson, Chris Woodbury]
This commit is contained in:
patrik
@@ -1,10 +1,19 @@
|
||||
-- -*- mode: lua -*-
|
||||
-- vim: set filetype=lua :
|
||||
|
||||
description = [[
|
||||
Queries Microsoft SQL Server (ms-sql) for a list of tables per database.
|
||||
|
||||
The sysdatabase table should be accessible by more or less everyone
|
||||
The script attempts to use the sa account over any other if it has
|
||||
the password in the registry. If not the first account in the
|
||||
registry is used.
|
||||
SQL Server credentials required: Yes (use <code>ms-sql-brute</code>, <code>ms-sql-empty-password</code>
|
||||
and/or <code>mssql.username</code> & <code>mssql.password</code>)
|
||||
Run criteria:
|
||||
* Host script: Will run if the <code>mssql.instance-all</code>, <code>mssql.instance-name</code>
|
||||
or <code>mssql.instance-port</code> script arguments are used (see mssql.lua).
|
||||
* Port script: Will run against any services identified as SQL Servers, but only
|
||||
if the <code>mssql.instance-all</code>, <code>mssql.instance-name</code>
|
||||
and <code>mssql.instance-port</code> script arguments are NOT used.
|
||||
|
||||
The sysdatabase table should be accessible by more or less everyone.
|
||||
|
||||
Once we have a list of databases we iterate over it and attempt to extract
|
||||
table names. In order for this to succeed we need to have either
|
||||
@@ -13,27 +22,24 @@ database we successfully enumerate tables from we mark as finished, then
|
||||
iterate over known user accounts until either we have exhausted the users
|
||||
or found all tables in all the databases.
|
||||
|
||||
Tables installed by default are excluded.
|
||||
System databases are excluded.
|
||||
|
||||
NOTE: Communication with instances via named pipes depends on the <code>smb</code>
|
||||
library. To communicate with (and possibly to discover) instances via named pipes,
|
||||
the host must have at least one SMB port (e.g. TCP 445) that was scanned and
|
||||
found to be open. Additionally, named pipe connections may require Windows
|
||||
authentication to connect to the Windows host (via SMB) in addition to the
|
||||
authentication required to connect to the SQL Server instances itself. See the
|
||||
documentation and arguments for the <code>smb</code> library for more information.
|
||||
|
||||
NOTE: By default, the ms-sql-* scripts may attempt to connect to and communicate
|
||||
with ports that were not included in the port list for the Nmap scan. This can
|
||||
be disabled using the <code>mssql.scanned-ports-only</code> script argument.
|
||||
]]
|
||||
|
||||
author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require 'shortport'
|
||||
require 'stdnse'
|
||||
require 'mssql'
|
||||
|
||||
dependencies = {"ms-sql-brute", "ms-sql-empty-password"}
|
||||
|
||||
---
|
||||
-- @args mssql.username specifies the username to use to connect to
|
||||
-- the server. This option overrides any accounts found by
|
||||
-- the <code>ms-sql-brute</code> and <code>ms-sql-empty-password</code> scripts.
|
||||
--
|
||||
-- @args mssql.password specifies the password to use to connect to
|
||||
-- the server. This option overrides any accounts found by
|
||||
-- the <code>ms-sql-brute</code> and <code>ms-sql-empty-password</code> scripts.
|
||||
-- @usage
|
||||
-- nmap -p 1433 --script ms-sql-tables --script-args mssql.username=sa,mssql.password=sa <host>
|
||||
--
|
||||
-- @args ms-sql-tables.maxdb Limits the amount of databases that are
|
||||
-- processed and returned (default 5). If set to zero or less
|
||||
@@ -46,9 +52,8 @@ dependencies = {"ms-sql-brute", "ms-sql-empty-password"}
|
||||
-- the keywords
|
||||
--
|
||||
-- @output
|
||||
-- PORT STATE SERVICE
|
||||
-- 1433/tcp open ms-sql-s
|
||||
-- | ms-sql-tables:
|
||||
-- | [192.168.100.25\MSSQLSERVER]
|
||||
-- | webshop
|
||||
-- | table column type length
|
||||
-- | payments user_id int 4
|
||||
@@ -72,15 +77,28 @@ dependencies = {"ms-sql-brute", "ms-sql-empty-password"}
|
||||
-- | users password varchar 50
|
||||
-- |_ users fullname varchar 100
|
||||
|
||||
-- Version 0.1
|
||||
-- Created 01/17/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||
-- Revised 04/02/2010 - v0.2
|
||||
-- - Added support for filters
|
||||
-- - Changed output formatting of restrictions
|
||||
-- - Added parameter information in output if parameters are using their
|
||||
-- defaults.
|
||||
-- Revised 02/01/2011 - v0.3 (Chris Woodbury)
|
||||
-- - Added ability to run against all instances on a host;
|
||||
-- - Added compatibility with changes in mssql.lua
|
||||
|
||||
portrule = shortport.port_or_service(1433, "ms-sql-s")
|
||||
author = "Patrik Karlsson"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
require 'shortport'
|
||||
require 'stdnse'
|
||||
require 'mssql'
|
||||
|
||||
dependencies = {"ms-sql-brute", "ms-sql-empty-password", "ms-sql-discover"}
|
||||
|
||||
hostrule = mssql.Helper.GetHostrule_Standard()
|
||||
portrule = mssql.Helper.GetPortrule_Standard()
|
||||
|
||||
local function table_contains( tbl, val )
|
||||
for k,v in pairs(tbl) do
|
||||
@@ -91,17 +109,15 @@ local function table_contains( tbl, val )
|
||||
return false
|
||||
end
|
||||
|
||||
action = function( host, port )
|
||||
|
||||
local status, result, dbs, tables, helper
|
||||
local username = stdnse.get_script_args( 'mssql.username' )
|
||||
local password = stdnse.get_script_args( 'mssql.password' ) or ""
|
||||
local function process_instance( instance )
|
||||
|
||||
local status, result, dbs, tables
|
||||
|
||||
local output = {}
|
||||
local exclude_dbs = { "'master'", "'tempdb'", "'model'", "'msdb'" }
|
||||
local db_query
|
||||
local done_dbs = {}
|
||||
local creds = {}
|
||||
local db_limit, tbl_limit
|
||||
|
||||
local DB_COUNT = stdnse.get_script_args( {'ms-sql-tables.maxdb', 'mssql-tables.maxdb'} )
|
||||
@@ -122,8 +138,8 @@ action = function( host, port )
|
||||
end
|
||||
|
||||
-- Build the keyword filter
|
||||
if ( nmap.registry.args['mssql-tables.keywords'] ) then
|
||||
local keywords = nmap.registry.args['mssql-tables.keywords']
|
||||
if ( stdnse.get_script_args( {'ms-sql-tables.keywords', 'mssql-tables.keywords' } ) ) then
|
||||
local keywords = stdnse.get_script_args( {'ms-sql-tables.keywords', 'mssql-tables.keywords' } )
|
||||
local tmp_tbl = {}
|
||||
|
||||
if( type(keywords) == 'string' ) then
|
||||
@@ -142,110 +158,123 @@ action = function( host, port )
|
||||
|
||||
db_query = ("SELECT %s name from master..sysdatabases WHERE name NOT IN (%s)"):format(db_limit, stdnse.strjoin(",", exclude_dbs))
|
||||
|
||||
if ( username ) then
|
||||
creds[username] = password
|
||||
elseif ( not(username) and nmap.registry.mssqlusers ) then
|
||||
-- do we have a sysadmin?
|
||||
if ( nmap.registry.mssqlusers.sa ) then
|
||||
creds["sa"] = nmap.registry.mssqlusers.sa
|
||||
else
|
||||
creds = nmap.registry.mssqlusers
|
||||
end
|
||||
end
|
||||
|
||||
-- If we don't have valid creds, simply fail silently
|
||||
if ( not(creds) ) then
|
||||
return
|
||||
end
|
||||
|
||||
for username, password in pairs( creds ) do
|
||||
helper = mssql.Helper:new()
|
||||
status, result = helper:Connect(host, port)
|
||||
if ( not(status) ) then
|
||||
return " \n\n" .. result
|
||||
end
|
||||
|
||||
status, result = helper:Login( username, password, nil, host.ip )
|
||||
if ( not(status) ) then
|
||||
stdnse.print_debug("ERROR: %s", result)
|
||||
break
|
||||
end
|
||||
|
||||
status, dbs = helper:Query( db_query )
|
||||
|
||||
if ( status ) then
|
||||
-- all done?
|
||||
if ( #done_dbs == #dbs.rows ) then
|
||||
local creds = mssql.Helper.GetLoginCredentials_All( instance )
|
||||
if ( not creds ) then
|
||||
output = "ERROR: No login credentials."
|
||||
else
|
||||
for username, password in pairs( creds ) do
|
||||
local helper = mssql.Helper:new()
|
||||
status, result = helper:ConnectEx( instance )
|
||||
if ( not(status) ) then
|
||||
table.insert(output, "ERROR: " .. result)
|
||||
break
|
||||
end
|
||||
|
||||
for k, v in pairs(dbs.rows) do
|
||||
if ( not( table_contains( done_dbs, v[1] ) ) ) then
|
||||
query = [[ SELECT so.name 'table', sc.name 'column', st.name 'type', sc.length
|
||||
FROM %s..syscolumns sc, %s..sysobjects so, %s..systypes st
|
||||
WHERE so.id = sc.id AND sc.xtype=st.xtype AND
|
||||
so.id IN (SELECT %s id FROM %s..sysobjects WHERE xtype='U') %s ORDER BY so.name, sc.name, st.name]]
|
||||
query = query:format( v[1], v[1], v[1], tbl_limit, v[1], keywords_filter)
|
||||
status, tables = helper:Query( query )
|
||||
if ( not(status) ) then
|
||||
stdnse.print_debug(tables)
|
||||
else
|
||||
local item = {}
|
||||
item = mssql.Util.FormatOutputTable( tables, true )
|
||||
if ( #item == 0 and keywords_filter ~= "" ) then
|
||||
table.insert(item, "Filter returned no matches")
|
||||
|
||||
if ( status ) then
|
||||
status = helper:Login( username, password, nil, instance.host.ip )
|
||||
end
|
||||
|
||||
if ( status ) then
|
||||
status, dbs = helper:Query( db_query )
|
||||
end
|
||||
|
||||
if ( status ) then
|
||||
-- all done?
|
||||
if ( #done_dbs == #dbs.rows ) then
|
||||
break
|
||||
end
|
||||
|
||||
for k, v in pairs(dbs.rows) do
|
||||
if ( not( table_contains( done_dbs, v[1] ) ) ) then
|
||||
query = [[ SELECT so.name 'table', sc.name 'column', st.name 'type', sc.length
|
||||
FROM %s..syscolumns sc, %s..sysobjects so, %s..systypes st
|
||||
WHERE so.id = sc.id AND sc.xtype=st.xtype AND
|
||||
so.id IN (SELECT %s id FROM %s..sysobjects WHERE xtype='U') %s ORDER BY so.name, sc.name, st.name]]
|
||||
query = query:format( v[1], v[1], v[1], tbl_limit, v[1], keywords_filter)
|
||||
status, tables = helper:Query( query )
|
||||
if ( not(status) ) then
|
||||
stdnse.print_debug(tables)
|
||||
else
|
||||
local item = {}
|
||||
item = mssql.Util.FormatOutputTable( tables, true )
|
||||
if ( #item == 0 and keywords_filter ~= "" ) then
|
||||
table.insert(item, "Filter returned no matches")
|
||||
end
|
||||
item.name = v[1]
|
||||
|
||||
table.insert(output, item)
|
||||
table.insert(done_dbs, v[1])
|
||||
end
|
||||
item.name = v[1]
|
||||
|
||||
table.insert(output, item)
|
||||
table.insert(done_dbs, v[1])
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
helper:Disconnect()
|
||||
end
|
||||
helper:Disconnect()
|
||||
end
|
||||
|
||||
local pos = 1
|
||||
local restrict_tbl = {}
|
||||
|
||||
if ( stdnse.get_script_args( {'ms-sql-tables.keywords', 'mssql-tables.keywords' } ) ) then
|
||||
tmp = stdnse.get_script_args( {'ms-sql-tables.keywords', 'mssql-tables.keywords' } )
|
||||
if ( type(tmp) == 'table' ) then
|
||||
tmp = stdnse.strjoin(',', tmp)
|
||||
end
|
||||
table.insert(restrict_tbl, 1, ("Filter: %s"):format(tmp))
|
||||
pos = pos + 1
|
||||
else
|
||||
table.insert(restrict_tbl, 1, "No filter (see ms-sql-tables.keywords)")
|
||||
end
|
||||
|
||||
if ( DB_COUNT > 0 ) then
|
||||
local tmp = ("Output restricted to %d databases"):format(DB_COUNT)
|
||||
if ( not(stdnse.get_script_args( { 'ms-sql-tables.maxdb', 'mssql-tables.maxdb' } ) ) ) then
|
||||
tmp = tmp .. " (see ms-sql-tables.maxdb)"
|
||||
end
|
||||
table.insert(restrict_tbl, 1, tmp)
|
||||
pos = pos + 1
|
||||
end
|
||||
|
||||
if ( TABLE_COUNT > 0 ) then
|
||||
local tmp = ("Output restricted to %d tables"):format(TABLE_COUNT)
|
||||
if ( not(stdnse.get_script_args( { 'ms-sql-tables.maxtables', 'mssql-tables.maxtables' } ) ) ) then
|
||||
tmp = tmp .. " (see ms-sql-tables.maxtables)"
|
||||
end
|
||||
table.insert(restrict_tbl, 1, tmp)
|
||||
pos = pos + 1
|
||||
end
|
||||
|
||||
if ( 1 < pos and #output > 0) then
|
||||
restrict_tbl.name = "Restrictions"
|
||||
table.insert(output, "")
|
||||
table.insert(output, restrict_tbl)
|
||||
end
|
||||
|
||||
output = stdnse.format_output( true, output )
|
||||
local pos = 1
|
||||
local restrict_tbl = {}
|
||||
|
||||
return output
|
||||
if ( stdnse.get_script_args( {'ms-sql-tables.keywords', 'mssql-tables.keywords' } ) ) then
|
||||
tmp = stdnse.get_script_args( {'ms-sql-tables.keywords', 'mssql-tables.keywords' } )
|
||||
if ( type(tmp) == 'table' ) then
|
||||
tmp = stdnse.strjoin(',', tmp)
|
||||
end
|
||||
table.insert(restrict_tbl, 1, ("Filter: %s"):format(tmp))
|
||||
pos = pos + 1
|
||||
else
|
||||
table.insert(restrict_tbl, 1, "No filter (see ms-sql-tables.keywords)")
|
||||
end
|
||||
|
||||
if ( DB_COUNT > 0 ) then
|
||||
local tmp = ("Output restricted to %d databases"):format(DB_COUNT)
|
||||
if ( not(stdnse.get_script_args( { 'ms-sql-tables.maxdb', 'mssql-tables.maxdb' } ) ) ) then
|
||||
tmp = tmp .. " (see ms-sql-tables.maxdb)"
|
||||
end
|
||||
table.insert(restrict_tbl, 1, tmp)
|
||||
pos = pos + 1
|
||||
end
|
||||
|
||||
if ( TABLE_COUNT > 0 ) then
|
||||
local tmp = ("Output restricted to %d tables"):format(TABLE_COUNT)
|
||||
if ( not(stdnse.get_script_args( { 'ms-sql-tables.maxtables', 'mssql-tables.maxtables' } ) ) ) then
|
||||
tmp = tmp .. " (see ms-sql-tables.maxtables)"
|
||||
end
|
||||
table.insert(restrict_tbl, 1, tmp)
|
||||
pos = pos + 1
|
||||
end
|
||||
|
||||
if ( 1 < pos and type( output ) == "table" and #output > 0) then
|
||||
restrict_tbl.name = "Restrictions"
|
||||
table.insert(output, "")
|
||||
table.insert(output, restrict_tbl)
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
local instanceOutput = {}
|
||||
instanceOutput["name"] = string.format( "[%s]", instance:GetName() )
|
||||
table.insert( instanceOutput, output )
|
||||
|
||||
return instanceOutput
|
||||
|
||||
end
|
||||
|
||||
|
||||
action = function( host, port )
|
||||
local scriptOutput = {}
|
||||
local status, instanceList = mssql.Helper.GetTargetInstances( host, port )
|
||||
|
||||
if ( not status ) then
|
||||
return stdnse.format_output( false, instanceList )
|
||||
else
|
||||
for _, instance in pairs( instanceList ) do
|
||||
local instanceOutput = process_instance( instance )
|
||||
if instanceOutput then
|
||||
table.insert( scriptOutput, instanceOutput )
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
return stdnse.format_output( true, scriptOutput )
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user