MSSQL Login Utility

This module simply queries the MSSQL instance for a specific user/pass (default is sa with blank).

Search Other Modules

Rank

Normal

Authors

MC < mc [at] metasploit.com >

Vulnerability References

CVE-1999-0506

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use auxiliary/scanner/mssql/mssql_login
msf auxiliary(mssql_login) > set RHOSTS [TARGET HOST RANGE]
msf auxiliary(mssql_login) > run

Module Options

BLANK_PASSWORDS	Try blank passwords for all users (default: true)
BRUTEFORCE_SPEED	How fast to bruteforce, from 0 to 5 (default: 5)
PASSWORD	A specific password to authenticate with
PASS_FILE	File containing passwords, one per line
RHOSTS	The target address range or CIDR identifier
RPORT	The target port (default: 1433)
STOP_ON_SUCCESS	Stop guessing when a credential works for a host
THREADS	The number of concurrent threads (default: 1)
USERNAME	A specific username to authenticate as
USERPASS_FILE	File containing users and passwords separated by space, one pair per line
USER_AS_PASS	Try the username as the password for all users (default: true)
USER_FILE	File containing usernames, one per line
USE_WINDOWS_AUTHENT	Use windows authentification (requires DOMAIN option set)
VERBOSE	Whether to print output for all attempts (default: true)
CHOST	The local client address
CPORT	The local client port
ConnectTimeout	Maximum number of seconds to establish a TCP connection
DOMAIN	The domain to use for windows authentication
HEX2BINARY	The path to the hex2binary script on the disk
MaxGuessesPerService	Maximum number of credentials to try per service instance. If set to zero or a non-number, this option will not be used.
MaxGuessesPerUser	Maximum guesses for a particular username for the service instance. Note that users are considered unique among different services, so a user at 10.1.1.1:22 is different from one at 10.2.2.2:22, and both will be tried up to the MaxGuessesPerUser limit. If set to zero or a non-number, this option will not be used.
MaxMinutesPerService	Maximum time in minutes to bruteforce the service instance. If set to zero or a non-number, this option will not be used.
NTLM::SendLM	Always send the LANMAN response (except when NTLMv2_session is specified)
NTLM::SendNTLM	Activate the 'Negotiate NTLM key' flag, indicating the use of NTLM responses
NTLM::SendSPN	Send an avp of type SPN in the ntlmv2 client Blob, this allow authentification on windows Seven/2008r2 when SPN is required
NTLM::UseLMKey	Activate the 'Negotiate Lan Manager Key' flag, using the LM key when the LM response is sent
NTLM::UseNTLM2_session	Activate the 'Negotiate NTLM2 key' flag, forcing the use of a NTLMv2_session
NTLM::UseNTLMv2	Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key is true
Proxies	Use a proxy chain
REMOVE_PASS_FILE	Automatically delete the PASS_FILE on module completion
REMOVE_USERPASS_FILE	Automatically delete the USERPASS_FILE on module completion
REMOVE_USER_FILE	Automatically delete the USER_FILE on module completion
SSL	Negotiate SSL for outgoing connections
SSLVersion	Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
ShowProgress	Display progress messages during a scan
ShowProgressPercent	The interval in percent that progress should be shown
WORKSPACE	Specify the workspace for this module
TCP::max_send_size	Maxiumum tcp segment size. (0 = disable)
TCP::send_delay	Delays inserted before every send. (0 = disable)