Mssql/mssql ping
De www.metasploit-es.com.ar
El modulo "mssql_ping" consulta un host o rango de hosts en el puerto UDP 1434 para determinar el puerto TCP a la escucha de cualquier servidor MSSQL disponible. MSSQL hace aleatorio el puerto TCP que escucha, por lo que es un modulo muy valioso en el framework.
msf > use auxiliary/scanner/mssql/mssql_ping msf auxiliary(mssql_ping) > show options Module options (auxiliary/scanner/mssql/mssql_ping): Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD no The password for the specified username RHOSTS yes The target address range or CIDR identifier THREADS 1 yes The number of concurrent threads USERNAME sa no The username to authenticate as
Para configurar el modulo, definimos los valores RHOSTS y THREADS y lo corremos contra nuestros objetivos.
msf auxiliary(mssql_ping) > set RHOSTS 192.168.1.200-254 RHOSTS => 192.168.1.200-254 msf auxiliary(mssql_ping) > set THREADS 20 THREADS => 20 msf auxiliary(mssql_ping) > run [*] Scanned 13 of 55 hosts (023% complete) [*] Scanned 16 of 55 hosts (029% complete) [*] Scanned 17 of 55 hosts (030% complete) [*] SQL Server information for 192.168.1.217: [*] tcp = 27900 [*] np = \\SERVER2\pipe\sql\query [*] Version = 8.00.194 [*] InstanceName = MSSQLSERVER [*] IsClustered = No [*] ServerName = SERVER2 [*] SQL Server information for 192.168.1.241: [*] tcp = 1433 [*] np = \\2k3\pipe\sql\query [*] Version = 8.00.194 [*] InstanceName = MSSQLSERVER [*] IsClustered = No [*] ServerName = 2k3 [*] Scanned 32 of 55 hosts (058% complete) [*] Scanned 40 of 55 hosts (072% complete) [*] Scanned 44 of 55 hosts (080% complete) [*] Scanned 45 of 55 hosts (081% complete) [*] Scanned 46 of 55 hosts (083% complete) [*] Scanned 50 of 55 hosts (090% complete) [*] Scanned 55 of 55 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(mssql_ping) >
Como puede verse de la salida del modulo, no solamente devuelve el puerto TCP a la escucha, sino tambien otra informacion valiosa como los valores InstanceName y ServerName.
© Offensive Security 2009
Original de www.offensive-security.com Traducido por cbk999
