[1llusion]

Hi,

So, I can't really provide pics etc, so I will only make a short tut on one of the ways to exploit MSSQL with metasploit.

We will be using exploit: windows/mssql/mssql_payload

As you can tell by the name, it delivers a payload through mssql, it uses 3 different ways to deliver the payload. You can get more info by typing in msf:

Code:

info windows/mssql/mssql_payload

NOTE: This exploit will leave an exe file behind on the system! So be carefull!

Using the exploit is pretty easy, as usuall you must set the rhost but also you might want to set other things:
set USERNAME = This is great if you know some username in the database with admin privs. By default the user is "sa"
set PASSWORD = possibly the most important thing here. You must put the right password to the chosen username, by default, the pass is blank.
set USE_WINDOWS_AUTHENT = the values are: true/false. If you don't know, just leave it at "false".

Okay, so we can build our exploit, but how can we gather the information?

Well, find out what service is using the database, once you find out, do a little bit of googling you might find wonders

Example: One year ago, Tales of Pirates private server development was at a stage, where nobody could make their own passwords, there was one pre-defined pass. Also windows authent is needed, that means that you knew most of the info allready, all you had to do is find out username and with a bit of SE you could get it

Oh and there are 2 default passwords used usually for "sa" = Y87dc#$98 sorry, but I have forgot the second one... you can search for it tho


Enjoy!!!!