MSSQLProxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server.
It consists of three parts:
You can compile the libraries or download them from releases (x64).
Compilation
To generate the core DLL, just import the project to Visual Studio (reciclador.sln) and compile it.
To generate the CLR assembly, first you need to find the C# compiler:
Get-ChildItem -Recurse “C:\Windows\Microsoft.NET\” -Filter “csc.exe” | Sort-Object fullname -Descending | Select-Object fullname -First 1
Then,
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /target:library .\assembly.cs
Usage
Once the two libraries are compiled, upload the core DLL (reciclador) to the target server.
Authentication options are the same as the ones in the original mssqlclient. mssqlproxy options:
Proxy Mode:
-reciclador path Remote path where DLL is stored in server
-install Installs CLR assembly
-uninstall Uninstalls CLR assembly
-check Checks if CLR is ready
-start Starts proxy
-local-port port Local port to listen on
-clr local_path Local CLR path
-no-check-src-port Use this option when connection is not direct (e.g. proxy)
We have also implemented two commands (within the SQL shell) for downloading and uploading files. Relating to the proxy stuff, we have four commands:
-clr
param to read the generated CLR from a local DLL file.-reciclador
), which can be uploaded using the upload command.-local-port
is not specified, it will listen on port 1337/tcp.Once the proxy is started, you can plug in your proxychains 😉
-no-check-src-port
flag is needed, so the server only checks the source address.Important: It’s important to stop the mssqlproxy by pressing Ctrl+C on the client. If not, the server may crash and you will have to restart the MSSQL service manually.
Credit: Pablo Martinez & Juan Manuel Fernandez
Have you ever come across a picture on the internet and wondered where it came…
Overview WhatsMyName is a free, community-driven OSINT tool designed to identify where a username exists…
Managing disk usage is a crucial task for Linux users and administrators alike. Understanding which…
Efficient disk space management is vital in Linux, especially for system administrators who manage servers…
Knowing how to check directory sizes in Linux is essential for managing disk space and…
Managing user accounts is a core responsibility for any Linux administrator. Whether you’re securing a…