o
    jA                     @   sF   d dl Z d dlZd dlZd dlZd dlZd dlZG dd dejZdS )    Nc                   @   s  e Zd ZdDddZdd Zdd Zd	d
 Zdd Zdd Zdd Z	dd Z
dd Zdd Zdd ZdEddZdd Zdd Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Zd6d7 Zd8d9 Zd:d; Zd<d= Zd>d? Z d@dA Z!dBdC Z"dS )FSQLSHELLFNc                 C   sz   |d ur"t jj| |j|jd |jt_|jt_|jt_d| _|| _n	t j|  d | _|| _	|| _
g | _|   d| _d S )N)stdinstdoutFz'[!] Press help for extra shell commands)cmdCmd__init__r   r   sysstderruse_rawinputshellsqlshow_queriesat
set_promptintro)selfSQLr   tcpShell r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/mssqlshell.pyr       s   
zSQLSHELL.__init__c                 C   s   | j jttd d S )N)error_loggerinfo_logger)r   printRepliesprintr   r   r   r   print_replies2   s   zSQLSHELL.print_repliesc                 C   s   t d d S )Na  
    lcd {path}                 - changes the current local directory to {path}
    exit                       - terminates the server process (and this session)
    enable_xp_cmdshell         - you know what it means
    disable_xp_cmdshell        - you know what it means
    enum_db                    - enum databases
    enum_links                 - enum linked servers
    enum_impersonate           - check logins that can be impersonated
    enum_logins                - enum login users
    enum_users                 - enum current db users
    enum_owner                 - enum db owner
    exec_as_user {user}        - impersonate with execute as user
    exec_as_login {login}      - impersonate with execute as login
    xp_cmdshell {cmd}          - executes cmd using xp_cmdshell
    xp_dirtree {path}          - executes xp_dirtree on the path
    sp_start_job {cmd}         - executes cmd using the sql server agent (blind)
    use_link {link}            - linked server to use (set use_link localhost to go back to local or use_link .. to get back one step)
    enable_rpc {link}          - enable RPC Out for a linked server
    disable_rpc {link}         - disable RPC Out for a linked server
    ! {cmd}                    - executes a local shell cmd
    upload {from} {to}         - uploads file {from} to the SQLServer host {to}
    download {from} {to}       - downloads file from the SQLServer host {from} to {to}
    show_query                 - show query
    mask_query                 - mask query
    )r   r   liner   r   r   do_help6   s   zSQLSHELL.do_helpc                 C   s   |    |S N)r   )r   stopr   r   r   r   postcmdQ   s   zSQLSHELL.postcmdc                 C   s   z|  dd}|d d }W n   d}Y | jd ur=t| jdkr=d}| jD ]
\}}|d| 7 }q&d||| jjf | _d S d	|| jjf | _d S )
Nz:select system_user + SPACE(2) + current_user as "username"Fr   username- >zSQL %s (%s@%s)> zSQL (%s@%s)> )	sql_queryr   lenr   	currentDBprompt)r   rowusername_prompt	at_promptr   prefixr   r   r   r   U   s   zSQLSHELL.set_promptc                 C   
   d| _ d S NTr   r   sr   r   r   do_show_queryc      
zSQLSHELL.do_show_queryc                 C   r.   )NFr0   r1   r   r   r   do_mask_queryf   r4   zSQLSHELL.do_mask_queryc                 C   sh   | j d ur)t| j dkr)| j dd  d \}}| j d d | _ | j ||f d S | | |   d S )Nr   )r   r'   appendr&   r   )r   exec_asr   r-   r   r   r   
execute_asi   s   
zSQLSHELL.execute_asc                 C      d| }|  | d S )Nzexecute as login='%s';r9   r   r2   r8   r   r   r   do_exec_as_loginr      zSQLSHELL.do_exec_as_loginc                 C   r:   )Nzexecute as user='%s';r;   r<   r   r   r   do_exec_as_userv   r>   zSQLSHELL.do_exec_as_userc                 C   st   |dkr	g | _ d S |dkr| j d d | _ d S | j |df | d}|   t|dk r8| j d d | _ d S d S )N	localhostz..r6   r$   z select system_user as "username"   )r   r7   r&   r   r'   )r   r2   r*   r   r   r   do_use_linkz   s   

zSQLSHELL.do_use_linkTc                 C   sx   | j d ur+t| j dkr+| j d d d D ]\}}d|dd |dd d | }q| jr6|r6td|  | j|S )Nr   r6   zEXEC (''z''z') AT z[%%] %s)r   r'   replacer   r   r   r&   )r   queryshowlinked_serverr-   r   r   r   r&      s   &
zSQLSHELL.sql_queryc                 C   s   t | d S r   )ossystemr1   r   r   r   do_shell   s   zSQLSHELL.do_shellc           
   
   C   sR  zt j|dd}|d }|d }| d}|d ddkr%td W d S | d| d	 }tt|d }|d |dkrFtd
 W d S td | d| d }t|dkr`td W d S td t|d}t	
|d d }|| W d    n1 sw   Y  td W d S  ty }	 ztd|	 W Y d }	~	d S d }	~	ww )NFposixr   rA   z\SELECT HAS_PERMS_BY_NAME(NULL, NULL, 'ADMINISTER BULK OPERATIONS') AS HasBulkAdminPermissionHasBulkAdminPermissionzF[-] Current user does not have 'ADMINISTER BULK OPERATIONS' permissionz%SELECT * FROM sys.dm_os_file_exists('z')z[-] File does not existz[+] File exists, downloading...z SELECT * FROM OPENROWSET(BULK N'z', SINGLE_BLOB) AS HexContentzD[-] Error downloading file. File is either empty or access is deniedz[+] Writing file to disk...wb
BulkColumnz[+] Downloaded[-] Unhandled Exception:)shlexsplitr&   getr   nextiterr'   openbytesfromhexdecodewrite	Exception)
r   r   argsremote_path
local_pathresult	first_keyfdataer   r   r   do_download   s8   
zSQLSHELL.do_downloadc              
   C   sr  d}z|  d |  d}|  d |d ddkr#td W d S tj|d	d
}|d }|d }t|d}| }t|	 }	d
t|  }
W d    n1 sYw   Y  tdt|
d t|	f  td tdt|
|D ]}d|
|||   d | d }|  d| d  qx|  d| d }tt|d }|d |dkrtd W d S td d| d | d }|  d| d  td|  d| d }|  d| d  td|  d| d }|  d| d }td|  |d d d!d"}|	|krtd# W d S td$ td%|  W d S  ty8 } ztd&| W Y d }~d S d }~ww )'Ni   zEexec master.dbo.sp_configure 'show advanced options', 1; RECONFIGURE;z*exec master.dbo.sp_configure 'xp_cmdshell'zEexec master.dbo.sp_configure 'show advanced options', 0; RECONFIGURE;r   	run_valuerA   zC[-] xp_cmdshell not enabled. Try running 'enable_xp_cmdshell' firstFrK   rb    z3[+] Data length (b64-encoded): %.2f KB with MD5: %si   z[+] Uploading...zecho z >> "z.b64"zEXEC xp_cmdshell 'rC   zEXEC xp_fileexist 'z.b64'zI[-] Error uploading file. Check permissions in the configured remote pathz[+] Uploadedzcertutil -decode "z.b64" ""z[+] zdel "zcertutil -hashfile "z" MD5output r$   z[+] MD5 hashes matchz#[-] ERROR! MD5 hashes do NOT match!z[+] Uploaded file MD5: %srP   )r&   rS   r   rQ   rR   rV   readhashlibmd5	hexdigestjoinbase64	b64encoderY   r'   strrangerT   rU   rD   r[   )r   r   BUFFER_SIZEr_   r\   r^   r]   ra   rb   md5sumb64enc_datair   r`   md5sum_uploadedrc   r   r   r   	do_upload   sZ   


 
zSQLSHELL.do_uploadc                 C   4   z|  d|  |   | j  W d S    Y d S )Nz#exec master.sys.xp_dirtree '%s',1,1r&   r   r   	printRowsr1   r   r   r   do_xp_dirtree   s   zSQLSHELL.do_xp_dirtreec                 C   sD   z|  d|  |   d| jjd d< | j  W d S    Y d S )Nzexec master..xp_cmdshell '%s'   r   TypeData)r&   r   r   colMetar|   r1   r   r   r   do_xp_cmdshell   s   zSQLSHELL.do_xp_cmdshellc                 C   rz   )Na  DECLARE @job NVARCHAR(100);SET @job='IdxDefrag'+CONVERT(NVARCHAR(36),NEWID());EXEC msdb..sp_add_job @job_name=@job,@description='INDEXDEFRAG',@owner_login_name='sa',@delete_level=3;EXEC msdb..sp_add_jobstep @job_name=@job,@step_id=1,@step_name='Defragmentation',@subsystem='CMDEXEC',@command='%s',@on_success_action=1;EXEC msdb..sp_add_jobserver @job_name=@job;EXEC msdb..sp_start_job @job_name=@job;r{   r1   r   r   r   do_sp_start_job   s   zSQLSHELL.do_sp_start_jobc                 C   s&   |dkrt t  d S t| d S )Nr$   )r   rH   getcwdchdirr1   r   r   r   do_lcd  s   zSQLSHELL.do_lcdc                 C   0   z|  d |   | j  W d S    Y d S )Nz}exec master.dbo.sp_configure 'show advanced options',1;RECONFIGURE;exec master.dbo.sp_configure 'xp_cmdshell', 1;RECONFIGURE;r{   r   r   r   r   do_enable_xp_cmdshell     
zSQLSHELL.do_enable_xp_cmdshellc                 C   r   )Nzjexec sp_configure 'xp_cmdshell', 0 ;RECONFIGURE;exec sp_configure 'show advanced options', 0 ;RECONFIGURE;r{   r   r   r   r   do_disable_xp_cmdshell  r   zSQLSHELL.do_disable_xp_cmdshellc                 C   s<   |  d |   | j  |  d |   | j  d S )NzEXEC sp_linkedserverszEXEC sp_helplinkedsrvloginr{   r   r   r   r   do_enum_links%  s   


zSQLSHELL.do_enum_linksc                 C   D   |st d dS z| d|  |   | j  W dS    Y dS )zQEnable RPC Out for a linked server to allow executing stored procedures remotely.z%[-] Usage: enable_rpc <linked_server>NzGEXEC sp_serveroption @server='%s', @optname='rpc out', @optvalue='true'r   r&   r   r   r|   r1   r   r   r   do_enable_rpc-     zSQLSHELL.do_enable_rpcc                 C   r   )z$Disable RPC Out for a linked server.z&[-] Usage: disable_rpc <linked_server>NzHEXEC sp_serveroption @server='%s', @optname='rpc out', @optvalue='false'r   r1   r   r   r   do_disable_rpc9  r   zSQLSHELL.do_disable_rpcc                 C   s    |  d |   | j  d S )NzEXEC sp_helpuserr{   r   r   r   r   do_enum_usersE  s   
zSQLSHELL.do_enum_usersc                 C   r   )Nz1select name, is_trustworthy_on from sys.databasesr{   r   r   r   r   
do_enum_dbJ     
zSQLSHELL.do_enum_dbc                 C   r   )NzISELECT name [Database], suser_sname(owner_sid) [Owner] FROM sys.databasesr{   r   r   r   r   do_enum_ownerR  r   zSQLSHELL.do_enum_ownerc              
   C   s   | j j}zRz9| d g }| j jD ]}| d|d  d }|r%|| q| d}|| |   || j _| j   W n   Y W | d|  d S W | d|  d S | d|  w )Nzselect name from sys.databaseszuse namea\  ; SELECT 'USER' as 'execute as', DB_NAME() AS 'database',pe.permission_name,pe.state_desc, pr.name AS 'grantee', pr2.name AS 'grantor' FROM sys.database_permissions pe JOIN sys.database_principals pr ON   pe.grantee_principal_id = pr.principal_Id JOIN sys.database_principals pr2 ON   pe.grantor_principal_id = pr2.principal_Id WHERE pe.type = 'IM'aM  SELECT 'LOGIN' as 'execute as', '' AS 'database',pe.permission_name,pe.state_desc,pr.name AS 'grantee', pr2.name AS 'grantor' FROM sys.server_permissions pe JOIN sys.server_principals pr   ON pe.grantee_principal_id = pr.principal_Id JOIN sys.server_principals pr2   ON pe.grantor_principal_id = pr2.principal_Id WHERE pe.type = 'IM')r   r(   r&   rowsextendr   r|   )r   r   old_dbr_   r*   result_rowsr   r   r   do_enum_impersonateZ  s&   




"zSQLSHELL.do_enum_impersonatec                 C   r   )Na  select r.name,r.type_desc,r.is_disabled, sl.sysadmin, sl.securityadmin, sl.serveradmin, sl.setupadmin, sl.processadmin, sl.diskadmin, sl.dbcreator, sl.bulkadmin from  master.sys.server_principals r left join master.sys.syslogins sl on sl.sid = r.sid where r.type in ('S','E','X','U','G')r{   r   r   r   r   do_enum_logins|  s   
zSQLSHELL.do_enum_loginsc                 C   s0   z|  | |   | j  W d S    Y d S r   r{   r   r   r   r   default  r   zSQLSHELL.defaultc                 C   s   d S r   r   r   r   r   r   	emptyline  s   zSQLSHELL.emptylinec                 C   s   | j d ur
| j   dS r/   )r   closer   r   r   r   do_exit  s   

zSQLSHELL.do_exit)FN)T)#__name__
__module____qualname__r   r   r   r!   r   r3   r5   r9   r=   r?   rB   r&   rJ   rd   ry   r}   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r      sB    
	
#9			"r   )rH   r   r   rl   rp   rQ   r   r   r   r   r   r   <module>   s   