{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4822","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4822/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4822/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4822/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/4822","id":58518615,"number":4822,"title":"Add module mssql_local_hashdump","user":{"login":"m7x","id":5778033,"avatar_url":"https://avatars.githubusercontent.com/u/5778033?v=3","gravatar_id":"","url":"https://api.github.com/users/m7x","html_url":"https://github.com/m7x","followers_url":"https://api.github.com/users/m7x/followers","following_url":"https://api.github.com/users/m7x/following{/other_user}","gists_url":"https://api.github.com/users/m7x/gists{/gist_id}","starred_url":"https://api.github.com/users/m7x/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/m7x/subscriptions","organizations_url":"https://api.github.com/users/m7x/orgs","repos_url":"https://api.github.com/users/m7x/repos","events_url":"https://api.github.com/users/m7x/events{/privacy}","received_events_url":"https://api.github.com/users/m7x/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":19,"created_at":"2015-02-22T21:08:08Z","updated_at":"2015-03-18T13:21:05Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4822","html_url":"https://github.com/rapid7/metasploit-framework/pull/4822","diff_url":"https://github.com/rapid7/metasploit-framework/pull/4822.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/4822.patch"},"body":"I have crafted a module which extracts the MS SQL hashes by taking advantage of the same technique of <a href=\"https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/manage/mssql_local_auth_bypass.rb\">mssql_local_auth_bypass.rb</a>\r\n\r\nFurther info: https://www.dionach.com/blog/easily-grabbing-microsoft-sql-server-password-hashes\r\n\r\nThanks,\r\nMike"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/82967736","html_url":"https://github.com/rapid7/metasploit-framework/pull/4822#issuecomment-82967736","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4822","id":82967736,"user":{"login":"nullbind","id":1179731,"avatar_url":"https://avatars.githubusercontent.com/u/1179731?v=3","gravatar_id":"","url":"https://api.github.com/users/nullbind","html_url":"https://github.com/nullbind","followers_url":"https://api.github.com/users/nullbind/followers","following_url":"https://api.github.com/users/nullbind/following{/other_user}","gists_url":"https://api.github.com/users/nullbind/gists{/gist_id}","starred_url":"https://api.github.com/users/nullbind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nullbind/subscriptions","organizations_url":"https://api.github.com/users/nullbind/orgs","repos_url":"https://api.github.com/users/nullbind/repos","events_url":"https://api.github.com/users/nullbind/events{/privacy}","received_events_url":"https://api.github.com/users/nullbind/received_events","type":"User","site_admin":false},"created_at":"2015-03-18T13:21:05Z","updated_at":"2015-03-18T13:21:05Z","body":"Sorry - fail on my part, I had a few things out of date on the MSF install I was working with.  However, I updated it and ran the modules with your updates.  2k5 worked, 2k8 worked, but I got the following error for 2k12 express.  \r\n\r\n<pre>\r\nmsf post(mssql_local_hashdump) > run\r\n\r\n[*] Running module against win8-mssql-2012\r\n[*] Checking if user is SYSTEM...\r\n[+] User is SYSTEM\r\n[*] Identified service 'SQL Server (SQLEXPRESS)', PID: 1348\r\n[+] Impersonated user: NT AUTHORITY\\SYSTEM\r\n[-] Post failed: RuntimeError unknown: Unable to determine MSSQL Version\r\n[-] Call stack:\r\n[-]   C:/metasploit/apps/pro/msf3/lib/msf/core/module.rb:278:in `fail_with'\r\n[-]   C:/metasploit/apps/pro/msf3/modules/post/windows/gather/credentials/mssql_local_hashdump.rb:103:in `get_sql_hash'\r\n[-]   C:/metasploit/apps/pro/msf3/modules/post/windows/gather/credentials/mssql_local_hashdump.rb:62:in `rescue in run'\r\n[-]   C:/metasploit/apps/pro/msf3/modules/post/windows/gather/credentials/mssql_local_hashdump.rb:57:in `run'\r\n[*] Post module execution completed\r\n</pre>\r\n\r\nIt's definitely possible I'm still missing something , but I'll taking a closer look when I get a little time. \r\n\r\nOn a side note, I have another 2012 standard instance on my box.  When I specify the standard instance the module grabs the process for the \"Analysis Services\" service instead of the main \"SQL Server\" service.  I haven't fully tested it yet, but my guess is that it will cause some priv issues since the services may use different service accounts and run as separate processes.  Example below:\r\n\r\n<pre>\r\n\r\nmsf post(mssql_local_hashdump) > run\r\n\r\n[*] Running module against win8-mssql-2012\r\n[*] Checking if user is SYSTEM...\r\n[+] User is SYSTEM\r\n[*] Identified service 'SQL Server Analysis Services (STANDARD)', PID: 2060\r\n[+] Impersonated user: NT SERVICE\\MSOLAP$STANDARD\r\n[-] Post failed: RuntimeError unknown: Unable to determine MSSQL Version\r\n[-] Call stack:\r\n[-]   C:/metasploit/apps/pro/msf3/lib/msf/core/module.rb:278:in `fail_with'\r\n[-]   C:/metasploit/apps/pro/msf3/modules/post/windows/gather/credentials/mssql_local_hashdump.rb:103:in `get_sql_hash'\r\n[-]   C:/metasploit/apps/pro/msf3/modules/post/windows/gather/credentials/mssql_local_hashdump.rb:62:in `rescue in run'\r\n[-]   C:/metasploit/apps/pro/msf3/modules/post/windows/gather/credentials/mssql_local_hashdump.rb:57:in `run'\r\n[*] Post module execution completed\r\n</pre>\r\n\r\n"}}