Skip to content

Commit

Permalink
Adds session documentation
Browse files Browse the repository at this point in the history
  • Loading branch information
zgoldman-r7 committed Mar 13, 2024
1 parent 923f4c9 commit c87dd0c
Show file tree
Hide file tree
Showing 5 changed files with 139 additions and 1 deletion.
35 changes: 35 additions & 0 deletions documentation/modules/auxiliary/scanner/mssql/mssql_login.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,41 @@ A docker container can be spun up with the following command to test this module

## Options

### CreateSession

When using the mssql_login module, the CreateSession option can be used to obtain an interactive
session within the smb instance. Running the following commands with all other options set:

```
set CreateSession true
run
```

Should give you output containing

```
[*] MSSQL session 1 opened
```

Which you can interact with using `sessions -i SESSION_NUMBER` or `sessions -1` to interact with the most recently opened session.

```
msf6 auxiliary(scanner/mssql/mssql_login) > sessions -1
[*] Starting interaction with 1...
mssql @ 192.168.2.242:1433 (master) > query 'select @@version;'
Response
========
# NULL
- ----
0 Microsoft SQL Server 2022 (RTM) - 16.0.1000.6 (X64)
Oct 8 2022 05:58:25
Copyright (C) 2022 Microsoft Corporation
Developer Edition (64-bit) on Windows Server 2022 Stand
ard 10.0 <X64> (Build 20348: ) (Hypervisor)
```

### USER_FILE

File containing users, one per line.
Expand Down
26 changes: 26 additions & 0 deletions documentation/modules/auxiliary/scanner/mysql/mysql_login.md
Original file line number Diff line number Diff line change
Expand Up @@ -61,3 +61,29 @@ msf auxiliary(mysql_login) > run
[*] Auxiliary module execution completed
msf auxiliary(mysql_login) >
```

## Obtaining an Interactive Session

The CreateSession option allows you to obtain an interactive session
for the MySQL client you're connecting to. The run command with CreateSession
set to true should give you an interactive session, and you can interact with
`sessions -i -1` or `sessions REPLACE_WITH_SESSION_NUMBER`.

Once you've done that, you can run any MySQL query against the target using
the `query` command, or run `query_interactive` to interact directly with
your session.

```
run rhost=127.0.0.1 rport=4306 username=root password=password createsession=true
[+] 127.0.0.1:4306 - 127.0.0.1:4306 - Found remote MySQL version 11.2.2
[!] 127.0.0.1:4306 - No active DB -- Credential data will not be saved!
[+] 127.0.0.1:4306 - 127.0.0.1:4306 - Success: 'root:password'
[*] MySQL session 1 opened (127.0.0.1:53241 -> 127.0.0.1:4306) at 2024-03-12 12:40:46 -0500
[*] 127.0.0.1:4306 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/mysql/mysql_login) > sessions -i -1
[*] Starting interaction with 1...
mysql @ 127.0.0.1:4306 () > query 'your query here;'
```
38 changes: 38 additions & 0 deletions documentation/modules/auxiliary/scanner/postgres/postgres_login.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
## Description

This auxiliary module is a brute-force login tool for Postgres servers.

## Verification Steps

1. Do: ```use auxiliary/scanner/postgres/postgres_login```
2. Do: ```set PASS_FILE [file containing passwords]```
3. Do: ```set RHOSTS [IP]```
4. Do: ```set USER_FILE [file containing usernames]```
5. Do: ```set DATABASE [template name]```
6. Do: ```run```

The above USER_FILE and PASS_FILE options can be replaced with USERNAME
and PASSWORD if you know the credentials.

## Getting an Interactive Session

The CreateSession option allows you to obtain an interactive session
for the Postgres client you're connecting to. The run command with CreateSession
set to true should give you an interactive session, and you can interact with
`sessions -i -1` or `sessions REPLACE_WITH_SESSION_NUMBER`.

For example:

```
msf6 auxiliary(scanner/postgres/postgres_login) > run rhost=127.0.0.1 rport=5432 username=postgres password=password database=template1 createsession=true
```

Should yield:

```
Postgres session 1 opened
```

Once you've done that, you can run any Postgres query against the target using
the `query` command, or run `query_interactive` to interact directly with
your session.
35 changes: 34 additions & 1 deletion documentation/modules/auxiliary/scanner/smb/smb_login.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,41 @@ host origin service public private realm private_type
msf auxiliary(smb_login)
```
## Obtaining a Session
When using the smb_login module, the CreateSession option can be used to obtain an interactive
session within the smb instance. Running the following commands with all other options set:
```
set CreateSession true
run
```
Should give you output containing
```
[*] SMB session 1 opened
```
Which you can interact with using `sessions -i SESSION_NUMBER` or `sessions -1` to interact with the most recently opened session.
```
msf6 auxiliary(scanner/smb/smb_login) > sessions -1
[*] Starting interaction with 1...
SMB (172.16.158.154) > shares
Shares
======
## Options
# Name Type comment
- ---- ---- -------
0 ADMIN$ DISK|SPECIAL Remote Admin
1 C$ DISK|SPECIAL Default share
2 foo DISK
3 IPC$ IPC|SPECIAL Remote IPC
SMB (172.16.158.154) > shares -i foo
[+] Successfully connected to foo
SMB (172.16.158.154\foo) > ls
ls
===
...
```
## Credential Options

By default, the smb_login module only requires the RHOSTS option to run. But in reality, you will
also need to supply user names and passwords. The following options are available to support
Expand Down
6 changes: 6 additions & 0 deletions documentation/modules/exploit/windows/smb/smb_relay.md
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,12 @@ I.E. the filename john will produce two files, `john_netntlm` and `john_netntlmv

The domain name used during smb exchange.

### ACTION
Determines which of two actions smb_relay will use against the target.
The default is to run PSEXEC, but can be changed to CREATE_SMB_SESSION to
open an interactive smb session against the target instead of running
psexec.

### TIMEOUT

Seconds that the server socket will wait for a response after the client has initiated communication.
Expand Down

0 comments on commit c87dd0c

Please sign in to comment.