Microsoft SQL Server Default Credentials (PCI wordlist)

#TRUSTED ac9aadb5bc45ec27d7185ae75a43cd01bc4ff83d4a70615160ad7088705375d36a1d88763e0e6e8e3d6feeb1a10fe4e4feeef8b4c5ff2a3c7f4b597b783249d588f0b3f9d199a054ee97060136507093efe5fabc79c3ef00eb9d1d36dbdc3ef918343a75cd5d1582bd91c0a73aed4d5dc855094b1abd2aee78e1ae348fe573c65ffb9f8db6e4498d3eb8a5886e963a33f14e394ef35cd7c53621329b386247e3dbfb35eece8738812953ea11166ec1fc830e0be277b1254575b8d542cbc48db366d50aba405a6ac4ac5484b6c44f6f03d1a4c782f204ab27941585c5df977e108c8c7f3f0b18ca034106bfe655e66dfd87d0a0d0081a085c91c3d8cde71a718b9f5468ac323359583a050ffc2bf7059683f5f22db2aefa2dae5f60b257aefc2ff5159250229ecbf0f2c9b01b8d61419801e669def806eecfc3db665c61fe0ecd1e33b939b62d8068a414b3bf232996937d915b81b4370262bb4beca3f2e0732cda4af1537133c8ea0ac007046ebd975c6fbeff750719f490488b6577cef4b22dc84cdda71d909a3035a6f5c7710f8e8a1bbd2de7ce268ae08fbe51f02351514945f0f9fe9c3b032eec6471905d65c26aa368996fc8bdcb08ef0f6ee6685bec3b9554b1273f36a17bdd2df431d36f502ead3d04ce07ed37efea84c861d44fe84b1f7924f437fb998c1f4af13a7e1fcef144128f70f0ef64b0e5d567ca7c31b4fe
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(108593);
  script_version("1.11");
  script_set_attribute(attribute:"plugin_modification_date", value:"2022/04/11");

  script_name(english:"Microsoft SQL Server Default Credentials (PCI wordlist)");

  script_set_attribute(attribute:"synopsis", value:
"Credentials for the remote database server can be discovered.");
  script_set_attribute(attribute:"description", value:
"The SQL Server has a common password for one or more accounts. These
accounts may be used to gain access to the records in the database or
even allow remote command execution.");
  # https://github.com/mubix/post-exploitation-wiki/blob/master/windows/mssql.md
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a5bc966a");
  script_set_attribute(attribute:"solution", value:
"Choose a strong password for affected Microsoft SQL Server accounts.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"manual");
  script_set_attribute(attribute:"cvss_score_rationale", value:"default credentials");

  script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/26");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sql_server");
  script_set_attribute(attribute:"default_account", value:"true");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2018-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mssqlserver_detect.nasl", "sybase_detect.nasl");
  script_require_keys("Settings/PCI_DSS");
  script_exclude_keys("global_settings/supplied_logins_only", "Settings/PCI_DSS_local_checks");
  script_require_ports("Services/mssql", 1433);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("pci_password_dict.inc");

if (!get_kb_item("Settings/PCI_DSS")) audit(AUDIT_PCI);
if (get_kb_item("Settings/PCI_DSS_local_checks"))
  exit(1, "This plugin only runs for PCI External scans.");

var pkt_hdr = raw_string(
    0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
);


var pkt_pt2 = raw_string (
    0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61, 0x30, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x20, 0x18, 0x81, 0xb8, 0x2c, 0x08, 0x03,
    0x01, 0x06, 0x0a, 0x09, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x73, 0x71, 0x75, 0x65, 0x6c, 0x64, 0x61,
    0x20, 0x31, 0x2e, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00
);

var pkt_pt3 = raw_string (
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x04, 0x02, 0x00, 0x00, 0x4d, 0x53, 0x44,
    0x42, 0x4c, 0x49, 0x42, 0x00, 0x00, 0x00, 0x07, 0x06, 0x00, 0x00,
    0x00, 0x00, 0x0d, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00
);

var pkt_lang = raw_string(
    0x02, 0x01, 0x00, 0x47, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x30, 0x30, 0x00, 0x00,
    0x00, 0x03, 0x00, 0x00, 0x00
);


function sql_recv(socket)
{
 local_var head, len_hi, len_lo, len, body;

 head = recv(socket:socket, length:4, min:4);
 if(strlen(head) < 4) return NULL;

 len_hi = 256 * ord(head[2]);
 len_lo = ord(head[3]);

 len = len_hi + len_lo;
 body = recv(socket:socket, length:len);
 return(head + body);
}

function make_sql_login_pkt (username, password)
{
    local_var ulen, plen, upad, ppad, ubuf, pbuf, nul, ublen, pblen, sql_packet;

    ulen = strlen(username);
    plen = strlen(password);

    upad = 30 - ulen;
    ppad = 30 - plen;

    ubuf = "";
    pbuf = "";

    nul = raw_string(0x00);


    if(ulen)
    {
        ublen = raw_string(ulen % 255);
    } else {
        ublen = raw_string(0x00);
    }


    if(plen)
    {
        pblen =  raw_string(plen % 255);
    } else {
        pblen = raw_string(0x00);
    }

    ubuf = username + crap(data:nul, length:upad);
    pbuf = password + crap(data:nul, length:ppad);

    sql_packet = pkt_hdr + ubuf + ublen + pbuf + pblen + pkt_pt2 + pblen + pbuf + pkt_pt3;

    return sql_packet;
}


info = "";
service_unknown = FALSE;

port = get_kb_item("Services/mssql");
if (!port) port = get_kb_item("Services/sybase");
if (!port)
{
  port = 1433;
  if (!service_is_unknown(port:port))
    audit(AUDIT_NOT_LISTEN, "Microsoft SQL Server", port);

  service_unknown = TRUE;
}
if (!get_tcp_port_state(port)) audit(AUDIT_PORT_CLOSED, port);

if (supplied_logins_only) audit(AUDIT_SUPPLIED_LOGINS_ONLY);

found = 0;
var logins = get_pci_login_list(platform:'MSSQL');
foreach login (logins)
{ 
  soc = open_sock_tcp(port);
  if (!soc)
    audit(AUDIT_SOCK_FAIL, port);

  var sql_packet;
  sql_packet = make_sql_login_pkt(
      username:login['username'], 
      password:login['password']
  );

  send(socket:soc, data:sql_packet);
  send(socket:soc, data:pkt_lang);

  r  = sql_recv(socket:soc);
  close(soc);

  if (
    strlen(r) > 10 &&
    ord(r[8]) == 0xE3
  )
  {
    info += '    Account     : ' + login['username'] + '\n' +
            '    Password    : ' + login['password'];

    info += '\n\n';
    found = found + 1;
  }
}

if (found)
{
  report =
    '\n' +
    'The following credentials were discovered for the remote SQL Server :\n'+
    '\n' +
    info;
  security_report_v4(port:port, severity:SECURITY_HOLE, extra:report);
  exit(0);
}
else
{
  if (service_unknown) exit(0, "The service listening on port "+port+" is not affected.");
  else audit(AUDIT_LISTEN_NOT_VULN, "Microsoft SQL Server", port);
}