Skip to content

Linked server chain module issues #34

@passthehashbrowns

Description

@passthehashbrowns

Several modules related to linked server chains fail because results are returned in a System.Byte[] object which then has .toString() called on it, so SQLRecon attempts to parse out information from the literal "System.Byte[]" string. One example is the CLR command which fetches the SQL version number to ensure compatibility, the version is returned but is in a different encoding or something. It likely either needs to be cast on the SQL query side or just post-processed on the SQLRecon side.

Several modules also fail when there is a linked server which is an FQDN (ex: sql1.contoso.com) as SQL thinks that a server is being referenced via the 4-part schema rather than an FQDN. The fix for this is to enclose the linked server in brackets. This only affects queries that use EXEC AT.

The impersonation module to fetch users that can be impersonated also does not seem to be actually executed over the linked chain and is instead executed on the server specified in the target host argument.

Planning on putting together a PR once I have some free time soon.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions