-
Notifications
You must be signed in to change notification settings - Fork 128
Description
Several modules related to linked server chains fail because results are returned in a System.Byte[] object which then has .toString() called on it, so SQLRecon attempts to parse out information from the literal "System.Byte[]" string. One example is the CLR command which fetches the SQL version number to ensure compatibility, the version is returned but is in a different encoding or something. It likely either needs to be cast on the SQL query side or just post-processed on the SQLRecon side.
Several modules also fail when there is a linked server which is an FQDN (ex: sql1.contoso.com) as SQL thinks that a server is being referenced via the 4-part schema rather than an FQDN. The fix for this is to enclose the linked server in brackets. This only affects queries that use EXEC AT.
The impersonation module to fetch users that can be impersonated also does not seem to be actually executed over the linked chain and is instead executed on the server specified in the target host argument.
Planning on putting together a PR once I have some free time soon.