MSSQL Module Command Execution does not work

[lenhart]

Describe the bug On a recent engagement command execution did not work via the MSSQL module. The same command with crackmapexec (version 5.4.0) however worked.

Differences were that nxc missed the server name in the 3rd column (had 'None' instead), the domain and had the ip as name after the build version in column 4.. After the successful login with the pwned message, there was an additional line with a failed login. cme had the cmd execution output.

To Reproduce Unfortunately I no longer have access to the system, but this was the output (with dummy data): Command: netexec mssql 10.10.10.10 -u username -p password --local-auth -x whoami Resulted in:

netexec mssql 10.10.10.10 -u username -p password --local-auth -x "whoami"
MSSQL         10.10.10.10  1433    None             [*] Windows 10.0 Build 17763 x64 (name:10.10.10.10) (domain:)
MSSQL         10.10.10.10  1433    None             [+] domain\username:password (Pwned)
MSSQL         10.10.10.10  1433    None             [-] domain\username:password

while the same command w/ crackmapexec resulted in

netexec mssql 10.10.10.10 -u username -p password --local-auth -x "whoami"
MSSQL         10.10.10.10  1433    MSSQL-SRV             [*] Windows 10.0 Build 17763 x64 (name:MSSQL-SRV) (domain:MSSQL-SRV)
MSSQL         10.10.10.10  1433    MSSQL-SRV             [+] domain\username:password (Pwned)
MSSQL         10.10.10.10  1433    MSSQL-SRV             [+] Executed command via mssqlexec
MSSQL         10.10.10.10  1433    MSSQL-SRV             ---------------------------
MSSQL         10.10.10.10  1433    MSSQL-SRV            nt-authority/system

Expected behavior cme and nxc should behave in the same way.

Screenshots

NetExec info

• OS: Kali
• Version of nxc: 1.2
• Installed from: pipx install (beginning of Juli)

[NeffIsBack]

Thanks for the bug report! We will take a look at it.

[Mercury0]

Unable to reproduce. Used HTB Querier as a test case.

[NeffIsBack]

Looks like he used --local-auth. That flag does some internal variable changes, my guess is that this fcked things up

[NeffIsBack]

So taking a deeper look into this, this is likely an issue with the ntlm challenge. All three "corrupted" information should be retrieved out of the challenge. What is interesting is, that the ntlm challenge did not throw an error, but also didn't provide the needed information. What happens to the rest of the execution is therefore quite ambiguous, hard to say without having a machine for further debugging. If you come across another error like this please let us know!

[NeffIsBack]

I will close this for now until we can get more information