PySQLRecon可以使用pip3 install pysqlrecon
安装,也可以通过克隆此存储库并运行pip3 install .
来安装
[PRIV]
标注的命令需要提升的权限或系统管理员权限才能运行。或者,标记为[NORM]
的命令可能由普通用户运行,并且不需要提升的权限。[I]
)或在链接服务器上执行([L]
)的支持。adsi [PRIV] Obtain ADSI creds from ADSI linked server [I,L]
agentcmd [PRIV] Execute a system command using agent jobs [I,L]
agentstatus [PRIV] Enumerate SQL agent status and jobs [I,L]
checkrpc [NORM] Enumerate RPC status of linked servers [I,L]
clr [PRIV] Load and execute .NET assembly in a stored procedure [I,L]
columns [NORM] Enumerate columns within a table [I,L]
databases [NORM] Enumerate databases on a server [I,L]
disableclr [PRIV] Disable CLR integration [I,L]
disableole [PRIV] Disable OLE automation procedures [I,L]
disablerpc [PRIV] Disable RPC and RPC Out on linked server [I]
disablexp [PRIV] Disable xp_cmdshell [I,L]
enableclr [PRIV] Enable CLR integration [I,L]
enableole [PRIV] Enable OLE automation procedures [I,L]
enablerpc [PRIV] Enable RPC and RPC Out on linked server [I]
enablexp [PRIV] Enable xp_cmdshell [I,L]
impersonate [NORM] Enumerate users that can be impersonated
info [NORM] Gather information about the SQL server
links [NORM] Enumerate linked servers [I,L]
olecmd [PRIV] Execute a system command using OLE automation procedures [I,L]
query [NORM] Execute a custom SQL query [I,L]
rows [NORM] Get the count of rows in a table [I,L]
search [NORM] Search a table for a column name [I,L]
smb [NORM] Coerce NetNTLM auth via xp_dirtree [I,L]
tables [NORM] Enumerate tables within a database [I,L]
users [NORM] Enumerate users with database access [I,L]
whoami [NORM] Gather logged in user, mapped user and roles [I,L]
xpcmd [PRIV] Execute a system command using xp_cmdshell [I,L]
pysqlrecon [GLOBAL_OPTS] COMMAND [COMMAND_OPTS]
查看全局选项:
pysqlrecon --help
查看命令特定选项:
pysqlrecon [GLOBAL_OPTS] COMMAND --help
query
标志将数据库身份验证更改为,或在某些PySQLRecon命令(tables
、columns
、rows
、--database
)中使用。--link
标志在链接服务器(而不是要验证的SQL服务器)上执行PySQLRecon命令。--impersonate
标志的PySQLRecon命令时模拟用户帐户。--link
和--impersonate
不兼容。欢迎添加微信进行业务咨询: 承接以下业务: