Penetration testers often need to check that no administrative account has a weak password. With some help from Nmap NSE, we can easily check that no host (or hosts) has a sysadmin account with an empty password.
This recipe teaches us how to use Nmap to find MS SQL servers with an empty sysadmin password.
To find MS SQL servers with an empty sa account, open your terminal and enter the following Nmap command:
$ nmap -p1433 --script ms-sql-empty-password -v <target>
If an account with an empty password is found, it will be included in the script output section:
PORT STATE SERVICE 1433/tcp open ms-sql-s | ms-sql-empty-password: | [192.168.1.102:1433] |_ sa:<empty> => Login Success
The parameter -p1433 --script ms-sql-empty-password makes Nmap initiate the NSE script ms-sql-empty-password if an MS SQL server is found running on port 1433.
The script ms-sql-empty-password was submitted by Patrik Karlsson and improved by Chris Woodbury. It tries to connect to an MS SQL server using the username sa (the sysadmin account) and an empty password.
If port 445 is open, you can use it to retrieve information via pipes. It is required that you set the arguments mssql.instance-name or mssql.instance-all:
$ nmap -sV --script-args mssql.instance-name=MSSQLSERVER --script ms-sql-empty-password -p445 -v <target> $ nmap -sV --script-args mssql.instance-all --script ms-sql-empty-password -p445 -v <target>
The output will be as follows:
PORT STATE SERVICE VERSION 445/tcp open netbios-ssn Host script results: | ms-sql-empty-password: | [192.168.1.102MSSQLSERVER] |_ sa:<empty> => Login Success
The NSE scripts ms-sql-brute, ms-sql-config.nse, ms-sql-empty-password, ms-sql-hasdbaccess.nse,ms-sql-info.nse, ms-sql-query.nse, ms-sql-tables.nse, and ms-sql-xp-cmdshell.nse may try to connect to ports that were not included in your scan. To limit NSE to only use scanned ports, use the argument mssql.scanned-ports-only:
$ nmap -p1433 --script-args mssql.scanned-ports-only --script ms-sql-* -v <target>