[Dfte]

Description

This PR adds the --db-hash core option that can be used to dump database users' hashes:

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Deprecation of feature or functionality
• This change requires a documentation update
• This requires a third party update (such as Impacket, Dploot, lsassy, etc)
• This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

Run the following command:

poetry run nxc mssql TARGET -u USER -p PASS --db-hash

Screenshots (if appropriate):

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

• [ x I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
• I have performed a self-review of my own code (not an AI review)
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

[NeffIsBack]

Sweeet, what's the hash type? Can you also add a wiki page that documents how you can crack it (preferebly even with the hashcat command so you can just copy&paste)?

[Dfte]

There are three type of hashes which are 0000 0100 0200 (the 4 first characters of the hash dump).
And yeah I will update the wiki once I'm over with MSSQL PR's (there are a few incoming).

[Dfte]

Latest commit adds the hash algorithm for easier post exploit:

[NeffIsBack]

@Dfte fixed a .decode() call on the password_hash value since it is now a string (iirc that was changed in tds.py a few months ago). Does that makes sense to you? Can you recheck in your lab?

Otherwise LGTM:

[NeffIsBack]

@Dfte can you add this stuff to the wiki?