Index: nselib/mssql.lua =================================================================== --- nselib/mssql.lua (revision 22368) +++ nselib/mssql.lua (working copy) @@ -233,6 +233,11 @@ end end, + --- Sets whether the instance is in a cluster + -- + -- @param self + -- @param isClustered Boolean true or the string "Yes" are interpreted as true; + -- all other values are interpreted as false. SetIsClustered = function( self, isClustered ) self.isClustered = (isClustered == true) or (isClustered == "Yes") end, @@ -572,11 +577,13 @@ -- the SQL Server Browser service on a host. -- -- @param host A host table for the target host - -- @param port A port table for the target SQL Server Browser service + -- @param port (Optional) A port table for the target SQL Server Browser service -- @return (status, result) If status is true, result is a table of -- SqlServerInstanceInfo objects. If status is false, result is an -- error message. DiscoverInstances = function( host, port ) + port = port or SSRP.PORT + if ( SCANNED_PORTS_ONLY and nmap.get_port_state( host, port ) == nil ) then stdnse.print_debug( 2, "%s: Discovery disallowed: scanned-ports-only is set and port %d was not scanned", SSRP.DEBUG_ID, port.number ) return false, "Discovery disallowed: scanned-ports-only" @@ -610,12 +617,14 @@ -- the SQL Server Browser service on a broadcast domain. -- -- @param host A host table for the broadcast specification - -- @param port A port table for the target SQL Server Browser service + -- @param port (Optional) A port table for the target SQL Server Browser service -- @return (status, result) If status is true, result is a table of -- tables containing SqlServerInstanceInfo objects. The top-level table -- is indexed by IP address. If status is false, result is an -- error message. DiscoverInstances_Broadcast = function( host, port ) + port = port or SSRP.PORT + local socket = nmap.new_socket("udp") socket:set_timeout(5000) local instances_all = {} @@ -1980,6 +1989,9 @@ -- Any discovered instances are returned, as well as being stored for use -- by other scripts (see mssql.Helper.GetDiscoveredInstances()). -- + -- @param host A host table for the target. + -- @param port (Optional) A port table for the target port. If this is nil, + -- the default SSRP port (UDP 1434) is used. -- @param broadcast If true, this will be done with an SSRP broadcast, and -- host should contain the broadcast specification (e.g. -- ip = "255.255.255.255"). @@ -2001,7 +2013,7 @@ -- Give some version info back to Nmap if ( instance.port and instance.version ) then instance.version:PopulateNmapPortVersion( instance.port ) - nmap.set_port_version( host, instance.port, "hardmatched" ) + nmap.set_port_version( instance.host, instance.port, "hardmatched" ) end end end @@ -2034,6 +2046,8 @@ -- port. If an instance is discovered, it is returned, as well as being -- stored for use by other scripts (see mssql.Helper.GetDiscoveredInstances()). -- + -- @param host A host table for the target. + -- @param port A port table for the target port. -- @return (status, result) If status is true, result is a table of -- SqlServerInstanceInfo objects. If status is false, result is an -- error message or nil. @@ -2068,6 +2082,7 @@ -- pipes. Any discovered instances are returned, as well as being stored -- for use by other scripts (see mssql.Helper.GetDiscoveredInstances()). -- + -- @param host A host table for the target. -- @param port A port table for the port to connect on for SMB -- @return (status, result) If status is true, result is a table of -- SqlServerInstanceInfo objects. If status is false, result is an @@ -2156,7 +2171,7 @@ -- script arguments. -- -- @param instanceInfo A SqlServerInstanceInfo object for the target instance - -- @return A table of the form { username, password } + -- @return A table of usernames mapped to passwords (i.e. creds[ username ] = password) GetLoginCredentials_All = function( instanceInfo ) local credentials = instanceInfo.credentials or {} local credsExist = false @@ -2190,6 +2205,7 @@ -- * Otherwise, nil is returned. -- -- @param instanceInfo A SqlServerInstanceInfo object for the target instance + -- @return (username, password) GetLoginCredentials = function( instanceInfo ) -- First preference goes to any user-specified credentials @@ -2579,7 +2595,9 @@ -- true if one or more instances have been targeted with the mssql.instance -- script argument. However, if a previous script has failed to find any -- SQL Server instances on the host, the hostrule function will return - -- false to keep further scripts from running unnecessarily on that host. + -- false to keep further scripts from running unnecessarily on that host. + -- + -- @return A hostrule function (use as hostrule = mssql.GetHostrule_Standard()) GetHostrule_Standard = function() return function( host ) if ( stdnse.get_script_args( {"mssql.instance-all", "mssql.instance-name", "mssql.instance-port"} ) ~= nil ) then @@ -2599,6 +2617,8 @@ -- true if BOTH of the following conditions are met: -- * The port has been identified as "ms-sql-s" -- * The mssql.instance script argument has NOT been used + -- + -- @return A portrule function (use as portrule = mssql.GetPortrule_Standard()) GetPortrule_Standard = function() return function( host, port ) return ( shortport.service( "ms-sql-s" )(host, port) and Index: scripts/ms-sql-brute.nse =================================================================== --- scripts/ms-sql-brute.nse (revision 22354) +++ scripts/ms-sql-brute.nse (working copy) @@ -7,34 +7,37 @@ SQL Server credentials required: No (will not benefit from mssql.username & mssql.password). +Run criteria: +* Host script: Will run if the mssql.instance-all, mssql.instance-name +or mssql.instance-port script arguments are used (see mssql.lua). +* Port script: Will run against any services identified as SQL Servers, but only +if the mssql.instance-all, mssql.instance-name +and mssql.instance-port script arguments are NOT used. -The script runs in two modes: -* Instances pre-discovered by ms-sql-discover or broadcast-ms-sql-discover -(run as a host script): The script will run against each of the instances -discovered on the host, performing password guessing on each. -* Targeted instances (run as a port script): If the port scan includes ports -that are identified as SQL Server instances, the script will run against each -instance in the same manner as the host script, but only against that particular -instance. In the case that an instance is targeted by a host script AND a port -script, it will only have its passwords tested once, but any successful results -will be listed in the output for both. - WARNING: SQL Server 2005 and later versions include support for account lockout policies (which are enforced on a per-user basis). If an account is locked out, the script will stop running for that instance, unless the ms-sql-brute.ignore-lockout argument is used. + +NOTE: Communication with instances via named pipes depends on the smb +library. To communicate with (and possibly to discover) instances via named pipes, +the host must have at least one SMB port (e.g. TCP 445) that was scanned and +found to be open. Additionally, named pipe connections may require Windows +authentication to connect to the Windows host (via SMB) in addition to the +authentication required to connect to the SQL Server instances itself. See the +documentation and arguments for the smb library for more information. + +NOTE: By default, the ms-sql-* scripts may attempt to connect to and communicate +with ports that were not included in the port list for the Nmap scan. This can +be disabled using the mssql.scanned-ports-only script argument. ]] --- -- @usage --- nmap -p 445 --script ms-sql-discover,ms-sql-brute --- nmap -p 445 --script ms-sql-discover,ms-sql-brute --script-args userdb=customuser.txt,passdb=custompass.txt --- nmap -p 1433 --script ms-sql-brute +-- nmap -p 445 --script ms-sql-brute --script-args mssql.instance-all,userdb=customuser.txt,passdb=custompass.txt +-- nmap -p 1433 --script ms-sql-brute --script-args userdb=customuser.txt,passdb=custompass.txt -- -- @output --- Host script results: --- | ms-sql-discover: --- | [...] -- | ms-sql-brute: -- | [192.168.100.128\TEST] -- | No credentials found @@ -46,13 +49,6 @@ -- | testuser:secret1234 => PasswordMustChange -- |_ lordvader:secret1234 => Login Success -- --- PORT STATE SERVICE --- 1433/tcp open ms-sql-s --- | ms-sql-brute: --- | [192.168.100.123\MSSQLSERVER] --- | Credentials found: --- |_ sa:sa => Login Success --- ---- -- @args ms-sql-brute.ignore-lockout WARNING! Including this argument will cause -- the script to continue attempting to brute-forcing passwords for users @@ -152,8 +148,7 @@ passwordIsGood = true canLogin = true elseif ( loginErrorCode ) then - if ( ( loginErrorCode ~= mssql.LoginErrorType.InvalidUsernameOrPassword ) and - ( loginErrorCode ~= mssql.LoginErrorType.NotAssociatedWithTrustedConnection ) ) then + if ( loginErrorCode ~= mssql.LoginErrorType.InvalidUsernameOrPassword ) then stopUser = true end Index: scripts/ms-sql-config.nse =================================================================== --- scripts/ms-sql-config.nse (revision 22354) +++ scripts/ms-sql-config.nse (working copy) @@ -7,15 +7,24 @@ SQL Server credentials required: Yes (use ms-sql-brute, ms-sql-empty-password and/or mssql.username & mssql.password) +Run criteria: +* Host script: Will run if the mssql.instance-all, mssql.instance-name +or mssql.instance-port script arguments are used (see mssql.lua). +* Port script: Will run against any services identified as SQL Servers, but only +if the mssql.instance-all, mssql.instance-name +and mssql.instance-port script arguments are NOT used. -The script runs in two modes: -* Instances pre-discovered by ms-sql-discover or broadcast-ms-sql-discover -(run as a host script): The script will run against each of the instances -discovered on the host. -* Targeted instances (run as a port script): If the port scan includes ports -that are identified as SQL Server instances, the script will run against each -instance in the same manner as the host script, but only against that particular -instance. +NOTE: Communication with instances via named pipes depends on the smb +library. To communicate with (and possibly to discover) instances via named pipes, +the host must have at least one SMB port (e.g. TCP 445) that was scanned and +found to be open. Additionally, named pipe connections may require Windows +authentication to connect to the Windows host (via SMB) in addition to the +authentication required to connect to the SQL Server instances itself. See the +documentation and arguments for the smb library for more information. + +NOTE: By default, the ms-sql-* scripts may attempt to connect to and communicate +with ports that were not included in the port list for the Nmap scan. This can +be disabled using the mssql.scanned-ports-only script argument. ]] --- Index: scripts/ms-sql-discover.nse =================================================================== --- scripts/ms-sql-discover.nse (revision 22368) +++ scripts/ms-sql-discover.nse (working copy) @@ -6,6 +6,12 @@ SQL Server credentials required: No (will not benefit from mssql.username & mssql.password). +Run criteria: +* Host script: Will always run, unless the mssql.scanned-ports-only + script argument was specified (see mssql.lua for more details); in that case, + the script will run if one or more of the following ports were scanned and + weren't found to be closed: 1434/udp, 1433/tcp, an SMB port (see smb.lua). +* Port script: N/A The script attempts to discover SQL Server instances. Any instances found are stored in the Nmap registry for use by any other ms-sql-* scripts that are run @@ -25,16 +31,22 @@ * Connecting via named pipes to the default pipe names: The script will attempt to connect over SMB to default pipe names for SQL Server. -NOTE: By default, the script (and other ms-sql-* scripts that are run -subsequently) may attempt to connect to and communicate with ports that were not -included in the port list for the Nmap scan. This can be disabled (for this and -all other ms-sql-* scripts) using the mssql.scanned-ports-only -script argument. +NOTE: Communication with instances via named pipes depends on the smb +library. To communicate with (and possibly to discover) instances via named pipes, +the host must have at least one SMB port (e.g. TCP 445) that was scanned and +found to be open. Additionally, named pipe connections may require Windows +authentication to connect to the Windows host (via SMB) in addition to the +authentication required to connect to the SQL Server instances itself. See the +documentation and arguments for the smb library for more information. + +NOTE: By default, the ms-sql-* scripts may attempt to connect to and communicate +with ports that were not included in the port list for the Nmap scan. This can +be disabled using the mssql.scanned-ports-only script argument. ]] --- -- @usage --- nmap -p 0 --script ms-sql-discover +-- nmap -p 445 --script ms-sql-discover -- -- @output -- | ms-sql-discover: Index: scripts/ms-sql-empty-password.nse =================================================================== --- scripts/ms-sql-empty-password.nse (revision 22354) +++ scripts/ms-sql-empty-password.nse (working copy) @@ -3,47 +3,43 @@ description = [[ Attempts to authenticate to Microsoft SQL Servers using an empty password for -the sysadmin (sa) account. Works best in conjuction with the ms-sql-discover. +the sysadmin (sa) account. SQL Server credentials required: No (will not benefit from mssql.username & mssql.password). +Run criteria: +* Host script: Will run if the mssql.instance-all, mssql.instance-name +or mssql.instance-port script arguments are used (see mssql.lua). +* Port script: Will run against any services identified as SQL Servers, but only +if the mssql.instance-all, mssql.instance-name +and mssql.instance-port script arguments are NOT used. -The script runs in two modes: -* Instances pre-discovered by ms-sql-discover or broadcast-ms-sql-discover -(run as a host script): The script will run against each of the instances -discovered on the host, attempting to log in with a blank password for the "sa" -account. -* Targeted instances (run as a port script): If the port scan includes ports -that are identified as SQL Server instances, the script will run against each -instance in the same manner as the host script, but only against that particular -instance. In the case that an instance is targeted by a host script AND a port -script, it will only have its passwords tested once, but any successful results -will be listed in the output for both. - WARNING: SQL Server 2005 and later versions include support for account lockout policies (which are enforced on a per-user basis). + +NOTE: Communication with instances via named pipes depends on the smb +library. To communicate with (and possibly to discover) instances via named pipes, +the host must have at least one SMB port (e.g. TCP 445) that was scanned and +found to be open. Additionally, named pipe connections may require Windows +authentication to connect to the Windows host (via SMB) in addition to the +authentication required to connect to the SQL Server instances itself. See the +documentation and arguments for the smb library for more information. + +NOTE: By default, the ms-sql-* scripts may attempt to connect to and communicate +with ports that were not included in the port list for the Nmap scan. This can +be disabled using the mssql.scanned-ports-only script argument. ]] --- -- @usage --- nmap -p 445 --script ms-sql-discover,ms-sql-empty-password +-- nmap -p 445 --script ms-sql-empty-password --script-args mssql.instance-all -- nmap -p 1433 --script ms-sql-empty-password -- -- @output --- Host script results: --- | ms-sql-discover: --- | [...] -- | ms-sql-empty-password: -- | [192.168.100.128\PROD] -- |_ sa: => Login Success -- --- PORT STATE SERVICE --- 1433/tcp open ms-sql-s --- | ms-sql-empty-password: --- | [192.168.100.128\PROD] --- |_ sa: => Login Success --- --- -- Created 01/17/2010 - v0.1 - created by Patrik Karlsson -- Revised 02/01/2011 - v0.2 (Chris Woodbury) Index: scripts/ms-sql-hasdbaccess.nse =================================================================== --- scripts/ms-sql-hasdbaccess.nse (revision 22354) +++ scripts/ms-sql-hasdbaccess.nse (working copy) @@ -7,16 +7,13 @@ SQL Server credentials required: Yes (use ms-sql-brute, ms-sql-empty-password and/or mssql.username & mssql.password) +Run criteria: +* Host script: Will run if the mssql.instance-all, mssql.instance-name +or mssql.instance-port script arguments are used (see mssql.lua). +* Port script: Will run against any services identified as SQL Servers, but only +if the mssql.instance-all, mssql.instance-name +and mssql.instance-port script arguments are NOT used. -The script runs in two modes: -* Instances pre-discovered by ms-sql-discover or broadcast-ms-sql-discover -(run as a host script): The script will run against each of the instances -discovered on the host. -* Targeted instances (run as a port script): If the port scan includes ports -that are identified as SQL Server instances, the script will run against each -instance in the same manner as the host script, but only against that particular -instance. - The script needs an account with the sysadmin server role to work. When run, the script iterates over the credentials and attempts to run @@ -25,6 +22,18 @@ NOTE: The "owner" field in the results will be truncated at 20 characters. This is a limitation of the sp_MShasdbaccess stored procedure that the script uses. + +NOTE: Communication with instances via named pipes depends on the smb +library. To communicate with (and possibly to discover) instances via named pipes, +the host must have at least one SMB port (e.g. TCP 445) that was scanned and +found to be open. Additionally, named pipe connections may require Windows +authentication to connect to the Windows host (via SMB) in addition to the +authentication required to connect to the SQL Server instances itself. See the +documentation and arguments for the smb library for more information. + +NOTE: By default, the ms-sql-* scripts may attempt to connect to and communicate +with ports that were not included in the port list for the Nmap scan. This can +be disabled using the mssql.scanned-ports-only script argument. ]] --- Index: scripts/ms-sql-info.nse =================================================================== --- scripts/ms-sql-info.nse (revision 22368) +++ scripts/ms-sql-info.nse (working copy) @@ -3,33 +3,33 @@ description = [[ Attempts to determine configuration and version information for Microsoft SQL -Server instances. Works best in conjuction with the ms-sql-discover -script. +Server instances. SQL Server credentials required: No (will not benefit from mssql.username & mssql.password). +Run criteria: +* Host script: Will always run. +* Port script: N/A NOTE: Unlike previous versions, this script will NOT attempt to log in to SQL Server instances. Blank passwords can be checked using the -ms-sql-empty-password script. +ms-sql-empty-password script. E.g.: +nmap -sn --script ms-sql-empty-password --script-args mssql.instance-all -The script runs in two modes: -* Instances pre-discovered by ms-sql-discover or broadcast-ms-sql-discover -(run as a host script): In this mode, the script attempts to expand upon the -version information obtained by the discover script(s), which has limited -accuracy (see below). The script uses the list of instances -discovered on this host and attempts to connect to each one via TCP and/or named -pipes in order to obtain an accurate version number. Using this version number, -the script will determine what service pack (if any) the instance has installed -and whether any additional patches have been installed on top of the service -pack. -* Targeted instances (run as a port script): If the port scan includes ports -that are identified as SQL Server instances, the script will run against each -instance in the same manner as the host script, but only against that particular -instance. +The script uses two means of getting version information for SQL Server instances: +* Querying the SQL Server Browser service, which runs by default on UDP port +1434 on servers that have SQL Server 2000 or later installed. However, this +service may be disabled without affecting the functionality of the instances. +Additionally, it provides imprecise version information. +* Sending a probe to the instance, causing the instance to respond with +information including the exact version number. This is the same method that +Nmap uses for service versioning; however, this script can also do the same for +instances accessiable via Windows named pipes, and can target all of the +instances listed by the SQL Server Browser service. -In the event that the script is unable to obtain more accurate version -information (because ports are blocked or the ms-sql-discover.scanned-ports-only +In the event that the script can connect to the SQL Server Browser service +(UDP 1434) but is unable to connect directly to the instance to obtain more +accurate version information (because ports are blocked or the mssql.scanned-ports-only argument has been used), the script will rely only upon the version number provided by the SQL Server Browser/Monitor, which has the following limitations: * For SQL Server 2000 and SQL Server 7.0 instances, the RTM version number is @@ -42,20 +42,25 @@ levels and whether patches have been installed. However, in cases where particular determinations can not be made, the script will report only what can be confirmed. + +NOTE: Communication with instances via named pipes depends on the smb +library. To communicate with (and possibly to discover) instances via named pipes, +the host must have at least one SMB port (e.g. TCP 445) that was scanned and +found to be open. Additionally, named pipe connections may require Windows +authentication to connect to the Windows host (via SMB) in addition to the +authentication required to connect to the SQL Server instances itself. See the +documentation and arguments for the smb library for more information. + +NOTE: By default, the ms-sql-* scripts may attempt to connect to and communicate +with ports that were not included in the port list for the Nmap scan. This can +be disabled using the mssql.scanned-ports-only script argument. ]] --- -- @usage --- nmap -p 445 --script ms-sql-discover,ms-sql-info --- nmap -p 1433 --script ms-sql-info +-- nmap -p 445 --script ms-sql-info +-- nmap -p 1433 --script ms-sql-info --script-args mssql.instance-port=1433 -- -- @output --- (This depicts results from a hypothetical scan of nmap -p 445 --script ms-sql-discover,ms-sql-info 192.168.100.128. --- The second instance listed is firewalled and could not have its exact version identified. The third --- instance listed was hidden from the SQL Server Browser service, but was found by its default pipe name.) --- --- Host script results: --- | ms-sql-discover: --- | [...] -- | ms-sql-info: -- | Windows server name: WINXP -- | [192.168.100.128\PROD] @@ -83,20 +88,6 @@ -- | Post-SP patches applied: Yes -- |_ Named pipe: \\192.168.100.128\pipe\sql\query -- --- --- (This depicts results from a hypothetical scan of nmap -p 1433 --script ms-sql-info 192.168.100.129.) --- PORT STATE SERVICE --- 1433/tcp open ms-sql-s --- | ms-sql-info: --- | [192.168.100.129\MSSQLSERVER] --- | Instance name: MSSQLSERVER --- | Version: Microsoft SQL Server 2000 SP4 --- | Version number: 8.00.2039 --- | Product: Microsoft SQL Server 2000 --- | Service pack level: SP4 --- | Post-SP patches applied: No --- |_ TCP port: 1433 --- -- rev 1.0 (2007-06-09) -- rev 1.1 (2009-12-06 - Added SQL 2008 identification T Sellers) Index: scripts/ms-sql-query.nse =================================================================== --- scripts/ms-sql-query.nse (revision 22354) +++ scripts/ms-sql-query.nse (working copy) @@ -6,15 +6,24 @@ SQL Server credentials required: Yes (use ms-sql-brute, ms-sql-empty-password and/or mssql.username & mssql.password) +Run criteria: +* Host script: Will run if the mssql.instance-all, mssql.instance-name +or mssql.instance-port script arguments are used (see mssql.lua). +* Port script: Will run against any services identified as SQL Servers, but only +if the mssql.instance-all, mssql.instance-name +and mssql.instance-port script arguments are NOT used. -The script runs in two modes: -* Instances pre-discovered by ms-sql-discover or broadcast-ms-sql-discover -(run as a host script): The script will run against each of the instances -discovered on the host. -* Targeted instances (run as a port script): If the port scan includes ports -that are identified as SQL Server instances, the script will run against each -instance in the same manner as the host script, but only against that particular -instance. +NOTE: Communication with instances via named pipes depends on the smb +library. To communicate with (and possibly to discover) instances via named pipes, +the host must have at least one SMB port (e.g. TCP 445) that was scanned and +found to be open. Additionally, named pipe connections may require Windows +authentication to connect to the Windows host (via SMB) in addition to the +authentication required to connect to the SQL Server instances itself. See the +documentation and arguments for the smb library for more information. + +NOTE: By default, the ms-sql-* scripts may attempt to connect to and communicate +with ports that were not included in the port list for the Nmap scan. This can +be disabled using the mssql.scanned-ports-only script argument. ]] --- Index: scripts/ms-sql-tables.nse =================================================================== --- scripts/ms-sql-tables.nse (revision 22354) +++ scripts/ms-sql-tables.nse (working copy) @@ -6,16 +6,13 @@ SQL Server credentials required: Yes (use ms-sql-brute, ms-sql-empty-password and/or mssql.username & mssql.password) +Run criteria: +* Host script: Will run if the mssql.instance-all, mssql.instance-name +or mssql.instance-port script arguments are used (see mssql.lua). +* Port script: Will run against any services identified as SQL Servers, but only +if the mssql.instance-all, mssql.instance-name +and mssql.instance-port script arguments are NOT used. -The script runs in two modes: -* Instances pre-discovered by ms-sql-discover or broadcast-ms-sql-discover -(run as a host script): The script will run against each of the instances -discovered on the host. -* Targeted instances (run as a port script): If the port scan includes ports -that are identified as SQL Server instances, the script will run against each -instance in the same manner as the host script, but only against that particular -instance. - The sysdatabase table should be accessible by more or less everyone. Once we have a list of databases we iterate over it and attempt to extract @@ -26,6 +23,18 @@ or found all tables in all the databases. System databases are excluded. + +NOTE: Communication with instances via named pipes depends on the smb +library. To communicate with (and possibly to discover) instances via named pipes, +the host must have at least one SMB port (e.g. TCP 445) that was scanned and +found to be open. Additionally, named pipe connections may require Windows +authentication to connect to the Windows host (via SMB) in addition to the +authentication required to connect to the SQL Server instances itself. See the +documentation and arguments for the smb library for more information. + +NOTE: By default, the ms-sql-* scripts may attempt to connect to and communicate +with ports that were not included in the port list for the Nmap scan. This can +be disabled using the mssql.scanned-ports-only script argument. ]] --- Index: scripts/ms-sql-xp-cmdshell.nse =================================================================== --- scripts/ms-sql-xp-cmdshell.nse (revision 22354) +++ scripts/ms-sql-xp-cmdshell.nse (working copy) @@ -7,21 +7,30 @@ SQL Server credentials required: Yes (use ms-sql-brute, ms-sql-empty-password and/or mssql.username & mssql.password) +Run criteria: +* Host script: Will run if the mssql.instance-all, mssql.instance-name +or mssql.instance-port script arguments are used (see mssql.lua). +* Port script: Will run against any services identified as SQL Servers, but only +if the mssql.instance-all, mssql.instance-name +and mssql.instance-port script arguments are NOT used. -The script runs in two modes: -* Instances pre-discovered by ms-sql-discover or broadcast-ms-sql-discover -(run as a host script): The script will run against each of the instances -discovered on the host. -* Targeted instances (run as a port script): If the port scan includes ports -that are identified as SQL Server instances, the script will run against each -instance in the same manner as the host script, but only against that particular -instance. - The script needs an account with the sysadmin server role to work. When run, the script iterates over the credentials and attempts to run the command until either all credentials are exhausted or until the command is executed. + +NOTE: Communication with instances via named pipes depends on the smb +library. To communicate with (and possibly to discover) instances via named pipes, +the host must have at least one SMB port (e.g. TCP 445) that was scanned and +found to be open. Additionally, named pipe connections may require Windows +authentication to connect to the Windows host (via SMB) in addition to the +authentication required to connect to the SQL Server instances itself. See the +documentation and arguments for the smb library for more information. + +NOTE: By default, the ms-sql-* scripts may attempt to connect to and communicate +with ports that were not included in the port list for the Nmap scan. This can +be disabled using the mssql.scanned-ports-only script argument. ]] ---