Skip to content

Instantly share code, notes, and snippets.

@zippy1981
Last active Aug 29, 2015
Embed
What would you like to do?
Powersploit + OrcaMDF hacking.
Import-Module PowerSploit
$vssPath = Join-Path $env:TEMP ([Guid]::NewGuid())
#TODO: Magical nuget stuff I talked to Matt about
$orcaMdfCorePath = 'C:\Users\Justin\Documents\Visual Studio 2013\Projects\OrcaMDF\src\OrcaMDF.Core\bin\Debug\OrcaMDF.Core.dll'
$orcaMdfFrameworkPath = 'C:\Users\Justin\Documents\Visual Studio 2013\Projects\OrcaMDF\src\OrcaMDF.Core\bin\Debug\OrcaMDF.Framework.dll'
mkdir $vssPath
Write-Host "Vss Path $vssPath"
#Get-CimInstance Win32_volume|select DriveLetter, DeviceId
function Get-SqlInstance {
[CmdletBinding()]
Param(
[Parameter(Mandatory = $False)]
[ValidateNotNullOrEmpty()]
[String]
$ComputerName = $env:COMPUTERNAME
)
BEGIN {
Write-Verbose "ComputerName: $ComputerName"
$hklm = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $ComputerName)
$instanceKey= $hklm.OpenSubKey("SOFTWARE\\Microsoft\\Microsoft SQL Server\\Instance Names\\SQL" )
if ([IntPtr]::Size -eq 8) {
$instanceKey32= $hklm.OpenSubKey("SOFTWARE\\WOW6432Node\\Microsoft\\Microsoft SQL Server\\Instance Names\\SQL" )
}
}
PROCESS {
function InstanceInfo ([string]$Name, [string]$InstanceId, [switch] $Is32Bit) {
if ($Is32Bit) { $RegistryPath = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Microsoft SQL Server\$($InstanceId)"; }
else { $RegistryPath = "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$($InstanceId)"; }
$row = New-Object PSCustomObject -Property @{
'Name' = $_;
'InstanceId' = $InstanceId;
'Is32Bit' = $Is32Bit ;
'RegistryPath' = $RegistryPath;
'RootPath' = (Get-ItemProperty "$($RegistryPath)\Setup" 'SqlDataRoot').SqlDataRoot;
'Binn' = (Get-ItemProperty "$($RegistryPath)\Setup" 'SqlBinRoot').SqlBinRoot;
'MssqlSystemResource' = [String] $null;
'MasterMdfPath' = (Get-ItemProperty "$($RegistryPath)\MSSQLSERVER\Parameters" 'SqlArg0').SqlArg0 -Replace '^-d', '';
}
$row.MssqlSystemResource = Join-Path $row.Binn 'mssqlsystemresource.mdf'
$row | Write-Output
}
$instanceKey.GetValueNames() | % { InstanceInfo -Name $_ $instanceKey.GetValue($_) }
if ($instanceKey32 -ne $null) { $instanceKey32.GetValueNames() | % { InstanceInfo -Name $_ $instanceKey32.GetValue($_) -Is32Bit } }
}
END {
$hklm.Close()
}
}
Add-Type -Path $orcaMdfCorePath
Add-Type -Path $orcaMdfFrameworkPath
Get-SqlInstance | %{
$masterMdfPath = [string]$_.MasterMdfPath
try {
$db = New-Object 'OrcaMDF.Core.Engine.Database' $masterMdfPath
$_
}
catch { Write-Warning $_.Exception }
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment