Powersploit + OrcaMDF hacking.

SqlScan.ps1

Import-Module PowerSploit

$vssPath = Join-Path $env:TEMP ([Guid]::NewGuid())
#TODO: Magical nuget stuff I talked to Matt about
$orcaMdfCorePath = 'C:\Users\Justin\Documents\Visual Studio 2013\Projects\OrcaMDF\src\OrcaMDF.Core\bin\Debug\OrcaMDF.Core.dll'
$orcaMdfFrameworkPath = 'C:\Users\Justin\Documents\Visual Studio 2013\Projects\OrcaMDF\src\OrcaMDF.Core\bin\Debug\OrcaMDF.Framework.dll'

mkdir $vssPath

Write-Host "Vss Path $vssPath"

#Get-CimInstance  Win32_volume|select DriveLetter, DeviceId

function Get-SqlInstance {
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory = $False)]
        [ValidateNotNullOrEmpty()]
        [String]
        $ComputerName =  $env:COMPUTERNAME
    )
    BEGIN {
        Write-Verbose "ComputerName: $ComputerName"
        $hklm = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $ComputerName)
        $instanceKey= $hklm.OpenSubKey("SOFTWARE\\Microsoft\\Microsoft SQL Server\\Instance Names\\SQL" )
        if ([IntPtr]::Size -eq 8) {
            $instanceKey32= $hklm.OpenSubKey("SOFTWARE\\WOW6432Node\\Microsoft\\Microsoft SQL Server\\Instance Names\\SQL" )
        }
        
    }
    PROCESS {
        function InstanceInfo ([string]$Name, [string]$InstanceId, [switch] $Is32Bit) {
            if ($Is32Bit) { $RegistryPath = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Microsoft SQL Server\$($InstanceId)"; }
            else { $RegistryPath = "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$($InstanceId)"; }
            $row = New-Object PSCustomObject -Property @{ 
                'Name' = $_; 
                'InstanceId' = $InstanceId; 
                'Is32Bit' = $Is32Bit ;
                'RegistryPath' = $RegistryPath;
                'RootPath' = (Get-ItemProperty "$($RegistryPath)\Setup" 'SqlDataRoot').SqlDataRoot;
                'Binn' = (Get-ItemProperty "$($RegistryPath)\Setup" 'SqlBinRoot').SqlBinRoot;
                'MssqlSystemResource' = [String] $null;
                'MasterMdfPath' = (Get-ItemProperty "$($RegistryPath)\MSSQLSERVER\Parameters" 'SqlArg0').SqlArg0 -Replace '^-d', '';
            }
            $row.MssqlSystemResource = Join-Path $row.Binn 'mssqlsystemresource.mdf'
            $row | Write-Output
            
        }
        $instanceKey.GetValueNames() | % { InstanceInfo -Name $_ $instanceKey.GetValue($_) }
        if ($instanceKey32 -ne $null) { $instanceKey32.GetValueNames() | % { InstanceInfo -Name $_ $instanceKey32.GetValue($_) -Is32Bit } }
    }
    END {
        $hklm.Close()
    }
}

Add-Type -Path $orcaMdfCorePath
Add-Type -Path $orcaMdfFrameworkPath

Get-SqlInstance | %{
    $masterMdfPath = [string]$_.MasterMdfPath
    try {
        $db = New-Object 'OrcaMDF.Core.Engine.Database' $masterMdfPath
        $_
    }
    catch { Write-Warning $_.Exception }
}