Josh Stone — Infosec, Pen-testing, Research

SQShell

By Josh Stone     Back to home

TL;DR → Download SQShell
(remember, DB2 and Oracle don't work until you follow instructions below!)

Introduction

SQShell is a tool I've carted around for awhile, but never published because of licensing concerns. I finally figured out how I can handle the incorporation of proprietary drivers, so I'm pushing this out.

Have you ever wished that every database could be accessed in a simple, command line way, ala the classic CLI MySQL client? Well, look no further — this is the purpose of SQShell. It is built on the Java JDBC ecosystem, incorporating database drivers for all of the major DBs (that I've had to pentest). It's pretty easy to add more, so let me know if you'd like to see another one incorporated.

Currently supported:

The value doesn't stop there, though. There are common tasks that you'll want to do in all DBs. This might include enumerating tables, examining schemas, listing users, etc. Each major SQL DB handles this in a different way — is it a custom query like in MySQL ("show databases", etc.)? Is it a set of metadata tables that describe the structure (e.g., MS-SQL)? Well, I can never remember these arcane things, and find myself looking at cheat-sheets, etc.

To solve this problem, SQShell builds in commands that carry out these actions in a DB-specific way. This way you don't have to remember how to list the databases... just type "db.list", and it should just work (note, some DBs dont' have as much support, like DB2, for example; but hey, it's a free tool!).

Not sure what I mean? Here's a video demonstration. This is an older version (before Oracle and DB2 support, etc.), but it should communicate what it's about:

Getting SQShell

You can download SQShell below. Note that this version will claim to support DB2 and Oracle, but this is not the case! This support relies on drivers that I don't think I can distribute with SQShell. You will have to add them following instructions later on this page.

VersionDateDownload Link
0.52015-11-02sqshell-0.5-pub.jar

Adding Drivers

As I said above, I can't package the Oracle and DB2 drivers with SQShell. You will need to download these from the vendors yourself and build a new JAR containing them. It's not that hard to do, though — here are some instructions.

First, download the drivers. Here are some links that might be about right:

Each of these are self-contained JAR files, but unless you want to define the classpath every time you run SQShell, you will probably want to add the drivers to the SQShell JAR. Another reason is to have them in one file — say you want to upload SQShell to a victim that lets you pivot to the DB; it's nicer if it's just one file.

We want to get the class files for the drivers into the JAR file, so here's how to do it. First, unpack the SQShell JAR in its own directory somewhere:

			$ mkdir unpack
			$ cd unpack
			$ jar xf ../sqshell-0.5-pub.jar

Now, we unpack the relevant content from the downloaded JARs:

			$ jar xf ../ojdbc6.jar oracle
			$ jar xf ../db2jcc4.jar com

Then, create a new JAR file with the unified contents:

			$ jar cfm ../sqshell-0.5.jar META-INF/MANIFEST.MF *

Now you should be able to use the DB2 and Oracle drivers! Yay!