0

I'm trying to recover a hard-coded password for SQL Server from an old VB6 application. Is there any way to get MS SQL Server to record the passwords used when a login attempt fails?

I've checked the VB6 app for strings and I've found the uid but the password is eluding me. I'm hoping there's a way to record this information at the SQL Server, rather than reverse-engineering the old VB6 app.

The VB6 app is using OLE DB to connect to SQL. I wondered if there was a way to get OLE DB to dump the connection string. This would also give me the info I need.

I don't have any source available. I think the password is created in RAM based off some other variables available. It's not in the OLE DB config manager.

The old VB6 app doesn't use the same password for SQL at every install. It's not a hard-coded password. That's why I was hoping to get it on the server-side.

0

2 Answers 2

1

Problem resolved with a bit of old-fashioned reversing.

I used some software called API Monitor (http://www.rohitab.com/apimonitor) so I could watch the OLEDB API call, peek into it, and get the required credential.

I had originally planned to use Frida (frida.re) but found the API Monitor approach much quicker for the VB6 app.

0
0

The doc says:

SQL Server always encrypts network packets associated with logging in. If no certificate has been provisioned on the server when it starts up, SQL Server generates a self-signed certificate, which is used to encrypt login packets.

Therefore, if you're not able to get it from the source code, you won't even be able to capture it on the fly with a packet analyzer like Wireshark.

One thing you could try is to import that login to a local/lab instance and use some brute force tool to discover the password. Since the app is old, the password security might not be that hard to break today.

I've never done this, just an idea that occurred to me.

1
  • 1
    Not always. Tabular datastream uses simple bit-flipping for plaintext passwords. For some cases, it is possible to snoop with Wireshark.
    – vonPryz
    Commented Nov 4, 2021 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.