Add --list-backups allowing enumerating databases backups on MSSQL

[Dfte]

Description

This PR adds the --list-backups option allowing finding databases backups location.

Type of change

Insert an "x" inside the brackets for relevant items (do not delete options)

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Deprecation of feature or functionality
• This change requires a documentation update
• This requires a third party update (such as Impacket, Dploot, lsassy, etc)
• This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description)

Setup guide for the review

Run:

First create a database then run the following query:

DECLARE @db_name sysname;
DECLARE @path nvarchar(500);

DECLARE db_cursor CURSOR FOR
SELECT name FROM sys.databases
WHERE name NOT IN ('master','model','msdb','tempdb')
AND state_desc = 'ONLINE';

OPEN db_cursor;
FETCH NEXT FROM db_cursor INTO @db_name;

WHILE @@FETCH_STATUS = 0
BEGIN
    SET @path = 'C:\Windows\Temp\' + @db_name + '_' + 
        REPLACE(CONVERT(varchar, GETDATE(), 112), '-', '') + '.bak';
    
    BACKUP DATABASE @db_name
    TO DISK = @path;
    
    FETCH NEXT FROM db_cursor INTO @db_name;
END;

CLOSE db_cursor;
DEALLOCATE db_cursor;

That is going to go through all databases and backup them on c:\windows\temp. These files, .bak, are the the actual zipped like databases with their content.

nxc mssql  IP -u USER -p PASS  --backups

From there an attacker could see if he has got access to these directories and may be exfiltrate sensitive data. That's mostly a recon option.

Screenshots (if appropriate):

Checklist:

Insert an "x" inside the brackets for completed and relevant items (do not delete options)

• I have ran Ruff against my changes (poetry: poetry run ruff check ., use --fix to automatically fix what it can)
• I have added or updated the tests/e2e_commands.txt file if necessary (new modules or features are required to be added to the e2e tests)
• If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
• I have linked relevant sources that describes the added technique (blog posts, documentation, etc)
• I have performed a self-review of my own code (not an AI review)
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

[NeffIsBack]

Very nice, thanks!

Can you include the settings that need to be configured so I get output in the setup guide? What kind of file is that backup file?

We should probably also describe how this can be (ab)used in the wiki then.

[Dfte]

Very nice, thanks!

Can you include the settings that need to be configured so I get output in the setup guide? What kind of file is that backup file?

We should probably also describe how this can be (ab)used in the wiki then.

Done :P
And yeah, I'll add all these PR's in the Wiki!

[Dfte]

Last commit adds the encryption status of the backups: