← Back to Academy

Academy Node

MSSQL Enumeration

MSSQL enumeration checks auth, roles, linked servers, xp_cmdshell, impersonation, and coercion opportunities.

Intermediate100 XPEnumeration

Why it matters

SQL often gives OSCP footholds through creds, command execution, or hashes.

How to identify it

  • Port 1433 open
  • MSSQL service SPN
  • Valid domain or SQL creds

BloodHound indicators

  • SQLAdmin

NetExec commands

nxc mssql 192.168.184.150 -u USER -p PASS -d xutslabs.local

Impacket commands

impacket-mssqlclient xutslabs.local/USER:PASS@192.168.184.150 -windows-auth

Expected output

  • SQL prompt
  • Server version
  • Login success

Success looks like

  • Query execution
  • sysadmin or linked server found

Failure looks like

  • Login failed
  • TCP blocked

Troubleshooting

  • Try Windows auth and SQL auth
  • Check domain syntax

Common mistakes

  • Not trying impacket-mssqlclient
  • Not checking linked servers

Alternative attacks

  • Kerberoast MSSQLSvc

What to try next

  • SQLAdmin
  • xp_cmdshell
  • linked servers

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.