Skip to content
HackIndex.io
MSSQL
Service

MSSQL

MSSQL is Microsoft's relational DB server. Attackers enumerate instances, exploit weak creds and xp_cmdshell for RCE, escalate to SYSTEM, pivot via linked servers, and exfiltrate stored data

:1433 10 guides 6 phases
1 min read Created: Dec 28, 2025 Updated: Jul 14, 2026

Microsoft SQL Server (MSSQL) runs on TCP port 1433 by default, with the SQL Browser service on UDP port 1434 for instance discovery. Nmap identifies it as ms-sql-s. MSSQL is widely used in enterprise environments and commonly found on Windows domain-joined servers.

Default or weak sa credentials are a frequent finding. Once authenticated, the xp_cmdshell stored procedure can execute OS commands directly. MSSQL also supports linked servers, which can chain access across multiple database instances. Impersonation and privilege escalation through database roles are additional attack vectors.

Use nmap --script ms-sql-info to gather version and instance details. Test credentials with crackmapexec mssql or mssqlclient.py from Impacket. After login, check for xp_cmdshell availability, linked servers, impersonatable logins, and sensitive data in databases.

Enumeration

Enumerate MSSQL using nmap, nxc, and impacket for DB info

1

Vulnerability Discovery

Find weak creds and dangerous MSSQL configs like xp_cmdshell

2

Exploitation

RCE, privilege escalation, and credential capture via MSSQL

3

MSSQL RCE via xp_cmdshell

Exploit MSSQL xp_cmdshell to achieve remote code execution, covering enablement via sp_configure, privilege requirements, and command execution techniques.

Mar 26, 2026 • 4 min read

Post-Exploitation

Pillage DBs, dump password hashes, and loot stored credentials

2

MSSQL Credential Dump

Techniques for extracting credentials from MSSQL databases post-compromise, including sa accounts, linked server passwords, and stored connection strings.

May 15, 2026 • 4 min read

MSSQL Database Pillaging

Techniques for extracting credentials, data, and secrets from compromised MSSQL instances, including linked servers, agent jobs, and stored procedures.

May 15, 2026 • 4 min read

Privilege Escalation

Escalate MSSQL sysadmin to SYSTEM via Agent Jobs

1

Lateral Movement

Move laterally via MSSQL linked servers using OPENQUERY and AT

1