# MSSQL

> MSSQL is Microsoft's relational DB server. Attackers enumerate instances, exploit weak creds and xp_cmdshell for RCE, escalate to SYSTEM, pivot via linked servers, and exfiltrate stored data

- **URL:** https://hackindex.io/services/mssql
- **Type:** Service
- **Default ports:** 1433
- **Tags:** mssql, database, windows, sql, network, enumeration
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

Microsoft SQL Server (MSSQL) runs on **TCP port 1433** by default, with the SQL Browser service on **UDP port 1434** for instance discovery. Nmap identifies it as `ms-sql-s`. MSSQL is widely used in enterprise environments and commonly found on Windows domain-joined servers.

Default or weak `sa` credentials are a frequent finding. Once authenticated, the `xp_cmdshell` stored procedure can execute OS commands directly. MSSQL also supports linked servers, which can chain access across multiple database instances. Impersonation and privilege escalation through database roles are additional attack vectors.

Use `nmap --script ms-sql-info` to gather version and instance details. Test credentials with `crackmapexec mssql` or `mssqlclient.py` from Impacket. After login, check for `xp_cmdshell` availability, linked servers, impersonatable logins, and sensitive data in databases.

## Phases

- [Enumeration](https://hackindex.io/services/mssql/enumeration.md): Enumerate MSSQL using nmap, nxc, and impacket for DB info (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/mssql/vulnerability-discovery.md): Find weak creds and dangerous MSSQL configs like xp_cmdshell (2 guides)
- [Exploitation](https://hackindex.io/services/mssql/exploitation.md): RCE, privilege escalation, and credential capture via MSSQL (3 guides)
- [Post-Exploitation](https://hackindex.io/services/mssql/post-exploitation.md): Pillage DBs, dump password hashes, and loot stored credentials (2 guides)
- [Privilege Escalation](https://hackindex.io/services/mssql/privilege-escalation.md): Escalate MSSQL sysadmin to SYSTEM via Agent Jobs (1 guides)
- [Lateral Movement](https://hackindex.io/services/mssql/lateral-movement.md): Move laterally via MSSQL linked servers using OPENQUERY and AT (1 guides)