# Exploitation

> RCE, privilege escalation, and credential capture via MSSQL

- **URL:** https://hackindex.io/services/mssql/exploitation
- **Service:** [MSSQL](https://hackindex.io/services/mssql.md)
- **Tags:** initial-access, execution
- **Published:** 2026-03-26
- **Updated:** 2026-03-29

MSSQL exploitation turns database access into operating system control. Enabling xp_cmdshell provides direct command execution as the SQL Server service account. OLE Automation procedures and CLR assembly loading offer alternative execution paths when xp_cmdshell is restricted.

Credential brute-forcing against sa and other accounts is often viable since MSSQL instances frequently use weak or default passwords. Known CVEs in unpatched instances can provide unauthenticated access or privilege escalation.

## Guides

- [MSSQL Credential Capture via Forced Authentication](https://hackindex.io/services/mssql/exploitation/mssql-credential-capture-via-forced-authentication.md)
- [MSSQL Privilege Escalation via Impersonation](https://hackindex.io/services/mssql/exploitation/mssql-privilege-escalation-via-impersonation.md): Exploit MSSQL IMPERSONATE privileges to escalate from low-privileged login to sysadmin by chaining user impersonation within database execution contexts.
- [MSSQL RCE via xp_cmdshell](https://hackindex.io/services/mssql/exploitation/mssql-rce-via-xp-cmdshell.md): Exploit MSSQL xp_cmdshell to achieve remote code execution, covering enablement via sp_configure, privilege requirements, and command execution techniques.