Skip to content
HackIndex logo

HackIndex

MSSQL Dangerous Configuration Checks

4 min read Mar 26, 2026

Several SQL Server features are disabled by default but are commonly re-enabled by DBAs and application teams. Each one represents a distinct exploitation path when accessible to the current login. Confirming which are active before attempting exploitation avoids unnecessary noise and tightens the attack plan.

All checks here require an authenticated SQL session. Use impacket-mssqlclient to run these queries interactively.

Check Current Privilege Level First

Confirm your privilege context before checking configurations. Some settings are only visible to sysadmin:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP -windows-auth
mysql> SELECT SYSTEM_USER; SELECT IS_SRVROLEMEMBER('sysadmin') AS is_sysadmin; SELECT IS_SRVROLEMEMBER('public') AS is_public; 
SYSTEM_USER: CORP\sqlsvc
is_sysadmin: 1
is_public:   1

is_sysadmin returning 1 means all configuration checks will succeed and all exploitation paths are available. If it returns 0, configuration reads may still work depending on the public role permissions, but write operations like enabling xp_cmdshell will fail without impersonation or privilege escalation first.

xp_cmdshell Status

xp_cmdshell executes OS commands as the SQL Server service account. When enabled, it is a direct OS execution primitive. Check whether it is currently enabled:

mysql> SELECT name, value, value_in_use FROM sys.configurations WHERE name = 'xp_cmdshell'; 
name          value  value_in_use
xp_cmdshell   1      1

value_in_use of 1 means xp_cmdshell is active right now and usable without any configuration changes. value of 1 but value_in_use of 0 means it is configured on but requires a RECONFIGURE to activate. Both cases lead to the xp_cmdshell exploitation page.

Ole Automation Procedures

Ole Automation allows creating COM objects from T-SQL, including WScript.Shell for command execution and MSXML2.ServerXMLHTTP for outbound HTTP. It is an alternative OS execution path when xp_cmdshell is disabled:

mysql> SELECT name, value, value_in_use FROM sys.configurations WHERE name = 'Ole Automation Procedures'; 
name                        value  value_in_use
Ole Automation Procedures   1      1

Ole Automation enabled alongside or instead of xp_cmdshell gives equivalent OS access through a different T-SQL path. Flag both as active when found.

Linked Servers with RPC

Linked servers allow queries to be forwarded to other SQL Server instances. When RPC Out is enabled on a linked server, stored procedures including xp_cmdshell can be executed on the remote instance. This is a lateral movement path even when local privileges are limited:

mysql> SELECT name, product, provider, data_source, is_rpc_out_enabled, is_data_access_enabled FROM sys.servers WHERE is_linked = 1; 
name         product    is_rpc_out_enabled  is_data_access_enabled
SQL-PROD-02  SQL Server 1                   1

Any linked server with is_rpc_out_enabled = 1 is a pivot candidate. The security context under which the linked server connection runs determines what privileges you land with on the remote instance. Check the linked server login mappings:

mysql> EXEC sp_helplinkedsrvlogin;

A self-mapping entry or a mapping to a high-privilege account on the remote server means the linked server pivot may land you with elevated privileges on the target instance.

Service Account Privileges

SQL Server service accounts running as NT AUTHORITY\SYSTEM, a Domain Admin, or a highly privileged domain service account give any sysadmin-level SQL access OS-level impact immediately. Confirm what the service account is:

mysql> EXEC xp_cmdshell 'whoami'; 
nt authority\system

NT AUTHORITY\SYSTEM output means OS commands execute at SYSTEM level. Any command execution via xp_cmdshell or Ole Automation gives full host compromise without a separate privilege escalation step.

Impersonation Rights

EXECUTE AS LOGIN allows one login to impersonate another. When a low-privilege login can impersonate sa or a sysadmin, it is a direct privilege escalation path. Check which logins the current user can impersonate:

mysql> SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE'; 
name
sa
Admin

Any sysadmin account appearing in this output means impersonation-based privilege escalation is available. The exploitation path is covered in the MSSQL impersonation page.

Bulk Quick Check with nxc

nxc can check for xp_cmdshell availability in a single command without opening an interactive session:

┌──(kali㉿kali)-[~]
└─$ nxc mssql $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --get-output-tries 5 -x 'SELECT name, value_in_use FROM sys.configurations WHERE name IN (''xp_cmdshell'',''Ole Automation Procedures'')'

References