Using Impacket to Exploit Misconfigured Microsoft SQL Server
Summary
A penetration-testing walkthrough shows how weak SQL credentials, IMPERSONATE permissions, or linked servers can lead to SQL Server sysadmin access, OS command execution, and file uploads, and outlines defenses.
Key points
- The walkthrough uses Impacket’s mssqlclient.py against a Windows Server running Microsoft SQL Server 2016.
- It demonstrates database and login enumeration, including identifying IMPERSONATE permissions on the sa login.
- It shows how impersonation or a linked server configured with sa can enable sysadmin access.
- With sysadmin privileges, xp_cmdshell can run OS commands; the walkthrough also demonstrates directory enumeration with xp_dirtree.
- The file-upload example uses xp_cmdshell and certutil to transfer and verify a file.
- Recommended defenses include securing or disabling sa, removing unnecessary IMPERSONATE permissions, restricting linked servers, disabling xp_cmdshell, auditing activity, and segmenting SQL Server networks.
Article Details
- Topic
- MSSQL misconfiguration exploitation, including privilege escalation and OS command execution, with defensive hardening recommendations.
Vendors
Products
Microsoft SQL ServerThis walkthrough demonstrates how common Microsoft SQL Server misconfigurations can be chained to achieve full OS-level compromise during penetration tests and red team engagements.Windows ServerThe target in our demonstration is a Windows Server running Microsoft SQL Server 2016 (SP2) at IP address 192.168.1.4.
Tools
ImpacketUsing Impacket’s mssqlclient.py, an attacker can authenticate, enumerate databases and logins, escalate to SA via IMPERSONATE or linked servers, enable xp_cmdshell, execute OS commands, and upload files — defenders mustmssqlclient.pyUsing Impacket’s mssqlclient.py, an attacker can authenticate, enumerate databases and logins, escalate to SA via IMPERSONATE or linked servers, enable xp_cmdshell, execute OS commands, and upload files — defenders must