Enumeration

Mandatory

1. Deter­mine ver­sion:
   nmap -p 445 --script ms-sql-info $target
2. If cre­den­tials are known:
   1. Try to con­nect to the DB (alter­na­tive: Intel­liJ, …):
      sqsh -U sa -P $password -S $target:1433
   2. Try to exe­cute com­mands:
      msf> use auxiliary/admin/mssql/mssql_exec
msf> use windows/mssql/mssql_payload
      1. If mssql_exec does­n’t work, take care of domain/username and powershell.exe ‑com­mand type system.

Optional

• Brute-force login (e.g. with msf> use scanner/mssql/mssql_login).