TLDRBins TLDRBins / MSSQL General

Usage Tips:

  • Click on a keyword to enable inline editing.
  • Click inside a code block to copy (excludes comments).
  • Use the button to view examples.
  • Click outside to collapse all examples.

Connect to MSSQL DB

# Password
impacket-mssqlclient '<USER>:<PASSWORD>@<TARGET>'

Sample Output:
TO-DO
# Windows auth
impacket-mssqlclient -windows-auth '<USER>:<PASSWORD>@<TARGET>'

Sample Output:
TO-DO
# Kerberos
impacket-mssqlclient -k <TARGET>

Sample Output:
TO-DO
# Current user
sqlcmd -S '<TARGET>' -Q "<QUERY>"

Sample Output:
TO-DO
# Password
sqlcmd -S '<TARGET>' -U '<USER>' -P '<PASSWORD>' -d '<DB_NAME>' -Q "<QUERY>"

Sample Output:
TO-DO

General

# Check mssql version
SELECT @@version;

Sample Output:
TO-DO
# Check current user
SELECT suser_name();

Sample Output:
TO-DO
# Check users
SELECT name FROM master..syslogins

Sample Output:
TO-DO
# Check sysadmin
SELECT name FROM master..syslogins WHERE sysadmin = '1';

Sample Output:
TO-DO
# Check service name and the account authorized to control the service
SELECT servicename, service_account FROM sys.dm_server_services;

Sample Output:
TO-DO
# List principals
SELECT name FROM sys.database_principals;

Sample Output:
TO-DO
# Check privilege over a principal from current user
SELECT entity_name, permission_name FROM fn_my_permissions('<PRINCIPAL>', 'USER');

Sample Output:
TO-DO
# Fix : Cannot resolve the collation conflict between "Latin1_General_CI_AI" and "SQL_Latin1_General_CP1_CI_AS"
SELECT entity_name collate DATABASE_DEFAULT,permission_name collate DATABASE_DEFAULT FROM fn_my_permissions('<PRINCIPAL>', 'USER');

Sample Output:
TO-DO
# Check current user privilege
SELECT entity_name, permission_name FROM fn_my_permissions(NULL, 'SERVER');

Sample Output:
TO-DO
# Check impersonate
SELECT name FROM sys.server_principals WHERE HAS_PERMS_BY_NAME(name, 'SERVER', 'IMPERSONATE') = 1;

Sample Output:
TO-DO
# Show databases
SELECT name FROM master..sysdatabases;

Sample Output:
TO-DO
# Show current database
SELECT DB_NAME();

Sample Output:
TO-DO
# List tables and schema
SELECT table_name,table_schema from <DB_NAME>.INFORMATION_SCHEMA.TABLES;

Sample Output:
TO-DO
# Select all from table
SELECT * from <DB_NAME>.<TABLE_SCHEMA>.<TABLE_NAME>;

Sample Output:
TO-DO
# Get domain name
SELECT DEFAULT_DOMAIN();

Sample Output:
TO-DO
# Get user SID
SELECT master.dbo.fn_varbintohexstr(SUSER_SID('<DOMAIN>\<USER>'))

Sample Output:
TO-DO
# Get group SID
SELECT master.dbo.fn_varbintohexstr(SUSER_SID('<DOMAIN>\<GROUP>'))

Sample Output:
TO-DO
# Read a text file
SELECT * FROM OPENROWSET(BULK N'<FILE>', SINGLE_CLOB) AS Contents

Sample Output:
TO-DO
# Read file system
xp_dirtree C:\

Sample Output:
TO-DO

Create sa User

CREATE LOGIN '<USER>' WITH PASSWORD = '<PASSWORD>';

Sample Output:
TO-DO
EXEC sp_addsrvrolemember '<USER>', 'sysadmin';

Sample Output:
TO-DO