MSSQL 1433,1434,2433

MSSQL Enumeration and Scanning (Ports 1433, 1434, 2433)

Step 1: Define the Target IP

Replace <target_ip> with the actual IP address of the target.

# Define the target IP
export TARGET_IP="192.168.1.100"

---

Step 2: Perform an Nmap Scan for MSSQL Services

Basic Scan

nmap -p 1433,1434,2433 -sV --script ms-sql* <target_ip>

Explanation:

• -p 1433,1434,2433: Specifies MSSQL ports.

• -sV: Detects the service version.

• --script ms-sql*: Runs MSSQL-related NSE scripts for enumeration.

Advanced Scan

nmap -p 1433,1434,2433 --script ms-sql-info,ms-sql-dump-hashes <target_ip>

Explanation:

• ms-sql-info: Retrieves version and instance information.

• ms-sql-dump-hashes: Attempts to dump password hashes if authentication succeeds.

---

Step 3: Enumerate MSSQL Using Metasploit

msfconsole

1. Launch Metasploit:

   msfconsole

2. Use the MSSQL auxiliary module:

   use auxiliary/scanner/mssql/mssql_ping
   set RHOSTS <target_ip>
   run

Brute Force Credentials

1. Use the MSSQL login module:

   use auxiliary/scanner/mssql/mssql_login
   set RHOSTS <target_ip>
   set USERNAME sa
   set PASS_FILE /path/to/password-list.txt
   run

---

Step 4: Enumerate MSSQL Manually Using sqsh (SQL Shell)

1. Install sqsh:

   sudo apt install sqsh

2. Connect to the MSSQL server:

   sqsh -S <target_ip> -U <username> -P <password>

3. Run queries to enumerate databases and users:

   SELECT name FROM sys.databases;
   SELECT * FROM sys.syslogins;

---

Step 5: Enumerate MSSQL Using Impacket's mssqlclient.py

1. Clone the Impacket repository:

   git clone https://github.com/SecureAuthCorp/impacket.git
   cd impacket/examples

2. Run mssqlclient:

   python3 mssqlclient.py <domain>/<username>:<password>@<target_ip>

3. Execute enumeration commands:

   SELECT name FROM sys.databases;
   SELECT name FROM sysobjects WHERE xtype = 'U';

---

Step 6: Enumerate MSSQL Using CrackMapExec

Scan for MSSQL Instances

cme mssql <target_ip> --port 1433,1434,2433

Test for Null Authentication

cme mssql <target_ip> -u '' -p ''

Brute Force Login

cme mssql <target_ip> -u sa -P /path/to/password-list.txt

---

Additional Notes

• Ensure tools like sqsh, Impacket, Nmap, and CrackMapExec are installed.

• Enumerate for default credentials and weak passwords.

• Leverage scripts for detailed enumeration and potential exploitation of misconfigurations.