Skip to content

MSSQL

ℹ️ Informations

  • 🌐 Website: HackTheBox
  • 📚 Module: Footprinting
  • 🔗 Link: MSSQL

❓Question

Enumerate the target using the concepts taught in this section. List the hostname of MSSQL server.

📋 Walkthrough

Start with enumeration: 

sudo nmap --script ms-sql* -sV -p1433 10.129.133.116
This command runs for several minutes but the answer is under ms-sql-ntlm-info script.

Answer

I**-***-**

❓Question

Connect to the MSSQL instance running on the target using the account (backdoor:Password1), then list the non-default database present on the server.

📋 Walkthrough

Connect using mssqclient 

impacket-mssqlclient backdoor@10.129.133.116 -windows-auth
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

Password:
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(ILF-SQL-01): Line 1: Changed database context to 'master'.
[*] INFO(ILF-SQL-01): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (ILF-SQL-01\backdoor  dbo@master)>
To show up database's name we have to run this command 
select name from sys.databases;

Answer

E********