Metasploit MS SQL modules

The Metasploit Framework ships a complete toolkit for enumerating and exploiting ms-sql-server instances. The four core modules cover the full attack lifecycle from discovery to shell:

Discovery: auxiliary/scanner/mssql/mssql_ping

Queries hosts on UDP 1434 (the SQL Server Browser service) to determine the TCP port any MSSQL instance is listening on. This matters because named instances listen on randomized TCP ports — the Browser service is the directory that maps instance names to ports, so mssql_ping finds servers that a straight TCP-1433 scan would miss. The nmap equivalent is --script=ms-sql-info.

Set RHOSTS and THREADS, then run — results are stored in the Metasploit database when one is connected.

Brute force: auxiliary/scanner/mssql/mssql_login

Tests username/password combinations against MSSQL instances. Defaults to the classic sa login with a blank password — the exact condition that drives mssql-empty-sa-xp-cmdshell. Supports user/pass files, BLANK_PASSWORDS, and USER_AS_PASS options, making it the standard password-spraying tool for the MSSQL surface.

Enumeration: auxiliary/admin/mssql/mssql_enum

Given valid credentials, enumerates the server configuration: databases, logins, roles, linked servers, stored procedure availability, and whether dangerous options like xp_cmdshell are enabled. This is the triage step that tells you whether the credential you hold is worth anything — and which escalation primitive (cmdshell, linked-server crawl, impersonation) is available. For linked-server crawling at domain scale, see attack-ms-sql-server-powerupsql.

Exploitation: exploit/windows/mssql/mssql_payload

Executes an arbitrary payload on the target via the xp_cmdshell stored procedure (enabling it via sp_configure if needed). Three delivery methods are supported, selected with the METHOD option:

• cmd (default) — uses the Command Stager subsystem, typically wscript.exe with a VBS stager, to build the executable on the target
• ps — PowerShell-based upload and execute (ReL1K’s method)
• old — the original debug.com-based delivery (Defcon 17 SecureState bypass); note this invokes ntvdm and is therefore not available on x64 systems

The module’s check verifies the login is sysadmin (a prerequisite for xp_cmdshell). Note the module leaves the payload executable on the target when finished — plan cleanup accordingly. Its vulnerability references date to 2000-era blank/default sa issues (CVE-2000-1209), which is the same legacy surface documented in mssql-empty-sa-xp-cmdshell.

Catch the resulting shell with exploit/multi/handler — see msfconsole for handler usage and msfvenom for generating standalone payloads for manual delivery.

Related

• ms-sql-server — the hub page for the underlying attack primitives
• attack-ms-sql-server-powerupsql — the PowerShell-native alternative toolkit (SPN discovery, link crawling)
• mssql-empty-sa-xp-cmdshell — the blank-sa attack path mssql_login probes for
• msfconsole — the console these modules run in
• msfvenom — payload generation for manual MSSQL delivery paths
• nmap — NSE alternatives (ms-sql-info, ms-sql-empty-password)

Sources

• MSSQL Ping Utility — Rapid7 Metasploit Module
• MSSQL Login Utility — Rapid7 Metasploit Module
• mssql_payload.rb — Metasploit MSSQL Payload Execution Module
• mssql_ping.md — Metasploit Framework Documentation