> For the complete documentation index, see [llms.txt](https://rfc1918.gitbook.io/offsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rfc1918.gitbook.io/offsec/services/ms-sql-server/enumeration.md).

# Enumeration

## Overview

MS SQL Server integrates right out the box with Windows and Active Directory Domains. Consequently, there are trust relationships which we can leverage from an attacker perspective.

## Enumeration

### Identifying MS SQL Server within an AD domain

#### Using PowerUpSQL

> PowerUpSQL includes functions that support SQL Server discovery, weak configuration auditing, privilege escalation on scale, and post exploitation actions such as OS command execution.

{% code overflow="wrap" %}

```powershell
import-module .\PowerUPSQL.psd1

# Discovering local SQL server instance
Get-SQLInstanceLocal -Verbose

# Discovery Active Directory Domain SQL Server instances
Get-SQLInstanceDomain -Verbose
```

{% endcode %}

### Testing connectivity

#### Using PowerUpSQL

{% code overflow="wrap" %}

```powershell
# Get a list of domain SQL servers that can be logged into with a provided SQL Server login
$Targets = Get-SQLInstanceDomain -Verbose | Get-SQLConnectionTestThreaded -Verbose -Threads 10 -username testuser -password testpass | Where-Object {$_.Status -like "Accessible"}
$Targets
```

{% endcode %}

### Enumeration SQL server links

> SQL Server links are a feature in Microsoft SQL Server that allow you to connect to and access data from another SQL Server instance or another database system.

{% code overflow="wrap" %}

```powershell
# Get database links
Get-SQLServerLink -Verbose -Instance SQLSERVER1\Instance1

# Crawl database links	
Get-SqlServerLinkCrawl -Verbose -Instance SQLSERVER1\Instance1

# Crawl database links and execute query	
Get-SqlServerLinkCrawl -Verbose -Instance SQLSERVER1\Instance1 -Query "select name from master..sysdatabases"
```

{% endcode %}

## References

{% embed url="<https://github.com/NetSPI/PowerUpSQL>" %}

{% embed url="<https://github.com/NetSPI/PowerUpSQL/wiki/PowerUpSQL-Cheat-Sheet>" %}