# Linked Server Exploitation

**Identifying MSSQL Listeners**

<figure><img src="https://3312882845-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FD5rqliIRJ8NoRpcxtWHk%2Fuploads%2FQbUIYU2yGQwc7JmFpF5J%2Fimage.png?alt=media&#x26;token=9150213d-f8f7-448d-b1ef-f03b215bb296" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}
```powershell
 New-NetFirewallRule -DisplayName "Allow SQL Server" -Direction Inbound -Protocol TCP -LocalPort 1433 -Action Allow
```
{% endcode %}

NMap can be used to identify the server on a network;

<figure><img src="https://3312882845-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FD5rqliIRJ8NoRpcxtWHk%2Fuploads%2FogegKAoS23AA20FcwoXI%2Fimage.png?alt=media&#x26;token=f29ff7f2-52f6-4c17-ad3e-ae25b920e175" alt=""><figcaption></figcaption></figure>

**case** 1 : **Brute Force Attacks**

SQL Server supports two types of authentication, Windows Authentication, and SQL Server authentication. This can be configured using SQL Server Management Studio;

<figure><img src="https://3312882845-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FD5rqliIRJ8NoRpcxtWHk%2Fuploads%2FumxISj1wqDWgmrRi8oO5%2Fimage.png?alt=media&#x26;token=660c1c46-35fe-4154-882d-71c9fc68cb84" alt=""><figcaption></figcaption></figure>

using&#x20;

```
crackmapexec mssql 192.168.16  -u sa -p  /usr/share/wordlists/rockyou.txt 
```

>
>
> **MSSQL** supports a feature called Linked Servers. Essentially the MSSQL database is configured to connect to remote databases running on other systems. This allows you to execute a query against one host, but the data to be retrieved from multiple systems.
>
> If linked servers are configured, and attacker may be able to exploit this feature to move laterally between different database systems.
>
> To configure a linked server, in SQL Management Studio, select <mark style="color:red;">**SERVER1**</mark> > **Linked** <mark style="color:red;">**Servers**</mark> > Right click and select new Linked Server.
>
> On the general tab, set the data source to the target SQL server hostname.

<figure><img src="https://3312882845-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FD5rqliIRJ8NoRpcxtWHk%2Fuploads%2Fi3u1MLPiXF1YScSinoGC%2Fimage.png?alt=media&#x26;token=134b9787-0a83-4ad6-894e-82eebda1c5ad" alt=""><figcaption></figcaption></figure>

In the security tab, set the user account used to login to the remote server.
