Authentication

Testing credentials

You can use two methods to authenticate to MSSQL: windows or local (default: windows). To use local auth, add the following flag --local-auth

Windows auth

  1. With SMB port open
nxc mssql <target> -u <username> -p '<password>'
  1. With SMB port close, add the flag -d DOMAIN
nxc mssql <target> -u <username> -p '<password>' -d <domain>

Expected Results:

MSSQL       <target>     1433   MANTIS           [+] <domain>\<username>:<password>

Local auth

nxc mssql <target> -u <username> -p '<password>' --local-auth

Expected Results:

MSSQL       <target>     1433   None             [+] <username>:<password> (Pwn3d!)

Specify Ports

nxc mssql <target> -u <username> -p '<password>' --port 1434