The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous templates for executing operating system commands through MSSQL features, such as xp_cmdshell, OLE Automation Procedures (sp_OACreate), and external script execution using Python or R. It also includes instructions for establishing persistence by configuring stored procedures to execute automatically at database startup.
[DATA_EXFILTRATION]: It documents techniques to force the SQL server to authenticate to an external attacker-controlled machine using UNC paths (via xp_dirtree, xp_subdirs, or xp_fileexist), which is used to capture NetNTLM hashes. It also provides SQL commands to read arbitrary local files using the OPENROWSET function.
[REMOTE_CODE_EXECUTION]: The instructions include patterns for the agent to download and execute remote PowerShell payloads and DLLs from external servers onto the target system.
[CREDENTIALS_UNSAFE]: It contains queries to extract SQL login password hashes from system tables (such as master.sys.sql_logins) for the purpose of offline cracking.
[EXTERNAL_DOWNLOADS]: The methodology relies on downloading and using various third-party security tools and scripts from non-vendor sources, including Impacket, NetExec, PowerUpSQL, and SQLServerLinkedServersPasswords.

mssql-pentesting