# PySQLRecon | Offensive MSSQL Toolkit Written In Python, Based Off SQLRecon **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming, hacking, freebies, data-recovery\ **Created:** [December 26, 2023, 9:33pm UTC](https://onehack.st/t/pysqlrecon-offensive-mssql-toolkit-written-in-python-based-off-sqlrecon/269904 "2023-12-26T21:33:55Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\ **Post date:** [December 26, 2023, 9:33pm UTC](https://onehack.st/t/pysqlrecon-offensive-mssql-toolkit-written-in-python-based-off-sqlrecon/269904/1 "2023-12-26T21:33:56Z")
# [![](https://github.com/Tw1sm/PySQLRecon/raw/main/resources/images/snake_logo.png)](https://github.com/Tw1sm/PySQLRecon/blob/main/resources/images/snake_logo.png) PySQLRecon [![Python](https://camo.githubusercontent.com/a1b2dac5667822ee0d98ae6d799da61987fd1658dfeb4d2ca6e3c99b1535ebd8/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f707974686f6e2d3336373041303f7374796c653d666f722d7468652d6261646765266c6f676f3d707974686f6e266c6f676f436f6c6f723d666664643534)](https://camo.githubusercontent.com/a1b2dac5667822ee0d98ae6d799da61987fd1658dfeb4d2ca6e3c99b1535ebd8/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f707974686f6e2d3336373041303f7374796c653d666f722d7468652d6261646765266c6f676f3d707974686f6e266c6f676f436f6c6f723d666664643534) [![PyPi](https://camo.githubusercontent.com/ccf5e027a3482f8942856064f95d90bde6da97b932bf54c6262c7dbb820536f5/68747470733a2f2f696d672e736869656c64732e696f2f707970692f762f707973716c7265636f6e3f7374796c653d666f722d7468652d6261646765)](https://camo.githubusercontent.com/ccf5e027a3482f8942856064f95d90bde6da97b932bf54c6262c7dbb820536f5/68747470733a2f2f696d672e736869656c64732e696f2f707970692f762f707973716c7265636f6e3f7374796c653d666f722d7468652d6261646765) PySQLRecon is a Python port of the awesome [SQLRecon](https://github.com/skahwah/SQLRecon) project by [@sanjivkawa](https://twitter.com/sanjivkawa). See the [commands](https://github.com/Tw1sm/PySQLRecon#commands) section for a list of capabilities. ## Install PySQLRecon can be installed with `pip3 install pysqlrecon` or by cloning this repository and running `pip3 install .` ## Commands All of the main modules from SQLRecon have equivalent commands. Commands noted with `[PRIV]` require elevated privileges or sysadmin rights to run. Alternatively, commands marked with `[NORM]` can likely be run by normal users and do not require elevated privileges. Support for impersonation (`[I]`) or execution on linked servers (`[L]`) are denoted at the end of the command description. ```auto adsi [PRIV] Obtain ADSI creds from ADSI linked server [I,L] agentcmd [PRIV] Execute a system command using agent jobs [I,L] agentstatus [PRIV] Enumerate SQL agent status and jobs [I,L] checkrpc [NORM] Enumerate RPC status of linked servers [I,L] clr [PRIV] Load and execute .NET assembly in a stored procedure [I,L] columns [NORM] Enumerate columns within a table [I,L] databases [NORM] Enumerate databases on a server [I,L] disableclr [PRIV] Disable CLR integration [I,L] disableole [PRIV] Disable OLE automation procedures [I,L] disablerpc [PRIV] Disable RPC and RPC Out on linked server [I] disablexp [PRIV] Disable xp_cmdshell [I,L] enableclr [PRIV] Enable CLR integration [I,L] enableole [PRIV] Enable OLE automation procedures [I,L] enablerpc [PRIV] Enable RPC and RPC Out on linked server [I] enablexp [PRIV] Enable xp_cmdshell [I,L] impersonate [NORM] Enumerate users that can be impersonated info [NORM] Gather information about the SQL server links [NORM] Enumerate linked servers [I,L] olecmd [PRIV] Execute a system command using OLE automation procedures [I,L] query [NORM] Execute a custom SQL query [I,L] rows [NORM] Get the count of rows in a table [I,L] search [NORM] Search a table for a column name [I,L] smb [NORM] Coerce NetNTLM auth via xp_dirtree [I,L] tables [NORM] Enumerate tables within a database [I,L] users [NORM] Enumerate users with database access [I,L] whoami [NORM] Gather logged in user, mapped user and roles [I,L] xpcmd [PRIV] Execute a system command using xp_cmdshell [I,L] ``` ## Usage PySQLRecon has global options (available to any command), with some commands introducing additional flags. All global options must be specified _before_ the command name: ```auto pysqlrecon [GLOBAL_OPTS] COMMAND [COMMAND_OPTS] ``` View global options: ```auto pysqlrecon --help ``` View command specific options: ```auto pysqlrecon [GLOBAL_OPTS] COMMAND --help ``` Change the database authenticated to, or used in certain PySQLRecon commands (`query`, `tables`, `columns` `rows`), with the `--database` flag. Target execution of a PySQLRecon command on a linked server (instead of the SQL server being authenticated to) using the `--link` flag. Impersonate a user account while running a PySQLRecon command with the `--impersonate` flag. `--link` and `--impersonate` and incompatible. ## Development pysqlrecon uses Poetry to manage dependencies. Install from source and setup for development with: ```auto git clone https://github.com/tw1sm/pysqlrecon cd pysqlrecon poetry install poetry run pysqlrecon --help ``` ### Adding a Command PySQLRecon is easily extensible - see the template and instructions in [resources](https://github.com/Tw1sm/PySQLRecon/blob/main/resources/command_template) ### TODO - Add SQLRecon SCCM commands - Add Azure SQL DB support? ## References and Credits - [Impacket](https://github.com/fortra/impacket) - [@sanjivkawa](https://twitter.com/sanjivkawa) for the [SQLRecon](https://github.com/skahwah/SQLRecon) project - [https://securityintelligence.com/x-force/databases-beware-abusing-microsoft-sql-server-with-sqlrecon/](https://securityintelligence.com/x-force/databases-beware-abusing-microsoft-sql-server-with-sqlrecon/) - [https://gist.github.com/skahwah/a585e176e4a5cf319b0c759637f5c410](https://gist.github.com/skahwah/a585e176e4a5cf319b0c759637f5c410) - Also checkout [MSSqlPwner](https://github.com/ScorpionesLabs/MSSqlPwner) for other offensive MSSQL capabilities written in Python ## GitHub: [https://github.com/Tw1sm/PySQLRecon](https://github.com/Tw1sm/PySQLRecon)