Hack Database Servers with SQLCMD and OSQL

The osql utility allows you to enter Transact-SQL statements, system procedures, and script files. This utility uses ODBC to communicate with the server.

Select AllCode:

osql -U YourUserName -P YourPassword -S ServerName -d DatabaseName
-n-1 -i DriveLetter:SQLFileNameAndPath.sql -o DriveLetter:LogFile.txt
 
Switches
-U: login ID for the specified server
-P: password for the login ID
-S: server name
-d: database upon which the script will be executed
-n: removes numbering and the prompt symbol (>) from the output file
-i: the .SQL file name (including drive letter)
-o: an output file that details how the script executed (if at all)

Finding SQL Servers:

Select AllCode:

C:\tools\osql -L

Connect to MSSQL Server using IP address:

Select AllCode:

C:\tools\osql -E -S <IP> -Q "<SQL QUERY>"

Connect to MSSQL Server using instance name:

Select AllCode:

C:\tools\osql -E -S SERVERNAME\INSTANCE -Q "<SQL QUERY>"

Connect to MSSQL Server which listen on non default port (10000):

Select AllCode:

C:\tools\osql -E -S tcp:SERVERNAME,10000 -Q "<SQL QUERY>"

Connect to MSSQL Server using SA authentication:

Select AllCode:

C:\tools\osql -U <username> -P <password> -S SERVERNAME\INSTANCE -Q "<SQL QUERY>"

Executing System Commands:

Select AllCode:

C:\tools\osql -E -S <IP> -Q “xp_cmdshell ‘whoami’”

Dump results to output file:

Select AllCode:

C:\tools\osql -E -S <IP> -Q "<SQL QUERY>" -o .\outfile.txt

The sqlcmd utility lets you enter Transact-SQL statements, system procedures, and script files at the command prompt, in Query Editor in SQLCMD mode, in a Windows script file or in an operating system (Cmd.exe) job step of a SQL Server Agent job. This utility uses OLE DB to execute Transact-SQL batches.

Select AllCode:

Sqlcmd                 [-U login id]          [-P password]
[-S server]            [-H hostname]          [-E trusted connection]
[-d use database name] [-l login timeout]     [-t query timeout]
[-h headers]           [-s colseparator]      [-w screen width]
[-a packetsize]        [-e echo input]        [-I Enable Quoted Identifiers]
[-c cmdend]            [-L[c] list servers[clean output]]
[-q "cmdline query"]   [-Q "cmdline query" and exit]
[-m errorlevel]        [-V severitylevel]     [-W remove trailing spaces]
[-u unicode output]    [-r[0|1] msgs to stderr]
[-i inputfile]         [-o outputfile]        [-z new password]
[-f  | i:[,o:]] [-Z new password and exit]
[-k[1|2] remove[replace] control characters]
[-y variable length type display width]
[-Y fixed length type display width]
[-p[1] print statistics[colon format]]
[-R use client regional setting]
[-b On error batch abort]
[-v var = "value"...]  [-A dedicated admin connection]
[-X[1] disable commands, startup script, enviroment variables [and exit]]
[-x disable variable substitution]
[-? show syntax summary]

Select AllCode:

List all local servers:

Select AllCode:

C:\tools\sqlcmd -L

Connect to MSSQL Server which listen on non default port (10000):

Select AllCode:

C:\tools\sqlcmd -S SERVERNAME,10000

Writing results to outfile file:

Select AllCode:

C:\tools\sqlcmd -S SERVERNAME -o C:\outfile.txt -e

Connect to MSSQL Server using username and password:

Select AllCode:

C:\tools\sqlcmd -S SERVERNAME -U <USERNAME> -P <PASSWORD>

Executing scripts:

Select AllCode:

C:\tools\sqlcmd -i dump.sql

Execute SQL queries and save results to outfile:

Select AllCode:

C:\tools\sqlcmd -S SERVERNAME\INSTANCE -Q "<SQL QUERY>" -o C:\outfile.txt

Command line utilities per MSSQL version:

• SQL Server 2000 – OSQL.exe
• SQL Server 2005 – OSQL.exe, SQLCMD.exe
• SQL Server 2008 – OSQL.exe, SQLCMD.exe

References:
OSQL: http://msdn.microsoft.com/en-us/library/aa214012(v=sql.80).aspx
SQLcmd: http://msdn.microsoft.com/en-us/library/ms162773.aspx

©2012, copyright BLACK BURN