How n3rada/mssqland works
MSSQLand is a command-line SQL Server post-exploitation tool. An operator supplies a target, authentication options, and an action; the program parses and dispatches the action, establishes a database context, and runs SQL directly or across linked servers. Results are formatted for terminal or CSV output. Separate branches cover unauthenticated server discovery, Active Directory queries, and ConfigMgr reconnaissance and operations. The excerpts confirm the main dispatch, context, query, and selected action paths; several feature links below reflect README documentation and the file tree, not inspected implementations.
Main entry points: QueryService.cs Query and routing · Program.cs CLI entry point · FindSqlServers.cs Discovery commands · DatabaseContext.cs Database context
Components 25
Command workflow
- CLI entry point
MSSQLand/Program.cs - Argument parser
MSSQLand/Utilities/CommandParser.cs - Action factory
MSSQLand/Actions/ActionFactory.cs - Output formatting
MSSQLand/Utilities/Formatters/OutputFormatter.cs - CSV formatter
MSSQLand/Utilities/Formatters/CsvFormatter.cs
Connection and routing
- Authentication
MSSQLand/Services/Authentication/AuthenticationService.cs - Database context
MSSQLand/Services/DatabaseContext.cs - Query and routing
MSSQLand/Services/QueryService.cs - Server model
MSSQLand/Models/Server.cs
SQL actions
- Query actions
MSSQLand/Actions/Execution/Query.cs - Database actions
MSSQLand/Actions/Database/Databases.cs - Execution actions
MSSQLand/Actions/Execution/Run.cs - Administration actions
MSSQLand/Actions/Administration/Requests.cs - SQL Agent actions
MSSQLand/Actions/Agent/Jobs.cs - Linked server actions
MSSQLand/Actions/Remote/Links.cs - File actions
MSSQLand/Actions/FileSystem/FileRead.cs
Discovery
- Discovery commands
MSSQLand/Utilities/Discovery/FindSqlServers.cs
Domain and ConfigMgr
- AD and ADSI actions
MSSQLand/Actions/Domain/AdsiQuery.cs - Directory services
MSSQLand/Services/ActiveDirectoryService.cs - ConfigMgr actions
MSSQLand/Actions/ConfigMgr/CMTaskSequences.cs - ConfigMgr service
MSSQLand/Services/CMService.cs
Other components
- Operator
- SQL Server
- SQL Browser
- Active Directory
Connections 30
- Operator → CLI entry point: provides options
- CLI entry point → Argument parser: parses arguments
- CLI entry point → Authentication: authenticates
- CLI entry point → Action factory: dispatches action
- CLI entry point → Database context: creates context
- Argument parser → Server model: builds target
- Action factory → Query actions: creates action
- Database context → Query and routing: constructs service
- Database context → Authentication: uses connection
- Authentication → SQL Server: connects
- Query and routing → SQL Server: executes routed SQL
- Query actions → Query and routing: executes queries
- Database actions → Query and routing: queries metadata
- Execution actions → Query and routing: executes commands
- Administration actions → Query and routing: queries server
- SQL Agent actions → Query and routing: queries jobs
- Linked server actions → Query and routing: routes remote access
- File actions → Query and routing: uses SQL file actions
- Query actions → Output formatting: formats results
- Output formatting → Operator: prints results
- CLI entry point → CSV formatter: selects export
- Discovery commands → SQL Browser: queries instances
- Discovery commands → Directory services: enumerates SPNs
- Discovery commands → Operator: reports servers
- AD and ADSI actions → Query and routing: queries ADSI link
- AD and ADSI actions → Directory services: uses directory access
- Directory services → Active Directory: queries directory
- ConfigMgr actions → ConfigMgr service: uses ConfigMgr queries
- ConfigMgr service → Query and routing: queries ConfigMgr data
- ConfigMgr actions → Output formatting: formats results