# Cracks in the Foundation: FOUNDATION Accounting Intrusions

FOUNDATION Accounting exposes MSSQL port 4243 with unchanged default sa/dba credentials, letting attackers brute force in and enable xp_cmdshell for OS command execution.

- Payout: Real-world hack
- Severity: critical
- Program: FOUNDATION Accounting
- Analysis by: Huntress
- Disclosed: 2024-09-17
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/cracks-in-the-foundation-intrusions-of-foundation-accounting-software
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cracks-in-the-foundation-intrusions-of-foundation-accounting-software
- Tags: area:cloud domain:infra impact:internal-access impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:default-creds vuln:misconfiguration vuln:rce

**Target:** Publicly exposed MSSQL instance (port 4243) of FOUNDATION Accounting server
**Root cause:** FOUNDATION's MSSQL instance is exposed on TCP 4243 for its mobile app, and high-privilege accounts (sa and a vendor-created dba) retain unchanged default credentials.
**Steps:**
1. Reach exposed MSSQL on TCP 4243 of FOUNDATION server
2. Brute force / try default credentials against sa and dba accounts (~35,000 attempts observed)
3. Authenticate with default creds
4. `EXEC sp_configure 'show advanced options', 1; RECONFIGURE;`
5. `EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;`
6. `EXEC xp_cmdshell 'ipconfig';` to run OS commands
**How found:** Huntress SOC flagged host/domain enumeration commands spawning as child processes of sqlservr.exe; correlating across hosts showed identical scripted commands hitting unrelated companies within minutes, and ERRORLOG showed ~35,000 brute force attempts ending an hour before successful auth and xp_cmdshell enablement.
**Exploitation:** Attackers brute forced MSSQL at scale across plumbing/HVAC/concrete firms, logged in with default sa/dba credentials, enabled xp_cmdshell, and ran host/domain enumeration commands (cmd.exe spawned from sqlservr.exe) across multiple unrelated companies within minutes.
**Escalation:** Default DB admin access escalated to OS command execution via xp_cmdshell, enabling host and domain enumeration.
**Insight:** Vendor mobile-app integration can force a database port (4243) public; check for vendor-created non-builtin admin accounts (e.g. dba) alongside sa, since both may ship with unchanged defaults and grant xp_cmdshell RCE.

## Proof of concept (copied exactly from the original report)

**SQL commands enabling xp_cmdshell and running OS command**

```
-- Enable advanced options
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
-- Enable xp_cmdshell
EXEC sp_configure 'xp_cmdshell', 1;
RECONFIGURE;
-- Run a shell command as an example
EXEC xp_cmdshell 'ipconfig';
```