# Deep Dive: Squashing an MSSQL Attack

Attackers brute-forced MSSQL sa credentials, enabled xp_cmdshell, disabled AV via IFEO Debugger hijack, and downloaded malware via FTP answer files for persistence.

- Payout: Real-world hack
- Severity: critical
- Program: MSSQL
- Credited: Huntress
- Disclosed: 2017-07-17
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/deep-dive-squashing-an-mssql-attack-a0e1f40f085c
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-squashing-an-mssql-attack-a0e1f40f085c
- Tags: domain:infra impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:default-creds vuln:misconfiguration vuln:rce

**Target:** MSSQL database on Windows server (port 1433)
**Root cause:** Weak MSSQL sa credentials allowed brute-force authentication; xp_cmdshell was re-enabled by the authenticated admin, granting OS command execution.
**Steps:**
1. Brute force MSSQL sa account over ODBC port 1433 with common passwords (37,000+ attempts, 21 usernames)
2. Authenticate as sa, then run `EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE`
3. Modify/delete registry keys to bypass GPO command prompt restrictions
4. Kill AV via `taskkill.exe` and IFEO Debugger value set to `taskkill.exe /F /IM <av>.exe`
5. Stop SharedAccess service to disable Windows Firewall
6. Create FTP answer file via `echo` and run `ftp -s:script.txt` to download crimeware/RAT/miner
7. Establish persistence via Run key `Aut2` and malicious service `Wsqhwr zajttrgb` launching UPX-packed binary
**How found:** Forensic review of Windows Event Logs revealed thousands of failed MSSQL logins, identifying the initial access vector; backups enabled timeline reconstruction.
**Exploitation:** After brute-forcing sa credentials, attacker enabled xp_cmdshell to run OS commands, disabled AV via taskkill and IFEO Debugger hijack, disabled firewall, downloaded malware via FTP answer files, and installed Run keys and services for persistence, including a UPX-packed binary beaconing to fyunf.f3322[.]net.
**Escalation:** Database access escalated to native OS command execution via xp_cmdshell, then to full host compromise with AV disabled and persistent malware.
**Insight:** IFEO Debugger value can be abused to silently neuter AV by redirecting its process launch to taskkill.exe — check HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Image File Execution Options for Debugger values pointing at taskkill or cmd.