mssqlbof: A Beacon Object File suite for Microsoft SQL Server
mssqlbof
A Beacon Object File suite for Microsoft SQL Server that speaks TDS 7.4 on the wire itself, in C. No msodbcsql.dll, no sqloledb.dll, no .NET CLR, no PowerShell. One COFF per arch, loads into every beacon that honors the canonical Beacon API.
Why
SQL Server shows up on nearly every engagement. The two tools people reach for are SQLRecon / PowerUpSQL (CLR + PowerShell) and whatever wraps sqlcmd.exe. Both leave mscoree.dll, PowerShell AMSI events, or a full copy of the Microsoft ODBC driver sitting in beacon memory. None of that is necessary: TDS is just framed bytes over TCP with a Schannel handshake in front, and every BOF-capable beacon already has ws2_32, secur32, schannel, and bcrypt loaded.
So mssqlbof implements TDS by hand, in C, and plugs directly into whatever SSPI or BCrypt primitives the operator needs for the target. Beacon loads one ~48 KB object, runs SQL, unloads. Nothing else enters the process.
Compatibility
| C2 | x64 | x86 |
|---|---|---|
| Cobalt Strike | yes | yes |
| Havoc | yes | yes |
| Sliver | yes | yes |
| BruteRatel | yes | yes |
| Nighthawk | yes | yes |
| Outflank Stage1 | yes | yes |
| AdaptixC2 | yes | yes |
Metasploit execute_bof |
yes | yes |
| PoshC2 | yes | yes |
One object file per architecture. mssql.x64.o is the same binary on every framework — we only use the canonical Beacon API (BeaconPrintf, BeaconDataExtract, etc.) and the <LIB>$<fn> dynamic import pattern COFF loaders resolve at runtime.
OPSEC
| Action | Extra DLLs beyond beacon baseline | Server-side trace | Notes |
|---|---|---|---|
find |
wldap32 |
DC event 1644 (rare) | LDAP only, no SQL touched |
info / query / links
/ |
secur32 or bcrypt,
|
SQL audit 33205 if enabled | Pure TDS, no ODBC fingerprint |
exec |
same | xp_cmdshell + sp_configure in default trace |
Loud. Use --impersonate from a low-priv login to avoid landing as NT SERVICE |
impersonate |
same | EXECUTE AS audit 33205 + 33206 |
|
coerce |
same | xp_dirtree attempt logged |
Point it at responder / ntlmrelayx |
chain |
same | EXEC AT logged on the linked server target |
Pivot primitive |
Everything TLS is real Schannel (not a stub) with the SQL Server PRELOGIN-wrap quirk handled: the handshake runs inside TDS PRELOGIN type 0x12 packets, then LOGIN7 goes out as raw TLS application data, and the server answers that first login packet in plaintext. Multi-leg SSPI continuations also go plaintext — if you encrypt them with TLS, SRV02 just closes the socket.
Download
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
