OS command execution

In the upcoming sections, we will look at ways to execute OS system commands through SQL Server. To enable command execution, sysadmin privileges are required. Execution itself always happens in the context of a service account. An attacker does not need to know the hash or password of the SQL Server service or agent account. Let’s start by looking at built-in extended stored procedures.

xp_cmdshell

xp_cmdshell is probably the most well-known built-in extended stored procedure, which is disabled by default. Enabling it requires sysadmin privileges. There are a few functions in PowerUpSQL (Invoke-SQLOSCmdExec and Invoke-SQLOSCmd), SQLRecon (EnableXp and XpCmd), as well as the Metasploit admin/mssql/mssql_exec module that can automate this task. The manual query to install xp_cmdshell and enable it is shown here:

sp_addextendedproc 'xp_cmdshell','xplog70.dll
EXEC sp_configure 'show advanced options',1
RECONFIGURE
EXEC sp_configure...