Running commands through xp_cmdshell in MS SQL servers
MS SQL servers have a stored procedure named xp_cmdshell that allows programmers to execute commands on the local system. This feature is enabled in a lot of environments and is extremely dangerous if attackers gain access to a set of credentials, especially if it is the MS SQL super administrator account that has system privileges.
This recipe shows how to run Windows commands through MS SQL servers with Nmap.
How to do it...
Open your terminal and enter the following Nmap command to check whether xp_cmdshell is enabled:
$ nmap --script-args 'mssql.username="<user>",mssql.password="<password>"' --script ms-sql- xp-cmdshell -p1433 <target>
An error message is returned if something goes wrong. Otherwise, you should see the output of the command you set if the command executed succesfully:
PORT STATE SERVICE VERSION 1433/tcp open ms...
