xp_cmdshell Is Disabled. You Can Still Get RCE. Here Is How.

#The Most Dangerous Stored Procedure in SQL Server#link

xp_cmdshell. Two words that make DBAs lose sleep. It executes operating system commands from within SQL Server. The spawned process runs with the same rights as the SQL Server service account. If that account is LocalSystem, you have SYSTEM-level RCE. Microsoft disables it by default. But "disabled by default" and "disabled in production" are two very different things.

It worked. xp_cmdshell was already enabled on this instance. The service runs as mssql$sqlexpress, a virtual service account. Not SYSTEM, but still significant. If it had been disabled, you would need sysadmin privileges to enable it via sp_configure. Two queries. Then you are executing commands.

MySQL: Writing a Web Shell via INTO OUTFILE

MySQL does not have xp_cmdshell. But it has SELECT INTO OUTFILE. If the MySQL process can write to a web-accessible directory, you can drop a PHP web shell directly onto the filesystem. Check the secure_file_priv variable first. If it is empty, you can write anywhere the mysql user has permissions.

Empty secure_file_priv. No restrictions. The webshell is written. Browse to http://target/webshell.php?c=whoami and you have command execution as the web server user. From there, standard post-exploitation applies.

Lateral Movement via Linked Servers

A linked server at 10.0.0.12. And the connection runs as sa_remote with sysadmin privileges (is_srvrolemember returns 1). You just pivoted from one SQL Server to another with full admin rights. From here, enable xp_cmdshell on the remote server. Execute commands. Read files. The linked server configuration is a lateral movement path that most organizations never audit.

SQL Server is not just a data store. It is an execution environment with network access, filesystem access, and the ability to impersonate users and pivot to other servers. Every SQL connection you obtain should be treated as a potential RCE vector. Check xp_cmdshell. Check file write capabilities. Check linked servers. Check impersonation rights. The database is the door. What is behind it is the engagement.