During a penetration test, a tester finds a target that is running MS SQL 2000 with default credentials. The tester assumes that the service is running with Local System account. How can this weakness

The Metasploit psexec module leverages SMB and Windows admin shares for remote execution - it does not exploit the SQL service's stored procedures or the xp_cmdshell attack vector specific to this scenario.

xp_shell is not a valid stored procedure in Microsoft SQL Server - this name does not exist and the command would fail.

cmd_shell is not a valid stored procedure name in Microsoft SQL Server - the correct procedure name is xp_cmdshell.

xp_cmdshell is a built-in extended stored procedure in Microsoft SQL Server that passes a string to the Windows command shell for execution and returns output as rows. When MS SQL Server runs under the Local System account - a highly privileged Windows account - commands executed via xp_cmdshell inherit that privilege level, giving the attacker full control of the underlying OS.