During a penetration test, a tester finds a target that is running MS SQL 2000 with default credentials. The tester assumes that the service is running with Local System account. How can this…

The Metasploit psexec module is used for remote lateral movement using valid credentials, not for exploiting SQL Server stored procedures to execute OS commands directly from the database.

xp_shell is not a valid or built-in SQL Server stored procedure; it does not exist in MS SQL and would produce an error if invoked.

cmd_shell is not a valid SQL Server stored procedure; the correct name is xp_cmdshell, and cmd_shell would not execute successfully.

xp_cmdshell is a legitimate extended stored procedure in MS SQL Server that spawns a Windows command shell and returns output as rows. Because the SQL Server service runs as Local System in this scenario, any OS command executed via xp_cmdshell inherits SYSTEM-level privileges, giving the attacker full control of the host.