312-50V9 · Question #46
During a penetration test, a tester finds a target that is running MS SQL 2000 with default credentials. The tester assumes that the service is running with Local System account. How can this…
The correct answer is D. Invoking the stored procedure xp_cmdshell to spawn a Windows command shell. MS SQL Server's built-in extended stored procedure xp_cmdshell allows execution of Windows OS commands, and when the SQL service runs as Local System with default SA credentials, this grants full system-level code execution.
Question
During a penetration test, a tester finds a target that is running MS SQL 2000 with default credentials. The tester assumes that the service is running with Local System account. How can this weakness be exploited to access the system?
Options
- AUsing the Metasploit psexec module setting the SA / Admin credential
- BInvoking the stored procedure xp_shell to spawn a Windows command shell
- CInvoking the stored procedure cmd_shell to spawn a Windows command shell
- DInvoking the stored procedure xp_cmdshell to spawn a Windows command shell
How the community answered
(20 responses)- A10% (2)
- B5% (1)
- D85% (17)
Why each option
MS SQL Server's built-in extended stored procedure xp_cmdshell allows execution of Windows OS commands, and when the SQL service runs as Local System with default SA credentials, this grants full system-level code execution.
The Metasploit psexec module exploits Windows SMB/admin shares for remote command execution and does not leverage SQL Server stored procedures or default database credentials.
xp_shell is not a valid stored procedure in MS SQL Server; the correct name is xp_cmdshell, so this choice would fail with an error about an unknown object.
cmd_shell is not a valid stored procedure in MS SQL Server; this name does not exist in the SQL Server extended stored procedure library.
xp_cmdshell is the correct name of the extended stored procedure in MS SQL Server that passes a command string to the Windows command shell and returns any output as rows. Because the SQL Server service is running under the Local System account, commands executed via xp_cmdshell inherit SYSTEM-level privileges, giving the attacker complete control over the host. An attacker authenticated as SA can enable and invoke xp_cmdshell directly using EXEC xp_cmdshell 'command'.
Concept tested: MS SQL Server xp_cmdshell OS command execution
Source: https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql
Topics
Community Discussion
No community discussion yet for this question.