Jump to content

samadielka

Members
  • Posts

    263
  • Credits

  • Joined

  • Last visited

  • Feedback

    0%

Posts posted by samadielka

  1. GrisoM can you tell me what program i need and version (sql)  for interlude server to crash? i am reading something about remote execution with sql injection and there is riting

    4.0 How do I get remote execution with SQL injection?

     

    Being able to inject SQL command usually mean, we can execute any SQL query at will. Default installation of MS SQL Server is running as SYSTEM, which is equivalent to Administrator access in Windows. We can use stored procedures like master..xp_cmdshell to perform remote execution:

     

    '; exec master..xp_cmdshell 'ping 10.10.1.2'--

     

    Try using double quote (") if single quote (') is not working.

     

    The semi colon will end the current SQL query and thus allow you to start a new SQL command. To verify that the command executed successfully, you can listen to ICMP packet from 10.10.1.2, check if there is any packet from the server:

     

    #tcpdump icmp

     

    and other stuff. can i test on any web this kind of stuff?

×
×
  • Create New...