impacket icon indicating copy to clipboard operation
impacket copied to clipboard

Published 20 hours ago • verified publisher icon fortra

Hex Encoded xp_cmdshell (aka HexP_cmdshell)

Open Z3rO-C00L opened this issue 2 years ago • 2 comments

Hex encoded version of xp_cmdshell to bypass AV/SQL query blacklisting and hide code execution in logs.

Extra Credit: @danielprintke - assisted with getting a working version of this code.

Z3rO-C00L avatar May 06 '22 20:05 Z3rO-C00L

Nice! What versions of MSSQL does this work on?

mubix avatar Aug 16 '22 02:08 mubix

Nice! What versions of MSSQL does this work on?

Good question - I haven't encountered a version where the hex encoding didn't work. I would be interested to know if there is a version of MSSQL that does not allow you to assign hex encoded commands to a variable. If that is the case, I can modify the code to include both new and old command execution methods - as needed.

Z3rO-C00L avatar Aug 17 '22 15:08 Z3rO-C00L