> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/windows-sql-hacktricks.md).

# Windows SQL HackTricks

This page is a series of tips and tricks for malicious SQL actions on Windows. It focuses on practical techniques that can be used during post-exploitation and command execution.

## xp\_cmdshell (Transact-SQL)

Spawns a Windows command shell and passes in string for execution. Any output is returned as rows of text.

```sql
xp_cmdshell { 'command_string' } [ , NO_OUTPUT ]
```

```
EXECUTE xp_cmdshell 'dir *.exe';
GO
```

### Resources

* <https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-ver15>