Nmap NSE net: ms-sql-xp-cmdshell

Summary
Attempts to run a command using the command shell of Microsoft SQL Server (ms-sql). The script needs an account with the sysadmin server role to work. It needs to be fed credentials through the script arguments or from the scripts 'ms-sql-brute' or 'ms-sql-empty- password'. When run, the script iterates over the credentials and attempts to run the command until either all credentials are exhausted or until the command is executed. SYNTAX: mssql-xp-cmdshell.cmd: specifies the OS command to run. (default is ipconfig /all) mssql.timeout: How long to wait for SQL responses. This is a number followed by 'ms' for milliseconds, 's' for seconds, 'm' for minutes, or 'h' for hours. Default: '30s'. mssql.password: specifies the password to use to connect to the server. This option overrides any accounts found by the 'ms-sql-brute' and 'ms-sql-empty-password' scripts. mssql.username: specifies the username to use to connect to the server. This option overrides any accounts found by the 'ms-sql-brute' and 'ms-sql-empty-password' scripts.