How to evade a signature to detect “xp_cmdshell” for SQLi?

Question

What methods can be used to bypass a signature which detects "xp_cmdshell"?

Answer 1

If you're trying to get around a trivial filter that simply checks if the query contains the string "xp_cmdshell"...
and you're dealing with MSSQL...
and you know that xp_cmdshell is active...
and you know that the user has permissions to access xp_cmdshell...
and you need to specifically run xp_cmdshell, e.g. to prove an exploit, or validate the severity of the finding...

you have several options:

1. you can obfuscate the "xp_cmdshell" string, in several ways:
   DECLARE @s varchar
SET @s = 'xp_' + 'cmdshell'
EXEC (@s)
   Or, you can generate if from charcodes... etc.
2. If what you really want to do is get unrestricted access to the OS, there are other ways besides xp_cmdshell - there are the sp_OA*** set of procs (to instantiate COM objects), assembly access procs, etc.