hi,

I was wondering whether its possible, with a known user and password of an MSSQL/MySQL server, with all privileges, to gain any access on the machine, maybe run a program or do anything beyond the sql server.

you looked at the sql commands?
Do you know sql at all..
well if u have full access to the sql database u can add a user/pass..
You might even be able to make a php script which use passthru() to execute a command..
in other words there are many possible ways.. and the best way to get a better understanding of things is to of course have a trial by error... and researcj wether you buy a book and learn about it competently or you of course do the smart thing and search for the information on this giant library called the internet

you dont really think im gonna learn whole sql just to figure this small thing? im sure someone thought about it before, maybe its got to do with the sql injection thingie dunno... im sure someone made already some sort of script for sql to allow such thing. thats all im asking here.

i just tried sqlexec... it doesnt seem to work with MySQL... anything which works with MySQL?

Sqlexec for SQL server not for MySQL server , it's not the same

i work as an PL/SQL programmer(ORACLE) and have some ideas
if any proggie will come i'll let you know
got sth on eye currently

greetz

the simplest is ms sql server with sqlexec
mysql lacks exploits
and oracle is generally too complicated for average people
but has few exploits, wrong privilidges etc.

that's my opinion
greetz

so no way to make any use of an admin account in mysql?
I also took a look of the mysql exploits, they seem too complicated and without much success...

I was also hunting for a equivalent as sqlcmd for mxsql, but until know without access.

I did also not not found a syntax / command to launch anything in the OS from the mysql prompt (with root access to the DB).

But both would be of intresst, if someone has an idea. And as mentioned before mysql bugs are not very often, but weak DB username/passwords are always available.

LL