xp_cmdshell & PowerShell

  • Hi,

    i having some trouble with following T-SQL Code

    This doesn't work:

    SELECT @Cmd = '"C:\WINDOWS\system32\windowspowershell\v1.0\powershell" "& ''Some PowerShell File.ps1''

    PRINT @Cmd

    exec master..xp_cmdshell @Cmd

    I get this error:

    'C:\WINDOWS\system32\windowspowershell\v1.0\powershell" "' is not recognized as an internal or external command, operable program or batch file. The system cannot find the path specified.

    This do work:

    SELECT @Cmd = '""C:\WINDOWS\system32\windowspowershell\v1.0\powershell" "& ''Some PowerShell File.ps1''

    PRINT @Cmd

    exec master..xp_cmdshell @Cmd

    The differences are highlighted red.

    Why doesn't work version 1 properly?? In Version 2 is an additional quotation mark !!

    Regards

    Daniel

  • Frankly, I am surprised that either one works. It seems to switch between apostrophes and quotation marks randomly and it is not at all clear what string you are trying to build and execute here. Perhaps you could break each piece down and explain what you are trying to do.

    [font="Times New Roman"]-- RBarryYoung[/font], [font="Times New Roman"] (302)375-0451[/font] blog: MovingSQL.com, Twitter: @RBarryYoung[font="Arial Black"]
    Proactive Performance Solutions, Inc.
    [/font]
    [font="Verdana"] "Performance is our middle name."[/font]

  • The first one has an unmatched open-single-quote. I copied it into Management Studio, and it's pretty clear there.

    - Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
    Property of The Thread

    "Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon

  • Yeah, but so does the second one.

    [font="Times New Roman"]-- RBarryYoung[/font], [font="Times New Roman"] (302)375-0451[/font] blog: MovingSQL.com, Twitter: @RBarryYoung[font="Arial Black"]
    Proactive Performance Solutions, Inc.
    [/font]
    [font="Verdana"] "Performance is our middle name."[/font]

  • I didn't bother looking at the second one, so I missed that. The whole thing looks like a mess to me.

    - Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
    Property of The Thread

    "Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon

  • My thoughts exactly.

    [font="Times New Roman"]-- RBarryYoung[/font], [font="Times New Roman"] (302)375-0451[/font] blog: MovingSQL.com, Twitter: @RBarryYoung[font="Arial Black"]
    Proactive Performance Solutions, Inc.
    [/font]
    [font="Verdana"] "Performance is our middle name."[/font]

  • My Mistake!! The statements are not copy & pasted correctly by me.

    Here a better Version:

    DECLARE @Cmd VARCHAR(4000)

    SET @Cmd = ' "C:\WINDOWS\system32\windowspowershell\v1.0\powershell" "& Get-Process " '

    PRINT @Cmd

    exec master..xp_cmdshell @Cmd

    SET @Cmd = ' ""C:\WINDOWS\system32\windowspowershell\v1.0\powershell" "& Get-Process " '

    PRINT @Cmd

    exec master..xp_cmdshell @Cmd

    First statement has 2 apostrophes and 4 quotation marks and should work properly, but doesn't.

    Second statement has 2 apostrophes 5 quotation marks and should not work properly, but does.

    (The additional quotation mark is at the beginning of the string)

    Why?

    Regards

    Daniel

  • Actually, it does make sense. xp_cmdshell can only take one set of double-quotes, per Books Online, and then it just ignores the ones after that. The first two quotation marks don't enclose anything, but they're the only ones xp_cmdshell is accepting, in the second command. After that, it ignores them.

    So, I'm going to hazard a guess that the powershell entry at the end of the first part of your command is an exe file or some such. Right? In that case, in the first version, the quotation mark is forcing the command shell to assume it's a directory, without the file extension, and it isn't one. The second one, it's ignoring that quotation mark, which allows the command shell to assume it's an executable file and run it with the given options/switches.

    From a DOS perspective, once the quotation marks are removed, it adds up and makes sense.

    - Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
    Property of The Thread

    "Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon

Viewing 8 posts - 1 through 7 (of 7 total)

You must be logged in to reply to this topic. Login to reply