Hi Juan,

There are some constraints I'm working with that make CmdStagerVBS a not so attractive choice.

Basically, xp_cmdshell execution has to be vectored through a SQLi of the following form where what you want to execute is base 64 encoded and stored as the variable "sqli" 

declare @querya VARCHAR(255);select @querya = 0x#{sqli};exec(@querya);--

The linemax for "sqli" would be 393

I played with a version of this module that used CmdStagerVBS but it took a little over 30 minutes to complete payload delivery, and no less than 345 notification messages were issued. So it would be pretty chatty and I've observed previously that the application may act a little erratically, or go silent for a period if too many notification messages are received in quick succession (although a delay of 1.5 appears to help here). I did get a shell though...

What do you think?