Recently, a business website launched by the company was attacked by hackers. through SQL injection, the trojan was injected into the database, and the whole MSSQLSERVER data was appended with malicious scripts.
Recently, a business website launched by the company was attacked by hackers. The trojan was injected into the database by means of SQL injection, and the data of the entire MSSQL SERVER was appended with malicious scripts.
Recently, I found a batch replacement of inserted Trojan records and found a good statement, which is very useful. I only use a dozen rows of cursor statements, the malicious trojan of all tables in the database is cleared, and the probability of this record being searched by Google is very small. I will repost it here! In the future, we hope that future generations can get help.
The original article is as follows:
The Code is as follows:
Declare @ t varchar (555), @ c varchar (555), @ inScript varchar (8000)
Set @ inScript = 'malicious Code'
Declare table_cursor cursor for select. name, B. name from sysobjects a, syscolumns B where. id = B. id and. xtype = 'U' and (B. xtype = 99 or B. xtype = 35 or B. xtype = 231 or B. (xtype = 167)
Open table_cursor
Fetch next from table_cursor into @ t, @ c
While (@ fetch_status = 0)
Begin
Exec ('Update ['+ @ t +'] set ['+ @ c +'] = replace (cast (['+ @ c +'] as varchar (8000 )), ''' + @ inScript + ''','''')')
Fetch next from table_cursor into @ t, @ c
End
Close table_cursor
Deallocate table_cursor;
Completely eliminate SQL Injection
1. Do not use the sa user to connect to the database
2. Create a public permission database user and use the user to access the database
3. [role] Remove the select access permission of the public role to the sysobjects and syscolumns objects.
4. Right-click a [user] user name and choose "properties"> "Permissions"> "sysobjects" and "syscolumns"
5. Use the following code to check whether the permission is correct. If the permission is displayed, the permission is too high ):
The Code is as follows:
DECLARE @ T varchar (255 ),
@ C varchar (255)
DECLARE Table_Cursor CURSOR
Select a. name, B. name from sysobjects a, syscolumns B
Where. id = B. id and. xtype = 'U' and (B. xtype = 99 or B. xtype = 35 or B. xtype = 231 or B. (xtype = 167)
OPEN Table_Cursor
Fetch next from Table_Cursor INTO @ T, @ C
WHILE (@ FETCH_STATUS = 0)
BEGIN print @ c
Fetch next from Table_Cursor INTO @ T, @ C
END
CLOSE Table_Cursor
DEALLOCATE Table_Cursor
