How to delete and restore dangerous stored procedures of SQL Server databases

To implement the /"target =" _ blank "> SQLServer replication function today, many sqlserver s are deleted before, which may lead to expansion of insecure factors, as a result, many functions are unavailable and there is no way to restore the expansion.
Once met, almost crazy, a friend installed MSSQL, hurry and try to delete the following components. of course, the premise is that you have to delete your own database, otherwise many functions will not be available after the component is deleted. To ensure security, you have to sacrifice some functions. Of course, for me, I used MSSQL less than twice a year, so I will not hesitate to delete it.

I. Delete the SQL process with security issues. It is comprehensive. Everything is safe!

The permission to corrupt shell, registry, and COM components is deleted.

Ms SQL SERVER2000

Log on to the query analyzer using a system account
Run the following script
Copy codeThe Code is as follows:
Use master
Exec sp_dropextendedproc 'xp _ export shell'
Exec sp_dropextendedproc 'xp _ enumgroups'
Exec sp_dropextendedproc 'xp _ loginconfig'
Exec sp_dropextendedproc 'xp _ enumerrorlogs'
Exec sp_dropextendedproc 'xp _ getfiledetails'
Exec sp_dropextendedproc 'SP _ OACreate'
Exec sp_dropextendedproc 'SP _ OADestroy'
Exec sp_dropextendedproc 'SP _ oageterrorinfo'
Exec sp_dropextendedproc 'SP _ oagetproperties'
Exec sp_dropextendedproc 'SP _ oamethod'
Exec sp_dropextendedproc 'SP _ oasetproperties'
Exec sp_dropextendedproc 'SP _ oastop'
Exec sp_dropextendedproc 'xp _ regaddmultistring'
Exec sp_dropextendedproc 'xp _ regdeletekey'
Exec sp_dropextendedproc 'xp _ regdeletevalue'
Exec sp_dropextendedproc 'xp _ regenumvalues'
Exec sp_dropextendedproc 'xp _ regremovemultistring'
Exec sp_dropextendedproc 'xp _ regwrite'
Drop procedure sp_makewebtask
Go


Delete all dangerous extensions.
Exec sp_dropextendedproc 'xp _ export shell' [after this extension is deleted, the database cannot be remotely connected]
The following three stored procedures will be used when SQL SERVER recovers the backup. Do not delete them unless necessary.
# Exec sp_dropextendedproc 'xp _ dirtree '[after this extension is deleted, the database cannot be created or attached]
# Exec sp_dropextendedproc 'xp _ regread '[restore the database after deleting this extension]
# Exec sp_dropextendedproc 'xp _ fixeddrives '[The database cannot be restored after this extension is deleted]

Recovery script
Copy codeThe Code is as follows:
Use master
EXEC sp_addextendedproc xp_cmdshell, @ dllname = 'loglog70. dll'
EXEC sp_addextendedproc xp_enumgroups, @ dllname = 'loglog70. dll'
EXEC sp_addextendedproc xp_loginconfig, @ dllname = 'loglog70. dll'
EXEC sp_addextendedproc xp_enumerrorlogs, @ dllname = 'xpstar. dll'
EXEC sp_addextendedproc xp_getfiledetails, @ dllname = 'xpstar. dll'
EXEC sp_addextendedproc Sp_OACreate, @ dllname = 'odsole70. dll'
EXEC sp_addextendedproc Sp_OADestroy, @ dllname = 'odsole70. dll'
EXEC sp_addextendedproc Sp_OAGetErrorInfo, @ dllname = 'odsole70. dll'
EXEC sp_addextendedproc Sp_OAGetProperty, @ dllname = 'odsole70. dll'
EXEC sp_addextendedproc Sp_OAMethod, @ dllname = 'odsole70. dll'
EXEC sp_addextendedproc Sp_OASetProperty, @ dllname = 'odsole70. dll'
EXEC sp_addextendedproc Sp_OAStop, @ dllname = 'odsole70. dll'
EXEC sp_addextendedproc xp_regaddmultistring, @ dllname = 'xpstar. dll'
EXEC sp_addextendedproc xp_regdeletekey, @ dllname = 'xpstar. dll'
EXEC sp_addextendedproc xp_regdeletevalue, @ dllname = 'xpstar. dll'
EXEC sp_addextendedproc xp_regenumvalues, @ dllname = 'xpstar. dll'
EXEC sp_addextendedproc xp_regremovemultistring, @ dllname = 'xpstar. dll'
EXEC sp_addextendedproc xp_regwrite, @ dllname = 'xpstar. dll'
EXEC sp_addextendedproc xp_dirtree, @ dllname = 'xpstar. dll'
EXEC sp_addextendedproc xp_regread, @ dllname = 'xpstar. dll'
EXEC sp_addextendedproc xp_fixeddrives, @ dllname = 'xpstar. dll'
Go


Copy all to "SQL query analyzer"

Click -- "query" -- "execute" on the menu to delete the SQL process with security issues.


2. SQL server 2000 has been prone to many vulnerabilities
Some time ago, my own server experienced a temporary SQL stored procedure vulnerability.
Vulnerability Extension: xp_dirtree Stored Procedure

Beforehand: A recent vulnerability was discovered on the SQL server.
Just a few days ago, nothing happened. I used the SQL injection tool of Alibaba Cloud to inject the website on my server, by accident, we found that mssql can be used to obtain all directories on the server (my server has made security settings, then, a packet capture tool is installed on the server to capture the SQL server packets. The tool is used to connect to the SQL vulnerability xp_dirtree to read the Directory and obtain the entire server directory, for example, listing the directory on drive C will list all the directories on drive C, which is very insecure. Currently, we can only investigate and handle the directory wearing things. You can imagine that, if you want to modify a boot. ini overwrites the boot of drive C. what is the concept of ini? First, it can lead to service paralysis and cannot read the system.
Solution: delete xp_dirtree. The command is sp_dropextendedproc 'xp _ dirtree'
After deleting the preceding component, you are using a d or any SQL injection tool.

Here we also provide you with some other dangerous SQL stored procedures.
Recommended to delete

[Note: All operations to delete the SQL stored procedure must be performed in the mssql query analyzer. Which of the following statements follow the stored procedure name followed by the command to delete the stored procedure?]

First, list dangerous internal storage processes:
Copy codeThe Code is as follows:
Xp_cmdshell sp_dropextendedproc 'xp _ cmdshell'
Xp_regaddmultistring sp_dropextendedproc 'xp _ regaddmultistring'
Xp_regdeletekey sp_dropextendedproc 'xp _ regdeletekey'
Xp_regdeletevalue sp_dropextendedproc 'xp _ regdeletevalue'
Xp_regenumkeys sp_dropextendedproc 'xp _ regenumkeys'
Xp_regenumvalues sp_dropextendedproc 'xp _ regenumvalues'
Xp_regread sp_dropextendedproc 'xp _ regread'
Xp_regremovemultistring sp_dropextendedproc 'xp _ regremovemultistring'
Xp_regwrite sp_dropextendedproc 'xp _ regwrite'


ActiveX script:

Copy codeThe Code is as follows:
Sp_OACreate sp_dropextendedproc 'SP _ oacreate'
Sp_OADestroy sp_dropextendedproc 'SP _ OADestroy'
Sp_OAMethod sp_dropextendedproc 'SP _ oamethod'
Sp_OAGetProperty sp_dropextendedproc 'SP _ oagetproperties'
Sp_OAGetErrorInfo sp_dropextendedproc 'SP _ oageterrorinfo'
Sp_OAStop sp_dropextendedproc 'SP _ oastop'