Modify the SQL Server internal storage process

From old knife Column

Address: http://blog.csdn.net/keenx/archive/2005/11/23/535451.aspx

Sqlserver is estimated to be for installation or other aspects, it has built-in a batch of dangerous stored procedures. Ability to read registry information, write registry information, and read disk sharing information ...... You may think that there are other code on my website and the results are not directly output as the query analyzer does. This permission cannot be used, but you still cannot see the information. If you think this way, it's a big mistake. Note: If the attacker has the create table permission, create a temporary table, insert the information to the table, select the table, and compare it with a number, so that SQL Server reports an error, then the results are complete ...... Therefore, we have to handle the mistake and try to fix it.
　　
First, list dangerous internal storage processes:
Xp_mongoshell
Xp_regaddmultistring
Xp_regdeletekey
Xp_regdeletevalue
Xp_regenumkeys
Xp_regenumvalues
Xp_regread
Xp_regremovemultistring
Xp_regwrite
ActiveX automatic script:
Sp_oacreate
Sp_oadestroy
Sp_oamethod
Sp_oagetproperty
Sp_oasetproperty
Sp_oageterrorinfo
Sp_oastop
　　
The above items are all in our blocking column. For example, the xp_mongoshell blocking method is as follows:
　　
Sp_dropextendedproc 'xp _ export shell'
　　
If necessary, use
　　
Sp_addextendedproc 'xp _ external shell', 'sqlsql70. dll'
　　
. If you do not know which. dll file is used by xp_cmdshell, you can use
　　
Sp_helpextendedproc xp_mongoshel
　　
To view which dynamic connection library is used by xp_mongoshell. In addition, after xp_mongoshell is blocked, we also need to change the name of the xpsql70.dll file to prevent attackers from recovering the file.

 

1. Remove mssql2000 extended stored procedures. SQL

Use master
Exec sp_dropextendedproc 'xp _ export shell'
Go
Exec sp_dropextendedproc 'xp _ dirtree'
Go
Exec sp_dropextendedproc 'xp _ enumgroups'
Go
Exec sp_dropextendedproc 'xp _ fixeddrives'
Go
Exec sp_dropextendedproc 'xp _ loginconfig'
Go
Exec sp_dropextendedproc 'xp _ regaddmultistring'
Go
Exec sp_dropextendedproc 'xp _ regdeletekey'
Go
Exec sp_dropextendedproc 'xp _ regdeletevalue'
Go
Exec sp_dropextendedproc 'xp _ regread'
Go
Exec sp_dropextendedproc 'xp _ regremovemultistring'
Go
Exec sp_dropextendedproc 'xp _ regwrite'
Go
Exec sp_dropextendedproc 'xp _ enumerrorlogs'
Go
Exec sp_dropextendedproc 'xp _ getfiledetails'
Go
Exec sp_dropextendedproc 'xp _ regenumvalues'
Go

2. Restore mssql2000 extended stored procedures. SQL

Use master
Exec sp_addextendedproc 'xp _ cmdshell', 'xp log70. dll'
Go
Exec sp_addextendedproc 'xp _ dirtree ', 'xpstar. dll'
Go
Exec sp_addextendedproc 'xp _ enumgroups ', 'xp log70. dll'
Go
Exec sp_addextendedproc 'xp _ fixeddrives ', 'xpstar. dll'
Go
Exec sp_addextendedproc 'xp _ loginconfig', 'xp log70. dll'
Go
Exec sp_addextendedproc 'xp _ regaddmultistring ', 'xpstar. dll'
Go
Exec sp_addextendedproc 'xp _ regdeletekey ', 'xpstar. dll'
Go
Exec sp_addextendedproc 'xp _ regdeletevalue ', 'xpstar. dll'
Go
Exec sp_addextendedproc 'xp _ regread ', 'xpstar. dll'
Go
Exec sp_addextendedproc 'xp _ regremovemultistring ', 'xpstar. dll'
Go
Exec sp_addextendedproc 'xp _ regwrite', 'xpstar. dll'
Go
Exec sp_addextendedproc 'xp _ enumerrorlogs', 'xpstar. dll'
Go
Exec sp_addextendedproc 'xp _ getfiledetails ', 'xpstar. dll'
Go
Exec sp_addextendedproc 'xp _ regenumvalues ', 'xpstar. dll'
Go