Modify the SQL SERVER internal storage process

SQLSERVER is estimated to be for installation or other aspects, it has built-in a batch of dangerous stored procedures. Ability to read registry information, write registry information, and read disk sharing information ...... You may think that there are other code on my website and the results are not directly output as the query analyzer does. This permission cannot be used, but you still cannot see the information. If you think this way, it's a big mistake. Note: if the attacker has the create table permission, CREATE a temporary TABLE, INSERT the information to the TABLE, SELECT the TABLE, and compare it with a number, so that SQL SERVER reports an error, then the results are complete ...... Therefore, we have to handle the mistake and try to fix it.

First, list dangerous internal storage processes:

Xp_mongoshell

Xp_regaddmultistring

Xp_regdeletekey

Xp_regdeletevalue

Xp_regenumkeys

Xp_regenumvalues

Xp_regread

Xp_regremovemultistring

Xp_regwrite

ActiveX automatic script:

Sp_OACreate

Sp_OADestroy

Sp_OAMethod

Sp_OAGetProperty

Sp_OASetProperty

Sp_OAGetErrorInfo

Sp_OAStop

The above items are all in our blocking column. For example, the xp_mongoshell blocking method is as follows:

Sp_dropextendedproc 'XP _ export shell'

If necessary, use

Sp_addextendedproc 'XP _ external shell', 'sqlsql70. dll'

. If you do not know which. dll file is used by xp_cmdshell, you can use

Sp_helpextendedproc xp_mongoshel

To view which dynamic connection library is used by xp_mongoshell. In addition, after xp_mongoshell is blocked, we also need to change the name of the xpsql70.dll file to prevent attackers from recovering the file.