First of all, I would like to thank @ busy chasing and forgetting the SQL text that can throw exceptions:
As follows:RAISERROR (n'exception 1',) WITH NOWAIT
SELECT 1
RAISERROR (n'exception 2',) WITH NOWAIT
SELECT 2
RAISERROR (n'exception 3',) WITH
Let's say a host has 1433 ports. We have remote connections via SQL injection or null weak password
What can be done to add a system administrator user (or execute a system command)
1). xp_cmdshell ' cmd.exe/c net user aaa Bbb/add '
Everybody
MSSQL
Error Log File storage location: C: \ Program Files \ Microsoft SQL Server \ MSSQL \ log view in Notepad
@ Error an integer 0 is returned as normal
System Table of error messages stored in sysmessages (master)
Use master
Select * From
@ ERROR an integer 0 is returned as normal
@ ERROR an integer 0 is returned as normal
Mssql
Error LOG File storage location: C: \ Program Files \ Microsoft SQL Server \ MSSQL \ LOG view in Notepad
@ ERROR an integer 0 is returned as normal
Infos:mssql an injection of its own stored procedure
Author: Madman [BCT]
date:10/11/2007
I see the MSSQL stored process, there is a model of the filter in the sample. Then I went to read their stored procedures. I found an injection.
Said the
Let's say a host has 1433 ports. What can we do with SQL injection or a remote connection with a null weak password to add a system administrator user (or execute a system command)?
1). xp_cmdshell ' cmd.exe/c net user aaa Bbb/add '
Everybody knows
I don't know if you have read this article. You can add the SysAdmin account under the db_owner role. This is really a tough move. The servers with the MSSQL injection vulnerability will suffer again. The primary method is to use db_owner to modify
Mssql
Error log file storage location: C:\Program Files\Microsoft SQL Server\mssql\log View with Notepad
@ @ERROR Returns an integer 0 as normal
sysmessages stored Error Information system table (master)
Use master
SELECT * FROM sysmessages where
The simulation implements the exception stack, reports the call chain and the exception location, with the following code:CREATE PROC [Myhelper]. [ThrowError] @ProcId intas--for the re-encapsulation error, Microsoft has a RAISERROR solution: [SYS]
Strictly speaking, these three production methods have certain intersections, and their positioning methods will be explained below
Strictly speaking, these three production methods have certain intersections, and their positioning methods will be
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.