passi
Jun 26 2004, 07:59 PM
hi
i want to write an sql client for the xp_cmdshell security leak (like sqlexec). but i only can write in visual basic.
is it possible to do this in vb? if yes, do you know a sql module to connect to a sql database? and do you have any information regarding writing a sql client in vb?
thanks a lot
greets, passiw
slipped
Jun 26 2004, 08:19 PM
Yes, its possible, and would probably be very easy to do, too. Look into ADO for visual basic on how to interact with databases. That should be all you need, along with some VB knowledge.
Metathron
Jun 27 2004, 05:46 AM
yes its possible
SQLExec 2.0 is too written in VB
passi
Jun 27 2004, 03:05 PM
thanks for info, but still don't know how to start. have any links or something for me? would be great
slipped
Jun 27 2004, 04:13 PM
just search for "mysql / mssql visual basic" in google. All xp_cmdshell is is a database call, its not that hard to implement at all. If you have 0 experience with database work it will make no sense, so start with just basic interaction with databases before moving on to actually writing the exploiter.
passi
Jun 27 2004, 05:28 PM
I searched for this and similar keywords on google but i dodn't find anything ergarding mssql client development in vb.
Did you find anything?
passiw
Lanig
Jun 27 2004, 08:54 PM
i too have searched for the answer for this and gathered this code:
u need to add a refernce to ActiveX Data Objects
| CODE |
Dim oConn As New ADODB.Connection
Dim oCmnd As New ADODB.Command
Dim oRset As New ADODB.Recordset
Dim sOutput As String, sServer As String, sUsername As String, sPassword As String
oConn.ConnectionString = "DRIVER={SQL Server};Network Library=DBMSSOCN;SERVER=" & sServer & ";UID=" & sUsername & ";PWD=" & sPassword
oConn.Open
oCmnd.ActiveConnection = oConn
oCmnd.CommandType = adCmdUnknown
oCmnd.CommandText = "xp_cmdshell('dir c:\')"
Set oRset = oCmnd.Execute
sOutput = oRset.GetString |
that would results having the dir contents of c:\ in sOutput variable
might be other ways tho this is what i put together from many different explainations
passi
Jun 29 2004, 12:15 PM
Wow! thanks a lot for this
i try it. if i do it i will let you know
//Cool it works great
Zenuka
Jul 3 2004, 09:56 AM
Sorry i didn't see it any sooner...
I did a vb sql tool a while ago. It was quite simpel.
I've attached the complete source so have fun and leave credz for me
Edit: Can't get the attachment to work
http://www.zenuka.nl/SQLBrouwser.rar
G-Ryder
Jul 3 2004, 06:41 PM
Nice 1 Zenuka.. The source is really interesting
I have been wondering how to do that for a while.. Cheers m8
ttfella
Jul 3 2004, 11:19 PM
cool zenuka works well ,ideal for us lazy types
twistedps
Jul 9 2004, 06:16 PM
why reinvent the wheel, when theyre already 50 wheels out there that work well. put your time into something new and innovative!
you'll enjoy the outcome more when its released to the public.
chris105
Jul 9 2004, 09:35 PM
unless he is incorporating this feature into a bigger "innovative" program he is making or if he is just using it as a "learning" project
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please
click here.
