[EXPLOiTED]

hi, im looking into Making a script or Code to Connect to all your sql servers, but you cant seem to Find any Documentation On the Raw syntax For Sql

[Jeremy]

All our SQL servers? I hope that is just poor english and not a threat :P

Well the code and syntax are differnt for each programming language. So research it for your particular prog lang.

[EXPLOiTED]

poor english? Ok i meant But I cant find any documentation on raw sql commands. a threat? no! What are you talking about. i just want the raw syntax how sqlexec.exe connects and opens the remote shell. and how xscan tries the passes on the sql server. this way i can make my own with mirc scripting. as im good at sockets and made tons of things.

[EXPLOiTED]

Same....i did search Google

[Reaper527]

EXPLOiTED, on Jan 28 2004, 12:32 PM, said:

a threat? no! What are you talking about.

well, i don't know how sqlexec opens the shell, however i can explain the threat part, i'm assuming w00dy meant it as a joke, but when you say "so it can connect to all your sql servers" it could jokingly be interpreted literaly as a tool to specifically connect to sql servers maintained by people on the board as opposed to reading a scan log which is what i'm assuming you meant.

[EXPLOiTED]

duh... i didnt even see that typo. Yes i meant a scan log. sorry

[Steffan]

EXPLOiTED, on Jan 28 2004, 12:32 PM, said:

i just want the raw syntax how sqlexec.exe connects and opens the remote shell. and how xscan tries the passes on the sql server. this way i can make my own with mirc scripting. as im good at sockets and made tons of things.

Hi.

1. U get only a Shell if U use the "Slammer" Exploit (SQL-UDP-Exploit) ;)

2. What U mean is (in case of sqlexec) --> xp_cmdshell
This is used to execute DOS-Commands when conn. to ms-SQL Server

3. Forget MS-SQL it's dead (exp. for SK's) *LOL*

4. Here a part of my own SQLexec I wrote (ist pure C) :

Have fun and now U should be able to code U own Scanner/Hacker B)

C'ya
Steven

// allocate environment handle
	if (SQLAllocHandle(SQL_HANDLE_ENV,SQL_NULL_HANDLE,&hEnvironment) != SQL_SUCCESS)
  {
  printf("[-] SQLAllocHandle returned an error!\n");
  free(Prev);
  return 0;
	}

    if (SQLSetEnvAttr(hEnvironment, SQL_ATTR_ODBC_VERSION,(SQLPOINTER)SQL_OV_ODBC3, SQL_IS_INTEGER) != SQL_SUCCESS)
  {
  printf("[-] SQLSetEnvAttr returned an error!\n");
  free(Prev);
  return 0;

	}

	if ((nResult = SQLAllocHandle(SQL_HANDLE_DBC,hEnvironment,(SQLHDBC FAR*)&hDbc)) != SQL_SUCCESS)
  {
  printf("[-] SQLAllocHandle returned an error!\n");
  free(Prev);
  return 0;
	}

// connect to SQL server

	nResult = SQLDriverConnect(hDbc,NULL, InConnectionString, strlen(InConnectionString), inBuff,  1024, &sLen, SQL_DRIVER_COMPLETE_REQUIRED);
	if(nResult == SQL_SUCCESS || nResult == SQL_SUCCESS_WITH_INFO)