当前位置:主页>Mssql>

SQL Server危险扩展删除与恢复详解

来源: 作者: 发布时间:2008-10-07 点击次数:

将有安全问题的SQL过程删除.比较全面.一切为了安全!
删除了调用shell,注册表,COM组件的破坏权限 字串7

MS SQL SERVER2000 字串8

使用系统帐户登陆查询分析器

字串7

运行以下脚本:

字串9

use master 字串3

exec sp_dropextendedproc 'xp_cmdshell'

字串4

exec sp_dropextendedproc 'xp_enumgroups' 字串6

exec sp_dropextendedproc 'xp_loginconfig'

字串4

exec sp_dropextendedproc 'xp_enumerrorlogs' 字串8

exec sp_dropextendedproc 'xp_getfiledetails'

字串8

exec sp_dropextendedproc 'Sp_OACreate'

字串5

exec sp_dropextendedproc 'Sp_OADestroy' 字串1

exec sp_dropextendedproc 'Sp_OAGetErrorInfo' 字串4

exec sp_dropextendedproc 'Sp_OAGetProperty' 字串9

exec sp_dropextendedproc 'Sp_OAMethod'

字串6

exec sp_dropextendedproc 'Sp_OASetProperty'

字串6

exec sp_dropextendedproc 'Sp_OAStop' 字串6

exec sp_dropextendedproc 'xp_regaddmultistring' 字串2

exec sp_dropextendedproc 'xp_regdeletekey' 字串1

exec sp_dropextendedproc 'xp_regdeletevalue'

字串4

exec sp_dropextendedproc 'xp_regenumvalues' 字串8

exec sp_dropextendedproc 'xp_regremovemultistring' 字串5

exec sp_dropextendedproc 'xp_regwrite'

字串3

drop procedure sp_makewebtask

字串3

go

字串3

删除所有危险的扩展: 字串3

exec sp_dropextendedproc 'xp_cmdshell' [删除此项扩展后,将无法远程连接数据库] 字串8

以下3个存储过程会在SQL SERVER恢复备份时被使用,非必要请勿删除 字串5

#exec sp_dropextendedproc 'xp_dirtree' [删除此项扩展后,将无法新建或附加数据库] 字串2

#exec sp_dropextendedproc 'Xp_regread' [删除此项扩展后, 还原数据库辅助] 字串1

#exec sp_dropextendedproc 'xp_fixeddrives' [删除此项扩展后,将无法还原数据库]

字串7

恢复脚本

字串7

use master

字串3

EXEC sp_addextendedproc xp_cmdshell ,@dllname ='xplog70.dll'

字串9

EXEC sp_addextendedproc xp_enumgroups ,@dllname ='xplog70.dll' 字串6

EXEC sp_addextendedproc xp_loginconfig ,@dllname ='xplog70.dll' 字串4

EXEC sp_addextendedproc xp_enumerrorlogs ,@dllname ='xpstar.dll'

字串6

EXEC sp_addextendedproc xp_getfiledetails ,@dllname ='xpstar.dll' 字串3

EXEC sp_addextendedproc Sp_OACreate ,@dllname ='odsole70.dll' 字串3

EXEC sp_addextendedproc Sp_OADestroy ,@dllname ='odsole70.dll' 字串3

EXEC sp_addextendedproc Sp_OAGetErrorInfo ,@dllname ='odsole70.dll'

字串6

EXEC sp_addextendedproc Sp_OAGetProperty ,@dllname ='odsole70.dll' 字串7

EXEC sp_addextendedproc Sp_OAMethod ,@dllname ='odsole70.dll' 字串7

EXEC sp_addextendedproc Sp_OASetProperty ,@dllname ='odsole70.dll'

字串9

EXEC sp_addextendedproc Sp_OAStop ,@dllname ='odsole70.dll'

字串8

EXEC sp_addextendedproc xp_regaddmultistring ,@dllname ='xpstar.dll'

字串8

EXEC sp_addextendedproc xp_regdeletekey ,@dllname ='xpstar.dll' 字串7

EXEC sp_addextendedproc xp_regdeletevalue ,@dllname ='xpstar.dll' 字串9

EXEC sp_addextendedproc xp_regenumvalues ,@dllname ='xpstar.dll' 字串8

EXEC sp_addextendedproc xp_regremovemultistring ,@dllname ='xpstar.dll' 字串7

EXEC sp_addextendedproc xp_regwrite ,@dllname ='xpstar.dll'

字串5

EXEC sp_addextendedproc xp_dirtree ,@dllname ='xpstar.dll'

字串3

EXEC sp_addextendedproc xp_regread ,@dllname ='xpstar.dll' 字串4

EXEC sp_addextendedproc xp_fixeddrives ,@dllname ='xpstar.dll' 字串2

go

字串9

全部复制到"SQL查询分析器" 字串8

点击菜单上的--"查询"--"执行",就会将有安全问题的SQL过程删除。
字串1