最近看到MSSQL2000的扩展存储过程破受关注,特此整理出几个常受攻击的extended stored procedures的 how to remove and / or restore scripts
1.remove mssql2000 extended stored procedures.sql
use master
exec sp_dropextendedproc 'xp_cmdshell'
go
exec sp_dropextendedproc 'xp_dirtree'
go
exec sp_dropextendedproc 'xp_enumgroups'
go
exec sp_dropextendedproc 'xp_fixeddrives'
go
exec sp_dropextendedproc 'xp_loginconfig'
go
exec sp_dropextendedproc 'xp_regaddmultistring'
go
exec sp_dropextendedproc 'xp_regdeletekey'
go
exec sp_dropextendedproc 'xp_regdeletevalue'
go
exec sp_dropextendedproc 'xp_regread'
go
exec sp_dropextendedproc 'xp_regremovemultistring'
go
exec sp_dropextendedproc 'xp_regwrite'
go
exec sp_dropextendedproc 'xp_enumerrorlogs'
go
exec sp_dropextendedproc 'xp_getfiledetails'
go
exec sp_dropextendedproc 'xp_regenumvalues'
go
2.restore mssql2000 extended stored procedures.sql
use master
exec sp_addextendedproc 'xp_cmdshell', 'xplog70.dll'
go
exec sp_addextendedproc 'xp_dirtree', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_enumgroups', 'xplog70.dll'
go
exec sp_addextendedproc 'xp_fixeddrives', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_loginconfig', 'xplog70.dll'
go
exec sp_addextendedproc 'xp_regaddmultistring', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regdeletekey', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regdeletevalue', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regread', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regremovemultistring', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regwrite', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_enumerrorlogs', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_getfiledetails', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regenumvalues', 'xpstar.dll'
go