MS SQL Server SA Empty Check
In Windows2000, enterprise-class users generally use another Microsoft product, which is the database management software MS SQL Server, but we have discovered a lot of problems in the use of MS SQL Server. Finally, we will simply talk about the security issues that have been universally facing the WINDOWS2000 network operating system installed in MS SQL Server.
After installing MS SQL Server, MS SQL Server will generate a default SA user, and the initial password is empty when the administrator is not set. But SA is a very important security module member in SQL Server. This hacker can be connected remotely through SQL Server client, and then use SQL remote database management command xp_cmdshell stored procedure (extended stored procedure) Command operation:
XP_cmdshell "Net User ID Password / Add"
XP_cmdshell "Net localgroup administrators id / add"
For the two simple command invaders, they will now create a user from the Administrator-level administrators group on the MS SQL Server server. So we remind you to the NMS, the first thing you need to do in installation of SQL Server is to modify the empty password of the SA. Don't tell you where this question should you change?
And in general, some functions are not necessary for administrators. If you don't need MS SQL Server XP_CMDShell (Use sp_dropextendedproc "xp_cmdshell") This feature does not leave the XP_CMDSHELL Extended Stored Proc (Extension) command function.
We only need to enter in the ISQL window:
Use master
sp_dropextendedProc 'XP_cmdshell'
Then put the service pack 3, where to remind the administrator, be sure to pay attention to Microsoft's patch package file, and pay attention to timely updating system and software to the latest patches.
In this article, we tell a few recent versions and attack methods. They have the invasion to be so convenient. There are many netizens that will think that Windows2000 is an unsafe operating system, but if you think that It is said that my article has not been written yet, so I have to emphasize in the end, as long as we often make the ding package, the correct to add a password to the system, our safety rate is around 85%.
