Google News
logo
SQL Server - Quiz(MCQ)
If xp_cmdshell has been disabled with sp_dropextendedproc, we can simply inject the following code?
A)
sp_addproc ‘xp_cmdshell’,’xp_log70.dll’
B)
sp_addextendedproc ‘xp_cmdshell’,’log70.dll’
C)
sp_addextendedproc ‘xp_cmdshell’,’xp_log70.dll’
D)
None of the above

Correct Answer :   sp_addextendedproc ‘xp_cmdshell’,’xp_log70.dll’


Explanation : Security best practices for SQL Server recommends disabling xp_cmdshell in SQL Server 2000 (in SQL Server 2005 it is disabled by default). However, if we have sysadmin rights (natively or by bruteforcing the sysadmin password, see below), we can often bypass this limitation.

Advertisement