Shulou(Shulou.com)05/31 Report--

This article is about how to use OPENROWSET to explode SQL Server passwords. The editor thinks it is very practical, so share it with you as a reference and follow the editor to have a look.

Use OPENROWSET to explode SQL Server password

The OPENROWSET function is a connection function provided by SQL Server. It can be used to connect to a database using OLE DB and perform operations such as data query. When using this function, you need to specify the target, user, password and other information of the connection. Penetration testers can use this function to explode database users by specifying a password dictionary.

For example, the SQL Server database injection tool sqlninja provided by Kali takes advantage of this function. If the injection is successful, it is found that only ordinary user rights have been obtained. At this point, you can use this function to build a connection to your own database as sa. During the connection process, the sa password can be exploded. Once successful, the current ordinary user status can be promoted to administrator, thus realizing the promotion of rights.

If the user has acquired administrative privileges on one server, he can also connect to other SQL Server servers based on that server and perform burst operations.

PS: starting with SQL Server 2005, the OPENROWSET function can only be executed by the administrator user group by default. Therefore, the lifting operation can only be carried out in SQL Server 2000.

Thank you for reading! This is the end of the article on "how to use OPENROWSET blasting SQL Server password". I hope the above content can be of some help to you, so that you can learn more knowledge. if you think the article is good, you can share it out for more people to see!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.