SQL Injection Attacks and Defense - 2009

306 Chapter 6 • Exploiting the Operating System
On modern versions of SQL Server, however, xp_cmdshell is disabled by default. This
(along with many other settings) can be configured through the Surface Area Configuration
tool that ships with SQL Server. The Surface Area Configuration tool is shown in Figure 6.20.
Figure 6.20 The Surface Area Configuration Tool
This, however, poses little problem if the attacker has the necessary privileges, since it can
once more be turned on through in-band signaling using the sp_configure statement.
Figure 6.21 demonstrates how to reenable xp_cmdshell within Query Manager. A quick
search on the Internet for “xp_cmdshell alternative” will also quickly point you to the
hordes of posts where people have rediscovered the possibility of instantiating a Wscript.Shell
instance through T-SQL in much the same manner as we used in this chapter for file reading
and writing. The neatest of these, demonstrated in the code that follows, creates a new stored
procedure called xp_cmdshell3. 3