Quantcast
Channel: SQLServerCentral » SQL Server 2014 » Development - SQL Server 2014 » Latest topics
Viewing all articles
Browse latest Browse all 3145

Code dotnet in the sql injection in management studio

$
0
0
Hello,I have developed a solution that allows to inject code directly in dotnet requettes sql . which allows to use all the dotnet framworks on the fly in the sql management studio.an example of which execute my function today:[code="sql"]Select dbo.Execute1(' var p1 = decimal.Parse(@p1.ToString()); return 15 + Math.Abs(p1); ',5)[/code]Execute1 dotnet 'll execute the code and return the result , of course everything can be possible, ( work on the chains , on numeric , created and instantiated class , ...) and there are possible to put it in a select ( the function will execute on each line ) .So you can easily deploy it on my sql server I would have the opportunity for a dotnet dll instantiated in sql server , to find a directory with read / write by the sql server processes (of course when recording my dll j ' I put unsafe ) and I bit or execute an exe from the command line .integration of code from my dll .[code="sql"]CREATE ASSEMBLY SqlFX from 'D:\SqlServerFX.dll' WITH PERMISSION_SET = UNSAFE /*SAFE | EXTERNAL_ACCESS | UNSAFE */Go CREATE FUNCTION [dbo].Execute1(@Algo sql_variant, @p1 sql_variant)RETURNS sql_variant WITH EXECUTE AS CALLERASEXTERNAL NAME [SqlFX].[SqlServerFX.FX].Execute1go[/code]Thank you to all.

Viewing all articles
Browse latest Browse all 3145

Trending Articles