remove and/or restore mssql2000 extended stored procedures s

最近看到MSSQL2000的擴展存儲過程破受關注,特此整理出幾個常受攻擊的extended stored procedures的 how to remove and / or restore scripts

1.remove mssql2000 extended stored procedures.sql

use master
exec sp_dropextendedproc 'xp_cmdshell'
go
exec sp_dropextendedproc 'xp_dirtree'
go
exec sp_dropextendedproc 'xp_enumgroups'
go
exec sp_dropextendedproc 'xp_fixeddrives'
go
exec sp_dropextendedproc 'xp_loginconfig'
go
exec sp_dropextendedproc 'xp_regaddmultistring'
go
exec sp_dropextendedproc 'xp_regdeletekey'
go
exec sp_dropextendedproc 'xp_regdeletevalue'
go
exec sp_dropextendedproc 'xp_regread'
go
exec sp_dropextendedproc 'xp_regremovemultistring'
go
exec sp_dropextendedproc 'xp_regwrite'
go
exec sp_dropextendedproc 'xp_enumerrorlogs'
go
exec sp_dropextendedproc 'xp_getfiledetails'
go
exec sp_dropextendedproc 'xp_regenumvalues'
go

2.restore mssql2000 extended stored procedures.sql

use master
exec sp_addextendedproc 'xp_cmdshell', 'xplog70.dll'
go
exec sp_addextendedproc 'xp_dirtree', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_enumgroups', 'xplog70.dll'
go
exec sp_addextendedproc 'xp_fixeddrives', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_loginconfig', 'xplog70.dll'
go
exec sp_addextendedproc 'xp_regaddmultistring', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regdeletekey', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regdeletevalue', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regread', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regremovemultistring', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regwrite', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_enumerrorlogs', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_getfiledetails', 'xpstar.dll'
go
exec sp_addextendedproc 'xp_regenumvalues', 'xpstar.dll'
go