| Reply To Message: |
| Posted By |
n/a on 11/14/2005 2:48:00 AM |
| Subject: |
some question about one paper |
| Message: |
hey guys,
i have read one paper named Hunting_Flaws_in_SQL_Server(the link is http://www.appsecinc.com/presentations/Hunting_Flaws_in_SQL_Server.pdf.
),in the paper,the author said :"We can confirm that any use granted the db_owner role canbecome. sysadmin. Cool - isn’t it? Why does this works?Because we tricked SQL Server into believing that we were the. ‘sa’ login by changing the SID in the ..."but my test is fail.in one bbs,i find one guy's test is susseccful, and his mssql version is 7.000.but mine is mssql 2000.so i m dizy.i know how can i do it.
i hope ur answers.
thanx,guys,good luck.
|
|