RE: MS SQL Server

["Beauford, Jason" <jbeauford () EightInOnePet com>]

Here's an idea:

If you were to install an INSTANCE of SQL Server on another machine and
name the INSTANCE the SAME Name as the original SQL Server, you should
be able to just copy over the SQL Directories to your server and open it
from there.  Of course the SQL Service will need to be stopped, but
because you have admin rights on the box you can do this.

Here's something that sounds promising:
http://www.windowsitpro.com/Article/ArticleID/14346/14346.html?Ad=1

-JMB
 

        |   -----Original Message-----
        |   From: xyberpix [mailto:xyberpix () xyberpix com] 
        |   Sent: Thursday, September 15, 2005 2:26 PM
        |   To: pen-test () securityfocus com
        |   Subject: MS SQL Server
        |   
        |   -----BEGIN PGP SIGNED MESSAGE-----
        |   Hash: SHA1
        |   
        |   Hey All,
        |   
        |   Ok, so here's the deal, I've managed to compromise 
        |   a Win2k server at a clients site, and this also has 
        |   thier Peoplesoft and Remedy databases on it, 
        |   running on MS SQL 2000. I have been able to 
        |   successfully add myself to the local Administrators 
        |   group, and can now TS into the box in question. I 
        |   have absolutely no rights on the SQL server though, 
        |   so any pointers here would be greatly appreciated!  
        |   I found a backup of the Remedy db, and by setting 
        |   up a SQL server on one of my machines managed to 
        |   restore it, and I now have access to that, thatnks 
        |   to a load of MS SQL howto's online, but I am more 
        |   concerned about getting the Peoplesoft db data, but 
        |   no such joy with finding backups lying around.
        |   
        |   Ideally I would like to try and avoid commercial 
        |   tools, but as far as compromising a SQL server, 
        |   I've never done it before, and could do with any 
        |   help that I can get here.
        |   TIA
        |   
        |   xyberpix

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------