sqlsql-serversql-server-2008t-sql

Extract password from SQL Login


I need to write a script to extract SQL login's password and spread it to another Server.

I did this:

Declare @PasswordBinary varbinary(256)
Set @PasswordBinary = CAST(LOGINPROPERTY( @LoginName, 'PasswordHash' ) AS varbinary (256))

Exec sp_hexadecimal @PasswordBinary, @PasswordStr Out

The sp_hexadecimal :

Create PROCEDURE [dbo].[sp_hexadecimal]
    @binvalue varbinary(256),
    @hexvalue varchar (514) OUTPUT
AS
  DECLARE @charvalue varchar (514)
  DECLARE @i int
  DECLARE @length int
  DECLARE @hexstring char(16)

  SELECT @charvalue = '0x'
  SELECT @i = 1
  SELECT @length = DATALENGTH (@binvalue)
  SELECT @hexstring = '0123456789ABCDEF'

  WHILE (@i <= @length)
  BEGIN
     DECLARE @tempint int
     DECLARE @firstint int
     DECLARE @secondint int

     SELECT @tempint = CONVERT(int, SUBSTRING(@binvalue,@i,1))
     SELECT @firstint = FLOOR(@tempint/16)
     SELECT @secondint = @tempint - (@firstint*16)

     SELECT @charvalue = @charvalue +
                         SUBSTRING(@hexstring, @firstint+1, 1) +
                         SUBSTRING(@hexstring, @secondint+1, 1)

     SELECT @i = @i + 1
  END

  SELECT @hexvalue = @charvalue

I have a variable

@SQL nvarchar(max) = 'CREATE LOGIN ' + QUOTENAME(@LoginName) + ' With PASSWORD = ' + @PasswordStr + ' HASHED'''

which I send it to the stored procedure on a remote server and I execute this variable there:

 Exec (@SQL)

but I got an error:

The @SQL variable is set to : 'Create Login [Name] With password = 0x Hashed'

Thanks :)


Solution

  • Change your procedures to add quotes on your password:

    SET @tmpstr = 'CREATE LOGIN [' + @name + '] WITH PASSWORD=' + @txtpwd + ' HASHED'